IT'S ALL YOURS

Data Controller 1:

The data controller in charge of your data is the "Hotel" (as defined in the email sent to you)

Data Controller 2:

The data controller in charge of your data is Barceló Gestión Hotelera, S.L. (hereinafter, for the purposes of this document, “BGH”, "Barceló" or “Barceló Gestión Hotelera”) with registered office at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca.

These clauses do not define any joint controllers regarding the processing of the data by the indicated entities.

If you have any queries regarding data protection, please get in touch with the Barceló Group Data Protection Office by sending an email to dpo@barcelo.com. 

BGH hereby informs the data subject that Barceló will process their personal data for the following purposes: 

1. Managing bookings and requested services.

In order to manage the booking received by the central office or through a channel outside Barceló Gestión Hotelera (by way of example, Expedia, Booking, Agencies or Tour Operators with which the customer has made their booking), the Hotel requires certain customer information, such as: name, surname, address, ID, passport or equivalent identification document, email, telephone number or date of birth. This information will be used to assign them the requested stay or other requested service other than the accommodation service (e.g., events, celebrations, conferences).

If the customer requests specific services from the Hotel (e.g., SPA or medical services) providing data related to their health, said Hotel understands that such information is voluntarily communicated by the customer, as there is no prior request for this information. These personal data will only be processed to manage the customer's request. However, the Hotel will request the interested party’s consent in order to process this data.

Likewise, in the event that data from third parties related to the customer (e.g. relatives, companions) has to be processed in order to provide the Hotel services, said customer guarantees the veracity of the information provided regarding said third parties, and they guarantee they will have fulfilled the duty to inform said third parties that their data will be communicated to the Hotel and, where appropriate, they will have obtained their consent for the processing thereof.

Legitimacy: This processing is necessary for the performance of the contract. 

2. Processing minors' data In the event that personal data related to a minor must be processed in order to manage the service, the Hotel will request the proper authorisation from their legal representatives when said minor is under the age of 14, even if the processing of their personal information is necessary to satisfy the services requested by the legal representatives of the minor. This authorisation will be deemed to extend to the processing of the minor’s data that is necessary for the provision of the services that concern them (e.g., entertainment services, mini-club, nursery).

Legitimacy: This processing is necessary for the performance of the contract. However, in the event that the minor is under the age of 14, the Hotel will request the authorisation of their legal representative for the processing of their personal data.

3. Compliance with accounting, legal, fiscal and administrative obligations.

Legitimacy: This processing is necessary for the performance of the contract. 

4. Communicating the information generated in the Hotel to Barceló Gestión Hotelera and to the hotels in the Barceló network for product customisation. With the customer’s consent, the Hotel, with the purpose of customising the services that it may offer in the future to its customers, will communicate to Barceló Gestión Hotelera and to the companies that own the hotels that are part of the Barceló network, the information generated by the customer while using the services offered in the Hotel in which the customer is staying. This information is very useful to Barceló and its hotels in order for them to offer their customers personalised products according to their commercial preferences as demonstrated by their use of the services offered in the hotels, in order to improve the customer’s experience in future bookings.

This communication may involve an international data transfer when the destination hotel is located outside the European Union. In any case, BGH has adopted the appropriate guarantees to regulate international data transfers with the aforementioned Hotels, by signing the Standard Contractual Clauses.

Legitimacy: This processing is necessary for the performance of the contract. The customer can revoke their consent by following the indications in section VI.

5. Management of customer complaints. The Hotel will process the data included in the complaints filed by the customer in order to process such complaints and they may offer discounts or more beneficial conditions in subsequent stays to compensate for the damage that the customer may have suffered in the Hotel.

Where appropriate, the information related to the complaint can be communicated to Barceló Gestión Hotelera in order to offer a satisfactory solution to the customer. For the same purpose and in the event that the customer has suffered indemnifiable damage, BGH will communicate this information to the hired insurance company in order to manage the loss suffered by the customer.

Legitimacy: This processing is necessary for the performance of the contract. 

6.  Communciation of data to Barcleló Gestión Hotelera for customer service. Barceló Gestión Hotelera provides a customer support service to handle the requests generated by the customers or potential customers of the hotels, regarding both information requested prior to the booking process as well as queries arising in relation to bookings already made or services offered by the hotels. Where appropriate, requests submitted by customers to the Hotel may be referred to Barceló Gestión Hotelera in order to ensure centralised management at the Group level.

Legitimacy: This processing is necessary for the performance of the contract.

7. Communication of data to Barceló Gestión Hotelera for administrative purposes. For accounting purposes, as well as to conduct internal audits or internal business valuations, the Hotel may communicate the data of its customers to BGH. As the Hotel will only process these data in order to carry out administrative, statistical, internal business valuation processes or corporate audits, the customer will not be harmed in any case by such processing nor will their rights pertaining to data protection be affected. The Hotel will carry out the aforementioned data communication based on its legitimate interest in order to thus improve the provision of its services.

8. Submission of quality surveys. The customer has forms at their disposal in which they can fill out surveys anonymously or identify themselves. In the latter case, the Hotel will process the information related to the owner of the survey and their opinion in order to improve the services provided in the Hotel, and may communicate it to Barceló Gestión Hotelera in order to improve our services at the Group level, both in the referenced Hotels as well as in other hotels. This information may also be communicated for commercial purposes based on the provisions of purpose 3 of this section, provided that the customer has given their consent for this purpose.

Legitimacy: This processing based on the legitimate interest of the hotel. The customer can opt out of receiving this type of communication at any time by following the instructions in section VI.

9. Implementation of controls for the detection of fraudulent activities. In order to control and monitor actions that may be fraudulent, the Hotel would like to inform customers that it carries out an analysis of the transactions that are carried out in the Hotel in order to identify and conduct a more in-depth analysis of those transactions that it detects as suspicious of being fraudulent.  Where applicable, the Hotel may provide Barceló Gestión Hotelera with access to this information as the hotel's legal advisor.

Legitimacy: this processing is based on the legitimate interest of BGH, given that it involves the control and monitoring of all transactions carried out by its customers for the detection of possible fraudulent activities in the transactions taking place during the booking process. The customer may object to the processing of their data by following the instructions set out in section VI.

10. Communication of data to Law Enforcement. As legally required, the Hotel must communicate the information related to the customers that occupy the rooms to the Police Forces and Security, who will in turn process the information for their own purposes and under their own legal basis.

Legitimacy: This processing will be carried out under the legal obligation applicable to the Hotel established by Spanish Organic Law 4/2015, of 30th March, on the protection of public safety, the Schengen Agreement and Order INT/1922/2003, of 3rd July, on registry-books and entry reports for travellers in hotels and other similar establishments.

11. Legal or administrative procedures. In the event of possible legal or administrative proceedings that may arise as a result of services offered or provided by the Hotel, the Hotel will process the information necessary to make the appropriate allegations, exercise its right of defence or lodge any claims that it deems appropriate depending on the events that have taken place.

Legitimacy: This processing is based on legal obligations, marked by administrative regulations (mainly the Law of Common Administrative Procedure) or is necessary for the Hotel to exercise its legitimate right to effective judicial protection, both in its right of defence and in the filing of legal claims that it deems appropriate, based on the Spanish Civil Procedure Law or the Spanish Criminal Procedure Law.

12. System incident management The Hotel will process any information belonging to its customers that is necessary to manage any reported incident or any incident that the Hotel itself detects by its own means (including those incidents that its service providers may detect). Such data processing will only be performed to solve the incident and resolve any problems derived from it. The Hotel understands that it has a legitimate interest in anticipating the safety of its IT assets, as well as resolving any incidents that put said safety, or the continuity of the provision of the services offered to customers, at risk.

Legitimacy: This data processing is required to satisfy the legitimate interests of the Hotel. Customers can oppose the processing of their data for such purposes by following the instructions set out in section VI at any time.

13. Processing of video-surveillance data. This processing will be carried out in accordance with the information clause related to video surveillance, available from reception upon the customer’s request.

14. Barceló App data processingThis processing will be regulated through the Privacy Policy found on the App itself.

BGH will send a link to your email through which you can download the Barceló App. The Barceló app will provide the customer with general hotel information, as well as information regarding the different services offered by the Hotel upon request by the customer.

Legitimacy: This processing is based on the legitimate interest of the Hotel, given that if the customer downloads the Barceló app, they will have information about the Hotel at their disposal.

1. Commercial communications sent by any means with offers related to the following products and/or services:

· Those that they have already booked or that they book at the Hotel.

· Those that the customer can enjoy at the Hotel (e.g., furniture in the booked room).

· Those related to tourism and leisure, such as cultural activities, excursions, sporting events, etc.

Based on the information received by BGH from the Hotel, personal data may be processed to create profiles (e.g. product preferences based on consumption at the Hotel, surveys completed at the Hotel...) whose results allow the preparation and analysis of personalised products, through segmentation into different groups in relation to common patterns. These profiles will only be used to send personalised communications regarding the products and services indicated above. This processing will not affect any commercial communications that BGH sends to the customer based on their legitimate interest, as described in the informative clause provided by BGH in the reservation of a Hotel of the Barceló network through its own channels (website, phone, email).

Legitimacy:This processing will only be carried out if BGH has the customer’s consent, except in the event that the data subject is a BGH customer and has already contracted services with this entity. The customer can revoke their consent by following the indications in section VI.

2. Customer complaint management. In order to manage any complaints that customers have made regarding the services booked at the hotels in a centralised way, BGH will receive the information related to the complaint generated at the hotel, with the aim of dealing with the complaint and offering an appropriate solution to the customer, whether by offering discounts or more beneficial conditions in subsequent stays to compensate for the damage. As a result, BGH requires access to the information generated by the customer at the hotel to be able to adequately deal with their complaint.

Where appropriate, if the complaint warrants compensation for damage suffered by the customer, BGH will transfer this information to the insurance company contracted by BGH in order to investigate the incident suffered by the customer.

Legitimacy: This treatment is necessary for the performance of the contract with the Hotel, in accordance with the description of the present purpose with regards to the processing carried out by BGH.

3. Customer service. BGH has customer service to deal with requests generated by customers or potential customers, in relation to questions regarding services offered by the hotels.

Legitimacy: This treatment is necessary for the execution of the contract with the Hotel, in accordance with the description of the present purpose with regards to the processing carried out by BGH.

4. Online reputation monitoring. BGH may, based on the information received from the Hotel, check the ratings given by customers on websites such as TripAdvisor. The purpose of this is to monitor its online reputation and be able to make business decisions that ensure the continuous improvement of its services, contacting customers who have suffered a negative experience in order to propose possible solutions. BGH understands that it has a legitimate interest in improving its services and protecting its brand.


Legitimacy: this processing is based on the legitimate interest held by BGH to protect its brand’s online reputation and resolve claims and complaints made on websites such as those mentioned. The customer has the right to object to the said processing of their personal data by following the instructions set forth in section VI.

5. User registration for MyBarcelóBGH will process the identification data required to enable the users’ registration for their myBarceló platform, designed for users to enjoy specific discounts when booking BGH products, request information concerning the hotels or enjoy services available solely to myBarceló users.

Those users who reach the myBarceló Unique level could:

· Receive special gifts as a reward for using the benefits and the special promotions offered by myBarceló.

· Provide the personal data of a third party so that they can enjoy discounts when contracting BGH products.

If users wish to register by identifying themselves via Facebook, Google+ or Twitter, they should be aware that in such cases said entities will provide us with information related to their identity (name, surname(s) and/or relevant network ID), as well as any information the users wish to share when using this option to register.

Legitimacy: data will only be processed if BGH has received users’ consent. 

Notwithstanding the foregoing, BGH will send special gifts to Unique level users based on a legitimate interest, considering the relationship between BGH and the user and the use by the user of the special conditions offered by myBarceló. The user will have the right to object to this processing of personal data at any time by following the instructions set forth in section VI.

If the Unique level user provides personal data belonging to a third party in accordance with the provisions of this paragraph, said user will guarantee the veracity of the information disclosed to BGH, and ensure that the third party has been informed and that their express consent has been obtained for the aforementioned transfer.

After registering for the myBarceló Loyalty Programme, users will receive an SMS offering to subscribe to BGH’s SMS Alerts Programme, BGH Alerts. The Programme sends registered users SMS alerts relating to updates to their stays and alerts regarding promotions and abandoned online shopping baskets. To subscribe to the BGH Alerts Programme, users must be registered for the MyBarceló Loyalty Programme and answer YES to the SMS received to confirm their subscription to the BGH Alerts Programme. If help is required regarding the Programme, users must send an SMS with the word HELP. To unsubscribe from the Programme, users must send an SMS with the word STOP. Users subscribed to the BGH Alerts Programme will receive two messages per month. Data and/or message rates established by their operator may apply.

Legitimacy: Data will only be processed if BGH has obtained users’ valid consent by sending YES confirming their subscription to the Programme.

6. Barceló App data processingThis processing will be regulated through the Privacy Policy found on the App itself

7. Processing of data regarding access to the Wi-Fi network provided by BGH: This processing will be carried out in accordance with the privacy policy accepted by the customer when using the Wi-Fi services offered in the hotels.

The personal data to which we have access will be processed for as long as the contractual relationship exists. After this, the Hotel will keep the personal data once the contractual relationship is terminated, duly blocked, in order to make them available to the competent Public Authorities, Judges and Courts or the Public Prosecutor during the statutory limitation period for claims that may arise from the relationship maintained with the customer and/or the legally established storage periods. Once these periods have elapsed, the Hotel will physically delete the data.

BGH will process the information provided by the Hotel, based on the performance of the contract or a legitimate interest, as appropriate in each case, storing it until the purposes for which it was collected have been fulfilled.

On the other hand, with regards to the data processed by BGH that have been transferred by the Hotel based on the customer's consent, BGH will keep said information as long as the consent is not withdrawn or no request is received regarding the right to delete.

In any case, once the indicated purposes have been fulfilled, consent is withdrawn or the right to delete is exercised, both BGH and the Hotel will keep the personal data, duly blocked, to meet possible requirements from Public Administrations or the courts, in accordance with the provisions of current data protection regulations.

The Hotel may share your data to:

· BGH and companies owning hotels in the Barceló network. As previously indicated, sharing the data may entail an international transfer.

· Competent Public Bodies, Judges and Courts, and in particular, Law Enforcement.

· Beside the aforementioned data sharing, the Hotel works with third parties who provide services and have access to customers’ personal data, which they process in representation and on behalf of BGH as a result of providing said services. In particular, the Hotel hires third parties to supply, for example and not limited to, services in the following sectors: legal advice, multidisciplinary professional services, tech services, IT services.

Barceló Gestión Hotelera may communicate the data to:

BGH's insurance brokerage and insurance company in the event that the customer suffers indemnifiable damage.

· Competent Public Bodies, Judges and Courts.

· Beside the aforementioned data sharing, BGH works with third parties who provide services and have access to customers’ personal data, which they process in representation and on behalf of BGH as a result of providing said services. Specifically, BGH hires third parties to provide services in the following sectors, including but not limited to: legal advice, multidisciplinary professional services, tech services and IT services. Providers include Salesforce Inc., an American company certified under the Privacy Shield.

Customers may, if they so wish, exercise their right to access, amend and delete their data, as well as request that the processing of their data be limited, object to said processing, request the portability of their data, and request that they not be subject to individual decisions based on automated processing.

In any event, the customer is hereby informed that any request to exercise their rights related to personal data will be managed by the Data Protection Officer located at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca, or by sending an e-mail to dpo@barcelo.com, attaching to this request, in both cases, a copy of their National Identity Document, Tax ID number, or an official document that identifies them.

With regards to any processing that requires their consent, the customer may withdraw their consent through the procedure detailed in the previous paragraph.

The Hotel has received the information related to the interested party through:

(i) Barceló Gestión Hotelera, if the Hotel's services have been requested through the BGH website, telephone channels or e-mail.

(ii) Third parties outside BGHarceló, such as tour operators, agencies or entities such as Expedia, Booking or similar.

The customer may file a claim with the Spanish Data Protection Agency regarding the reply they received from the hotel and Barceló Gestión Hotelera in addressing their rights.

In any case, users are hereby informed that any claims relating to the processing of personal data will be managed and processed by the Data Protection Officer of Barceló Gestión Hotelera, S.L., located at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca, or by sending an email to dpo@barcelo.com, attaching a copy of their National Identification Document, Tax Identification Number or an official identification document.