PRIVACY POLICY

This privacy policy is in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of the 27th of April, 2016, concerning the protection of natural persons with regard to the processing of personal data and free movement of these data (RGPD), to Organic Law 3/2018, of the 5th of December, Protection of Personal Data and digital rights guarantee (LOPDGDD), as well as in what is not contrary to the regulations indicated, to the Law Organic 15/1999, Protection of Personal Data (LOPD) and its development regulations, and/or those that could replace or update in the future.

Our organisation is committed to the privacy of your personal data. The personal data provided are necessary to provide our services and are processed in a lawful, fair and transparent way, ensuring adequate security of them, including protection against unauthorised or illegal processing and against loss, destruction or accidental damage through the application of technical and organisational measures.

In this document we want to oﬀer you, in a transparent and loyal way, all the necessary information related to the processing of your personal data that this organisation makes.

I.I- RESPONSIBLE FOR THE PROCESSING group management (CVS, MARKETING,…) IDENTITY: SERAWA HOSPITALITY, S.L.

C.I.F.: B40610768

ADDRESS: C/ MARE SACRAMENT, 2 BAJO, 46010 VALENCIA (VALENCIA)

TELEPHONE: 963360233

E-MAIL: info@serawahotels.com

I.II- RESPONSIBLE FOR THE PROCESSING – RESERVATIONS HOTEL MORAIRA IDENTITY: GEMA HOTEL, S.L.

C.I.F.: B03792280

ADDRESS: C/ CABO ESTACA DE BARES, 11, 03724 MORAIRA (ALICANTE)

TELEPHONE: 965747188

E-MAIL: info.moraira@serawahotels.com

I.III- RESPONSIBLE FOR THE PROCESSING – RESERVATIONS HOTEL ALICANTE IDENTITY: FASOLUS RESORT, S.L.

C.I.F.: B98981160

ADDRESS: C/ SAN FERNANDO, 16, 03002 ALICANTE (ALICANTE)

TELEPHONE: 865660022

E-MAIL: info.alicante@serawahotels.com

II.- RECIPIENTS OF THE PERSONAL DATA

The personal data provided in the booking software (GEMA HOTEL, S.L. AND FASOLUS RESORT, S.L.) will be transferred to the company SERAWA HOSPITALITY, S.L.

2. Optionally, for the procurement cloud computing services and/or services for the sending of emails, communication, as well as other related IT services, the personal data may be:

– Assigned to IT service companies located within the European Economic Area (EEA) or,

– Transferred to IT service companies located outside the EEA adhered to the Privacy Shield protection framework and therefore have implemented the appropriate protection measures to ensure the security of personal data. To obtain further information, please follow this link: https://www.privacyshield.gov/welcome

Optionally, to administrations and other organisations when they are required in compliance with legal obligations.

III.- LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA

For each speciﬁc processing of personal data, we will inform you of the legal for such processing.

IV.- RIGHTS RIGHT TO ACCESS

It is the right to obtain from the controller conﬁrmation as to whether or not personal data relating

to the data subject are being processed and, if so, the right to access to the personal data and the following information: the purposes of the processing, the categories of the processing, the recipients or the categories of recipients to whom the data have been or will be disclosed, the storage period or the criteria used to determine this period, the existence of the right to request from the controller the rectiﬁcation or deletion of personal data or the restriction or objection to the processing of personal data relating to the data subject, the right to lodge a complaint with the Spanish Agency for Data Protection (AEPD), the existence, where applicable, of automated decisions, including proﬁling, where data are transferred to third countries the right to be informed of the appropriate safeguards applied.

RIGHT TO RECTIFICATION

You have the right to request the rectiﬁcation of your personal data if these are innaccurate, including the right to complete data that is incomplete. Please note that by providing personal data by any means, you warrant that such data are true and accurate, and you undertake to notify us of any changes or modiﬁcations to such data. Therefore, any damage caused as a result of the communication of erroneous, inaccurate or incomplete information in the forms of the website, will be the sole responsibility of the concerned party.

RIGHT TO SUPPRESSION/DELETION

It is the right to request the suppression of your personal data when, among other assumptions, they are no longer necessary for the purpose for which they were gathered, or are otherwise being processed or you withdraw your consent. It should be borne in mind that erasure will not be

applicable when the processing of personal data is necessary, among other cases, for the fulﬁlment of legal obligations or for the formulation, exercise or defense of claims.

RIGHT TO LIMITATION

It is the right to request that restrict the processing of your personal data, which means that in certain cases you can ask us to temporarily stop the processing of your personal data or to store your data for longer than necessary when you may need it.

RIGHT TO WITHDRAW CONSENT

It is the right to withdraw the consent you have provided by ticking “I have read and accept the privacy policy” at any time and as speciﬁed in the relevant section “Exercise of rights” or in the speciﬁc processing of commercial communications or Newsletter. Please note that this right will not be applied if, inter alia, the processing of personal data is necessary for the compliance with a legal obligation, the performance and maintenance of a contractual relationship, or for the formulation, exercise or the defense of claims. Likewise, the withdrawal of consent will not have retroactive eﬀects, it will not aﬀect the lawfulness of the processing based on the consent prior to its withdrawal.

RIGHT TO PORTABILITY

It is the right to receive the personal data concerning you and that you have provided to us, in a structured, commonly used and machine-readable format and to transmit them to another controller, provided that: the processing is based on your consent and is carried out by automated or computerised means.

RIGHT TO OPPOSITION

You have the right to oppose the processing of your personal data on the basis of our legitimate interest. We will cease to process your personal data unless we can prove compelling legitimate grounds for the processing that prevail over your interests, rights and freedoms, or for the formulation, exercise or defence of claims.

RIGHT TO LODGE A COMPLAINT WITH A CONTROL AUTHORITY

If you believe that we are processing your personal data in an incorrect manner, you can contact us or you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

https://www.agpd.es/portalwebAGPD/index-ides-idphp.php

EXERCISING OF THESES RIGHTS

You may exercise your rights by sending a letter to the postal address indicated above or by e- mail jaimealacreu@serawahotels.com, enclosing, in both cases, a copy of your NIF/NIE/Passport or similar document.

V.- PERSONAL DATA PROCESSING.

GENERAL PROVISIONS

The personal data requested in each of the speciﬁc processing operations are strictly necessary; refusal to provide them would mean that we would not be able to provide the requested service.

The communications of the personal data provided for in each of the speciﬁc processing operations in some cases are necessary for the performance and maintenance of a contract and in other cases for compliance with a legal obligation applicable to the responsible/controller.

DIGITAL ASSISTANT – “CHATBOT” or “CHAT ONLINE”

In the event that this website uses online chat software, provided as a self-service to provide users with an adequate and quick response to common questions and in improving customer services for the beneﬁt of users visiting the website, the following data will be subject to processing during the conversation with the “chat bot”: the IP address and other personal data entered into the chat bot’s conversation function.

The collected data will not be used to personally identify the website visitor, and will not be merged with personal data about the bearer of the pseudonym, unless the personal data is provided voluntarily when using the online chat.

The legal basis for this processing is set out in Article 6(1)(f) of the GDPR.

CONTACT FORM

Personal data will be processed to channel requests for information, suggestions and complaints from users or customers.

The legal basis that legitimates the processing of personal data is the express consent when marking “I have read and accept the privacy policy”.

Personal data will be kept for a period of two years from the moment they stop being processed, without prejudice to the exercise of the rights that assist them as interested.

BOOKING FORM

Personal data will be processed to manage online reservations, your payments, any complaint or claim about the services provided, identify and validate your legal age to contract, as well as for and, where appropriate, the formulation, exercise or defense of claims

The legal basis that legitimates the processing of personal data is the express consent when marking “I have read and accept the privacy policy”.

As a necessary contractual requirement, personal data will be transferred to third companies for the provision of advisory services to responible party. In compliance with legal obligations, the personal data will be transferred to the State Security Forces and the Tax Administration. Likewise, and in some cases, they may be transferred to providers of online payment services.

Personal data will be kept as long as the consent is not withdrawn, unless they should be kept for the maintenance of the relationship between the parties or during the years necessary for compliance with legal obligations.

CURRICULUM FORM

Personal data will be processed to manage the selective process in the company.

The legal basis that legitimates the processing of personal data is the express consent when marking “I have read and accept the privacy policy”.

Personal data will be kept for a period of two years from the moment they stop being processed, without prejudice to the exercise of the rights that assist them as interested.

COMMERCIAL COMMUNICATIONS OR NEWSLETTER FORM

Personal data will be processed to manage the subscription to our Newsletter, including the sending of personalised or non-personalised information, about our products or services by diﬀerent means such as telephone, email, SMS, applications for mobile devices, as well as by any similar procedure. It must be borne in mind that this type of data processing may involve the analysis of your user proﬁle to determine what your preferences are and thus be able to provide you with information that best suits your interests.

You can request the withdrawal for this type of processing, depending on the means used, as follows:

Electronic mail: By the link to the eﬀect that you will ﬁnd in each of the electronic communications or by an analogous procedure speciﬁed in the commercial communication.
WhatsApp (Other apps): Requesting the unsubscription.
SMS: Requesting unsubscription.

The legal basis that legitimises the personal data processing is the express consent when marking “I have read and accept the privacy policy”.

It must be borne in mind that if the mean used is WhatsApp, personal data will be transferred to WhatsApp Ireland Limited which is located within the EEA.

Personal data will be kept as long as you do not withdraw the consent according to the form indicated in this section.