Privacy Policy
PRIVACY POLICY
1. Initial information
At Ona Hotels & Apartments, your personal information is very important to us. That is why we process it confidentially and securely. We are committed to guaranteeing the privacy of personal data at all times and to not collecting unnecessary information.
2. ¿Who processes your data?
The user is informed that the following group of companies group of companies come under the Ona Hotels & Apartments brand, with CLUBOTEL LA DORADA, S.L. being the main establishment where the data are stored and managed which has the following identification data:
Company Name: CLUBOTEL LA DORADA, SL
Tax ID (NIF): B61502035
Address: C/ Calabria 129, entresuelo, 08015, Barcelona
Email: gdpr@onahotels.com
Likewise, the data of the persons concerned will be processed by the companies in which Ona Hotels & Apartments acts as manager. In this regard, you can consult the details of the Data Controller, according to the accommodation, by clicking here.
Data Protection Officer:
Company Name:TARINAS VILADRICH ADVOCATS I PROCURADORS, S.L.P.
Contact: gdpr@onahotels.com
3. Data processing in Europe
In accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as with Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, we provide you with information on the processing of your data through this Privacy Policy.
4. What data do we collect, for what purposes, and for how long?
| DATA PROCESSING | PURPOSE AND LEGAL BASIS | RETENTION PERIOD |
| Functioning of the Website | To ensure the proper functioning of the website, as well as its all its features, personal data will be processed to the extent strictly necessary to provide and ensure the security of the application and information, with the legitimate basis being the legitimate interest pursued by the controller, in accordance with Art. 6.1.f) of the GDPR. | The data collected will be kept for the time strictly necessary to fulfil the purpose for which they were collected, and in any case to determine the possible liabilities that may arise from this purpose, taking into account the periods established in the corresponding regulations. |
| Contact | To respond to requests and/or queries made by the user, with the legal basis of the processing being express consent in accordance with Art. 6.1.a) of the GDPR. | The data will be kept until the request has been resolved. In any case, they may be kept in order to determine the possible liabilities that may arise from this purpose. |
| Sending of information about the company and newsletter. | Subscription to the company's news, promotions and offers, with the legal basis for the processing being express consent in accordance with Art. 6.1.a) of the GDPR. | The data will be kept for the duration of the subscription to the Newsletter or until the exercise of the right to objection or erasure of the data by the data subject. In any case, they may be kept in order to determine any possible liabilities that may arise from this purpose. |
| Email management | The purposes of data processing are to respond to queries received, as well as to manage the commercial and/or professional relationship, with the legal basis being the contractual relationship between the Data Controller and the data subject, in accordance with Art. 6.1.b) of the GDPR. | The data collected will be kept for the time strictly necessary to fulfil the purpose for which they were collected, and in any case to determine the possible liabilities that may arise from this purpose, taking into account the periods established in the corresponding regulations. |
| CV management | The corresponding data will be processed for the purpose of dealing with your application and to form part of the selection process. The processing of personal data is justified by the implementation of pre-contractual measures at your request in accordance with Art. 6.1.b) of the GDPR. |
The data will not be kept for longer than necessary for the purpose for which they were collected, unless there is a legal obligation to do so. In this case, they will be kept for a maximum period of one year. |
| Check-in management | The data will be processed in order to manage the online check-in process, with the legitimate basis being the contractual relationship in accordance with Article 6.1b) of the GDPR. | The data will be kept for a maximum period of three years. |
| Booking management | The data will be processed in order to manage bookings. The processing of personal data is justified by the implementation of pre-contractual measures at your request in accordance with Article 6.1.b) of the GDPR. |
The data collected will be kept for the time strictly necessary to fulfil the purpose for which they were collected, and in any case to determine the possible liabilities that may arise from this purpose, taking into account the periods established in the corresponding regulations. |
The user may register as a club member in order to be able to receive informative communications from Ona Hotels & Apartments and enjoy the advantages of being part of the Club, with the legal basis of the processing being express consent in accordance with Art. 6.1.a) of the GDPR.
The data will be kept for the duration of the subscription to the Newsletter or until the exercise of the right to objection or erasure of the data by the data subject. In any case, they may be kept in order to determine any possible liabilities that may arise from this purpose.
Likewise, the user is informed that the Ona Hotels & Apartments group of companies will act as Joint Data Controllers.
The user may unsubscribe as a member of the club, as well as revoke consent to receive commercial communications by following the steps listed in the section “What rights do you have as a user and how can you exercise them?”.
6. To whom will the data be disclosed?
The data will be disclosed to CLUBOTEL LA DORADA, S.L., the establishment where the data are stored and managed, with the legal basis being the legitimate interest in transmitting personal data within the business group for internal administrative purposes.
The personal data of guests relating to the identity document number, type of document and date of issue, name and surname, sex, date of birth and country of nationality, date of entry, and signature of the traveller will be disclosed to the State Security Forces and Corps, with the legal basis for this disclosure being a legal obligation.
They will not be disclosed to other third parties except where required by law or with the express consent of the data subject.
7. Ona Hotels & Apartments as manager
CLUBOTEL LA DORADA, S.L. acquires the status of Data Processor for those hotels where it manages the accommodation. In this regard, the user can access information on the Data Controllers depending on their accommodation by clicking here.
8. Are international transfers of data carried out?
No international data transfers to third countries outside the European Union are carried out.
9. What rights do you have as a user and how can you exercise them?
9.1. Right to access
As a user, you can ask us to explain what we do with your personal data.
You can also ask us for information about the purpose of the processing of your personal data, how long we keep your data for, what rights you have as a user, whether your data has been transferred to a third country or an international organisation, the existence of automated decisions, or whether profiling is carried out on the website, among other things.
9.2. Right to access
If the personal data you have provided us with is inaccurate or incomplete, you have the right to correct or complete it. Please contact us and we will correct the data in accordance with your request.
9.3. Right to the restriction of processing
As a User you can request the restriction of the processing of your personal data when:
•You dispute the accuracy of your personal data for a period of time that allows us to verify its accuracy.
•If the processing is unlawful and you object to the erasure of your personal data and, instead of erasure, you request that their use be restricted.
•If we no longer need your data for the purposes of processing, but you need it to make, exercise, or defend claims.
9.4. Right to erasure
You can request that we erase your personal data immediately. We are obliged to delete this data immediately if the data are no longer required for the purpose for which they were collected. In addition, you can ask us to erase your data if you change your mind in terms of consent, if you object and there are no justified reasons for the processing, if your data are processed incorrectly, if they have to be erased in order to comply with a legal obligation, or if your data are obtained in relation to a legal offer.
9.5. Right to information
If you have exercised your right to rectification, erasure, or restriction, we are obliged to inform all recipients to whom your personal data have been disclosed of said rectification, erasure, or restriction of processing, unless this proves impossible or involves a disproportionate effort.
As a User, you have the right to be informed by the data controller about who these recipients are.
9.6. Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. In addition, you have the right to transfer this data to another data controller without us being able to prevent this.
9.7. Right to object
As a user, you have the right to object at any time to the use of the personal data made available to us for specific personal reasons.
We will stop processing your personal data unless we have compelling legitimate grounds for using them, if these grounds prevail over your interests, rights, and freedoms, or if the processing is for the purpose of making, exercising or defending claims.
9.8. Right to revoke the data protection declaration of consent
As a User you have the right to change your declaration of consent regarding data protection at any time. This change of decision regarding consent will not affect the lawfulness of the processing that took place based on the consent given prior to its withdrawal.
9.9. Automated individual decisions, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for the User or significantly affects the User in a similar way.
9.10. Right to lodge a complaint with a supervisory authority
As a User you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or the place where the infringement takes place, if you believe that the processing of personal data entails a breach of the GDPR.
9.11. How can you exercise your rights?
The user may request the exercise of their rights by sending an email to gdpr@onahotels.com
Likewise, in order to facilitate the exercise of the rights established in Articles 15 to 22 of the General Data Protection Regulation (EU) 2016/679 and Articles 12 to 18 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, and without their use being compulsory, a number of application forms for the different rights are made available to data subjects.
· Access
· Opposition
· Erasure
· Restriction of processing
· Rectification
· Portability
10. Do I have to provide all the information requested in the data collection forms?
For the forms on the Website, you must complete those marked as “required”. Failure to complete the required personal data fields or doing so partially may mean that Ona Hotels & Apartments will not be able to respond to your requests and, consequently, Ona Hotels & Apartments will be held harmless from any liability if the services requested are not provided or provided only partially.
The personal data provided by the User to Ona Hotels & Apartments must be current to ensure that the information in the records is up to date and error-free. The User shall be responsible for the accuracy of the data provided.
11. What security measures do you have in place?
We inform you that we take care of and use your personal data in accordance with the current regulations on data protection and information society services.
We have implemented the necessary technical and organisational security measures to guarantee the security of the User's personal data and prevent its alteration, loss, processing, and/or unauthorised access in accordance with the state of the art, the nature of the data stored, and the risks to which they are exposed, whether from human action or the physical or natural environment, in accordance with the provisions of current legislation.
Ona Hotels & Apartments Group of Companies
| Complex | Data Controller |
| Ona Valle Romano | Clubotel La Dorada, S.L. |
| Ona Palmira Paradise Paguera | Clubotel La Dorada, S.L. |
| Ona Palmira Paguera | Clubotel La Dorada, S.L. |
| Ona Garden Lago | Clubotel La Dorada, S.L. |
| Ona Suites Salou | Clubotel La Dorada, S.L. |
| Ona Jardines Paraisol | Clubotel La Dorada, S.L. |
| Ona Aquamarina | Clubotel La Dorada, S.L. |
| Ona Internacional | Clubotel La Dorada, S.L. |
| Ona Palamós | Clubotel La Dorada, S.L. |
| Mosaic By Ona | Clubotel La Dorada, S.L. |
| Ona Living Barcelona | Clubotel La Dorada, S.L. |
| Ona Aldea del Mar | Clubotel La Dorada, S.L. |
| Ona Las Lomas Village | Clubotel La Dorada, S.L. |
| Ona Marina Arpón | Clubotel La Dorada, S.L. |
| Ona Marinas de Nerja | Apartur Marinas de Nerja, S.L. |
| Ona Club Bena Vista | Wimpen Leisure Management, S.A. |
| Ona Alanda Club Marbella | Galatea Marbella, S.L.U. |
| Ona Campanario | Ona Campanario Management, S.L. |
| Ona Cala Pi | Cala Pi Maintenance, S.L. |
| Ona Village Cala D'Or | Cala Pi Maintenance, S.L. |
| Ona Aucanada | Inmobiliaria Aucanada, S.L. |
| Hollywood Mirage-Excel Hotels & Resorts | Excel Hotels & Resorts, S.A.U. |
| Beverly Hills Suites-Excel Hotels & Resorts | Excel Hotels & Resorts, S.A.U. |
| Beverly Hills Heights-Excel Hotels & Resorts | Excel Hotels & Resorts, S.A.U. |
| Ona Los Claveles | Wimpen Leisure Management, S.A. |
| Palm Beach-Excel Hotels & Resorts | Excel Hotels & Resorts, S.A.U. |
| Ona El Marqués | Wimpen Leisure Management, S.A. |
| Ona Las Rosas | Wimpen Leisure Management, S.A. |
| Ona Sueño Azul | Wimpen Leisure Management, S.A. |
| Bahía Blanca | Bahía Blanca Leisures, S.L. |
| Ona Las Brisas | Wimpen Leisure Management, S.A. |
| Ona Las Casitas | Wimpen Leisure Management, S.A. |
| Ona Ogisaka Garden; | Ogisaka Costa Blanca, S.L. |
| Ona Las Zarzas | Ogisaka Costa Blanca, S.L. |
Ona Hotel & Apartments as manager
| Complex | Data controller |
| Ona Diana Park | Vive Resort Management, S.L.. |
| Ona Marbella Inn | Vive Resort Management, S.L. |
| Ona Benalmar/td> | Vive Resort Management, S.L. |
| Ona Alborada | Peninsula Management, S.L. |
| Casa Lit Barcelona by Ona | Inversiones Riera San Miquel, S.A.U. |
| Ona Mar Menor-The Residences | Bainbridge Spain, S.L. |
| Ona Mar Menor-Golf Resort & Spa | Bainbridge Spain, S.L. |
| Ona Hacienda del Álamo Golf Resort | Bainbridge Spain, S.L. |
| Ona El Tarter | Club Estela la Dorada, S.L. |
Access
Details of the Data Controller· Company Name: ……………………………………………………..
· Address: ……………………………………………………..
The user can find out who the Data Controller is for:
- The Ona Hotels & Apartments Group of companies by clicking here.
- Ona Hotels & Apartments as manager by clicking here.
Applicant's details
Mr/Ms ….............................................................., of legal age, with address at ..................................................... no. .............., Town ........................................... Province ......................................... Postcode .................. holder of ID Card (DNI) ............................, of which a photocopy is attached, hereby expresses their wish to exercise their right to access, in accordance with Article 15 of Regulation (EU) 679/2016 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 13 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Requests
1.To receive confirmation from the Data Controller that personal data concerning them are being processed.
2.To provide them with access to the files within a maximum period of one month from receipt of this request, with it being understood that if this period elapses without an express response to the aforementioned request for access, it will be understood to have been denied. In this case, a complaint may be lodged with the Spanish Data Protection Agency.
3.This information should include, in a legible and understandable form, the data on the person contained in their records, such as:
a.The purposes of the processing;
b.The categories of personal data;
c.The recipients or categories of recipients to whom the personal data are or will be disclosed.
d.The intended period of retention of the personal data or, if this is not possible, the criteria used to determine this period.
e.The existence of automated decisions, including profiling.
f.whether personal data have been transferred to a third country or to an international organisation, or are intended to be transferred.
In ..........................., on ..... .................... ....
Opposition
Details of the Data Controller ·Company Name: ……………………………………………………..
·Address: ……………………………………………………..
The user can find out who the Data Controller is for:
-The Ona Hotels & Apartments Group of companies by clicking here.
-Ona Hotels & Apartments as manager by clicking here.
Applicant's details
Mr/Ms ….............................................................., of legal age, with address at ..................................................... no. .............., Town ........................................... Province ......................................... Postcode .................. holder of ID Card (DNI) ............................, of which a photocopy is attached, hereby expresses their wish to exercise their right to object, in accordance with Article 21 of Regulation (EU) 679/2016 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 18 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Grounds for the opposition
The applicant objects to the processing of personal data concerning them, contained in the company's processing records and,
Requests: 1.That, within a maximum period of one month from receipt of this request, they may object to the processing of the data indicated above.
2.That, if the Data Controller believes that this objection is not applicable, they should also disclose this, stating the reasons and within the period indicated, in order to lodge the corresponding complaint.
In ..........................., on ..... .................... ....
Erasure
Details of the Data Controller·Company Name: ……………………………………………………..
·Address: ……………………………………………………..
The user can find out who the Data Controller is for:
-The Ona Hotels & Apartments Group of companies by clicking here.
-Ona Hotels & Apartments as manager by clicking here.
Daten des Antragstellers
Applicant's details
Mr/Ms ….............................................................., of legal age, with address at ..................................................... no. .............., Town ........................................... Province ......................................... Postcode .................. holder of ID Card (DNI) ............................, of which a photocopy is attached, hereby expresses their wish to exercise their right to erasure, in accordance with Article 17 of Regulation (EU) 679/2016 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 15 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).Requests
1.That, within a maximum period of one month from receipt of this request, any data and information relating to the person that is in their processing records shall be effectively erased, under the terms established in Regulation (EU) 679/2016, of 27 April, on the protection of natural persons with regard to the processing of personal data and the free movement of such data, as well as the LOPDGDD, and shall notify you in writing to the address indicated above.
2.If the data controller deems this erasure to not be applicable, they shall also inform the data subject, giving reasons and within the aforementioned period, for the purpose of lodging the corresponding complaint.
In ..........................., on ..... .................... ....
Restriction of processing
Details of the Data Controller·Company Name: ……………………………………………………..
·Address: ……………………………………………………..
The user can find out who the Data Controller is for:
-The Ona Hotels & Apartments Group of companies by clicking here.
-Ona Hotels & Apartments as manager by clicking here.
Applicant's details
Mr/Ms ….............................................................., of legal age, with address at ..................................................... no. .............., Town ........................................... Province ......................................... Postcode .................. holder of ID Card (DNI) ............................, of which a photocopy is attached, hereby expresses their wish to exercise their right to the restriction of processing, in accordance with Article 18 of Regulation (EU) 679/2016 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 15 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Grounds for the restriction
Provided that the following conditions are met:
a)The data subject contests the accuracy of the personal data, during the period of time that allows the Data Controller to verify the accuracy of the data.
b)The processing is unlawful and the data subject objects to the erasure of the personal data and requests the restriction of their use instead.
c)The Controller no longer needs the personal data for processing purposes, but the data subject needs them to make, exercise, or defend claims.
d)The data subject objects to the processing pursuant to Article 21.1. while it is being verified whether the legitimate grounds of the Controller prevail over those of the data subject.
In accordance with the provisions of Article 18 of the Regulation (EU) and Article 16 of the LOPDGDD, the undersigned
Requests
Requests that the processing of my personal data be limited, taking into consideration:
· That the processing is unlawful and I object to their erasure.
· That the controller no longer needs my personal data for the purposes for which they were collected, but I need them to make, exercise, or defend claims.
That, within a maximum period of one month from the receipt of this request, the processing of personal data concerning me be limited, under the terms of Regulation (EU) 2016/679 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as the LOPDGDD.
In ..........................., on ..... .................... ....
Rectification
Details of the Data Controller·Company Name: ……………………………………………………..
·Address: ……………………………………………………..
The user can find out who the Data Controller is for:
-The Ona Hotels & Apartments Group of companies by clicking here.
-Ona Hotels & Apartments as manager by clicking here.
Applicant's details
Mr/Ms ….............................................................., of legal age, with address at ..................................................... no. .............., Town ........................................... Province ......................................... Postcode .................. holder of ID Card (DNI) ............................, of which a photocopy is attached, hereby expresses their wish to exercise their right to rectification, in accordance with Article 16 of Regulation (EU) 679/2016 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 14 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Requests
That the personal data for which the right to rectification is exercised be rectified and that the result of the rectification be communicated by post to the address stated above.
The data to be rectified are as follows:
.......................................................................... ............................................................................................................................................
This request is accompanied by the following documentation justifying the inaccuracy or non-compliance of the data to be processed:
[.................................................................]
If the rectified data had been previously disclosed, the transferring Data Controller must be notified of the rectification made, so that they may also proceed to make the appropriate corrections.
In ..........................., on ..... .................... ....
Portability
Details of the Data Controller
·Company Name: ……………………………………………………..
·Address: ……………………………………………………..
The user can find out who the Data Controller is for:
-The Ona Hotels & Apartments Group of companies by clicking here.
-Ona Hotels & Apartments as manager by clicking here.
Applicant's details
Mr/Ms ….............................................................., of legal age, with address at ..................................................... no. .............., Town ........................................... Province ......................................... Postcode .................. holder of ID Card (DNI) ............................, of which a photocopy is attached, hereby expresses their wish to exercise their right to data portability, in accordance with Article 20 of Regulation (EU) 679/2016 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 17 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Grounds for exercising the right to portability Provided that the following conditions are met:
a)Processing is based on the consent of the data subject [Article 6(1)(a)/Article 9(2)(a)].
b)The processing is based on a contract between the parties [Article 6(1)(b)].
c)The processing is carried out by automated means.
In accordance with the provisions of Article 20 of the Regulation (EU) and Article 17 of the Organic Law (LOPDGDD), the undersigned
Requests:
1.That, within a maximum period of one month from the receipt of this request, they may proceed to exercise their right to the portability of personal data concerning them, under the terms of Regulation (EU) 2016/679 of 27 April on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as the LOPDGDD.
2.That the personal data concerned are transmitted directly, in a structured, commonly used, and machine-readable format, to ...................................................................
In ..........................., on ..... .................... ....