Privacy Policy

1. Identity and contact details of the controller.

Lopesan Hotel Management, S.L., domiciled at C/ Concepción Arenal 20, 2º Cial., 35006, Las Palmas de Gran Canaria (Las Palmas, Spain), with employer identification number B-76261130, and telephone number 928402418 (“Lopesan”) is the controller of the personal data. This clause provides information on the use that Lopesan will make of your personal data.

The purpose of this Privacy Policy is to provide information on your rights under the General Data Protection Regulation (“GDPR”). If you have any questions regarding the processing of your data, please contact Lopesan at the following address: dpo@lopesan.com.

We also inform you that the Group to which Lopesan belongs has a data protection officer designated at a Group level who you may contact at the following address dpo@lopesan.com.

2. General information: description of the information contained in the privacy policy.

In this privacy policy you will find a table that sets out the different types of services offered by Lopesan.
In these tables you will find information on:
• The purposes of the processing of your data, that is, the reason why Lopesan processes your personal data.
• The legal basis that enables Lopesan to process your data for each of the purposes indicated.
• The possible disclosure of your data to third parties, as well as the ground for the disclosure. For these purposes we inform you that we may disclose your personal data to third parties where there is a legal obligation to do so (tax authorities, judges and the courts and law enforcement agencies) and to the bank to manage the reservation or if we expressly indicate that we do so in the table below. In addition, data processors of Lopesan, i.e., service providers who need to access your data in order to perform their functions, may have access to your data. The service providers accessing your data generally operate in the information systems and technology, marketing and hotel industries. The other industries in which Lopesan’s service providers that have to access your data operate are set out in the table below.
• You may request more detailed information on the recipients of your data by sending an email to dpo@lopesan.com, indicating the specific processing for the recipients in relation to which you require information.
• The existence of potential international data transfers.
• The storage period of the data provided by you. In this regard we inform you that we will store your data for the entire duration of the contractual relationship or for longer if you have authorized us to do so. We also inform you that your data will subsequently remain blocked for the purposes of handling legal, administrative or tax claims, for the periods stipulated in each applicable law.

3. Necessary, up-to-date information

Completion of all the fields marked with an asterisk (*) or regarding which the system requires completion in the forms provided is compulsory. Failure to fill out any of these fields could prevent you receiving the services. You must provide truthful information; using an alias or other methods to hide your identity is prohibited.
In order to ensure that the information provided is always up to date and does not contain errors, you should inform Lopesan as soon as possible of any amendments to or changes in your data at reception or via the following email: dpo@lopesan.com.
By accepting this document, you state that the information and data you have provided are accurate and true.

4. Exercise of your rights

You may exercise the following rights:
• the right of access to your personal data to know which data are being processed and the processing operations that are being performed with that data;
• the right to rectification of any inaccurate data;
• the right to erasure of your personal data, where possible;
• the right to request the restriction of the processing of your personal data where the accuracy, legality or need to process the data is doubtful, in which case we may store your data duly blocked for the exercise or defense of claims;
• the right to object to the processing of your personal data, when the legal basis that enables us to process them, of those indicated in the above table, is legitimate interest. Lopesan will cease to process your data unless it has a compelling legitimate interest to do so or it is necessary for the defense of claims.
• the right to data portability, when the legal basis that enables us to process your data, set out in the table included in point 5, is the existence of a contractual relationship or your consent;

You may exercise your rights at any time, without charge, by sending an email to dpo@lopesan.com, indicating the right you wish to exercise and your personal particulars.
You may also lodge a complaint with the Spanish Data Protection Agency if you consider that data protection legislation has been breached in the processing of your personal data.

5. Detailed information on the processing carried out.

Purpose of the processing	Legal basis	Recipients	International transfers	Storage period
Management of your reservation and/or purchase via the website. -Management of your reservation and/or purchase. -To send confirmation of the reservation. -To process, where applicable, payment of the reservation. -To send quality surveys.	Management of the contractual relationship consisting of the provision of the eservation management services requested	The categories of data disclosees and service providers that may access your data are indicated in section 2 of this Policy. We will also disclose your data to the establishment at which you have decided to make the reservation/purchase since such disclosure is necessary in order to provide our services. In this regard we inform you that the hotel’s processing of the reservation data is limited to the actual management of such data, which will be performed on the same terms as those indicated in this privacy policy.	Your data may be accessed by technology and information systems service providers, by entities that perform surveys and manage personal data located outside the European Economic Area. Lopesan will adopt the relevant standard contractual clauses and will require adhesion to the Privacy Shield or additional safeguards. In addition, your data may be transferred to countries outside the European Economic Area should you decide to receive services at our establishments located outside the EU, since we must disclose your data to the hotel at which you are staying in order to for it to be able to provide the services requested. For further information on the transfers and safeguards adopted please write to: dpo@lopesan.com.	Throughout the contractual relationship and for up to 10 years after your reservation and/or purchase on our website.
Management of your registration as user of Lopesan’s website. -Management as user of the website -To send confirmation of the registration	Management of the contractual relationship consisting of providing the registration service as user of the website	The categories of data disclosees and service providers that may access your data are indicated in section 2 of this Policy.	Your data may be accessed by data management service providers established outside the European Economic Area. Lopesan will adopt the relevant standard contractual clauses and will require adhesion to the Privacy Shield or additional safeguards. In addition, if you register as user of Lopesan’s website from a country located outside the European Union, we inform you that from that perspective, international transfers of your data to Spain are performed. For further information on the transfers and safeguards adopted please write to: dpo@lopesan.com.	During the contractual relationship, i.e., until you unsubscribe as user of the website.
Management of the queries form – Management of requests and queries made via the contact form	Lopesan’s legitimate interest in attending to requests for information or claims made by users of the website.	The categories of data disclosees and service providers that may access your data are indicated in section 2 of this Policy. We will also disclose your data to the establishment in which you have received the services since this disclosure is necessary to reply to possible complaints or claims. In this regard we inform you that the establishment’s processing of your reservation data is limited to resolving the compliant, which will be performed on the same terms as those indicated in this privacy policy.	Your data will be transferred to countries outside the European Economic Area only if we provide services to you at establishments located outside the European Union, since we must disclose your data to the hotel at which you are staying in order to for it to be able to respond appropriately to your claims or complaints. These international transfers are regulated by standard contractual clauses approved by the European Commission. You can obtain a copy of this information by writing to dpo@lopesan.com.	Until the query, incident or claim has been resolved.
To send commercial communications and subscribe to the newsletter which includes: -Sending marketing communications. -Invitations to events. -Promotion of our products. -Sending news about developments in the industry. -Sending information of interest regarding Lopesan.	Your consent	The categories of data disclosees and service providers that may access your data are indicated in section 2 of this Policy.	Your data may be accessed by systems and information technology and marketing s ervice providers established outside the European Economic Area. Lopesan will adopt the relevant standard contractual clauses and will require adhesion to the Privacy Shield or additional safeguards. For further information on the transfers and safeguards adopted please write to:dpo@lopesan.com.	Until you unsubscribe from the service or make clear that you are not interested in receiving our commercial communications.

6. Confidentiality

The personal data we may collect will be treated as confidential and we undertake to keep such data confidential in accordance with applicable legislation.

7. Minors

Minors under the age of 18 may not make reservations at the hotel, and minors under 14 years’ of age may not use the other services available on the website without prior authorization from their parents, guardians or legal representatives. Such parents, guardians or legal representatives have exclusive responsibility for the conduct of the minors in their care, including completing forms with the personal data of such minors and ticking the accompanying boxes, where applicable.

8. Updates to the privacy policy

This Privacy Policy may need to be updated. You should therefore review this policy periodically and if possible every time you make a reservation with us in order to ensure that you are duly informed of the type of information collected and its processing. We will inform you of any changes to this privacy policy that affect the processing of your personal data.

9. Additional privacy information

If you visit our website as representative of a travel agency or as a job candidate for any of the Group’s offers, you can find detailed information on the processing of your data at the following link: Travel agency privacy policy.