Privacy policy and information treatment
1.- Right to information
In application of the provisions of article 11 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD) and article 13 of the General Data Protection Regulation 2016/679 (GDPR), we describe how personal data is processed at the Hotel Montsià in Amposta.1.2.- Definitions
It is understood by:
1) Personal data: any information about an identified or identifiable natural person (the data subject). An identifiable natural person is one who can be identified, directly or indirectly, by means of an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2) Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
3) Profiling: any form of automated processing of personal data consisting of the use of those data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
4) Pseudonymization: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
5) File: a structured set of personal data which is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.
6) Data controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
7) Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
8) Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
9) Third party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
10) Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
11) Supervisory authority: an independent public authority established by a Member State in accordance with Article 51 of the GDPR.
12) Cross-border processing:
a) The processing of personal data carried out in the context of the activities of establishments in more than one Member State of a controller or processor in the European Union, where the controller or processor is established in more than one Member State.
b) The processing of personal data carried out in the context of the activities of a single establishment of a controller or processor in the Union, but which substantially affects or is likely to affect data subjects in more than one Member State.
1.3.-Who decides on the use of the data and the means to be used for processing?
The data controller is Kronotex Spain, SL
- Tax ID: B98390461
- Address: Barrio Castañares, s/n (09199) Burgos
- Phone: +34 947 484 900
- Email: privacy@kronospan.es
1.4.-Who ensures that all rules governing information processing in the hotel are correctly applied?
The data protection officer is CIPDI Information Processing SL, with address in Mataró, C/Sant Agustí n. 1 1º 1ª, dpd@cipdi.com.
1.5.-What purpose will we use your data for, what is the legal basis for these data processing activities, and how long will we keep them?
| Purpose | Legal Basis | Retention Period |
|---|---|---|
|
Retention period
|
Contractual relationship
|
5 years.
|
|
Sending commercial information
|
Consent and legal authorization (art. 21.2 of the LSSI)
|
Until consent is revoked or rights are exercised.
|
|
Labor management
|
Contractual relationship and legal authorization
|
4 years
|
|
Résumés
|
Contractual relationship and consent
|
1 year
|
|
Video surveillance
|
Legitimate interest. Maintenance of security within the hotel
|
30 days
|
1.6. Do we carry out any processing of your images?
With the exception of the images that may be captured by security cameras, no.
1.7.-Who can access and know the content of your data?
To comply with the above purposes, service providers at the hotel may have access to personal data. Their access will be limited to the data necessary to perform the functions assigned to them by the data controller. Confidentiality agreements and/or specific agreements have been signed with all recipient entities and individuals governing access to information, security measures, and the use that can be made of the data. You can obtain further information by contacting the Data Protection Officer.
1.8.-Are there any cross-border data transfers?
The data controller does not host data outside the European Union.
1.9.-What rights do data subjects and data holders have?
Right of access. Regulated in article 15 of the GDPR 2016/679 of April 27, 2016. It involves requesting the data controller to obtain, free of charge, all information regarding personal data and communications made or planned. Right to rectification. Regulated in article 16 of the GDPR. It involves asking the data controller to change the content of information about the person and data, following the instructions of the data subject. Right to erasure. Regulated in article 17 of the GDPR 2016/679. It consists of asking the data controller to delete any information about the data subject. Erasure involves blocking all data and keeping it available to public authorities for the prescribed period for legal actions. Right to restrict processing. Regulated in article 18 of the GDPR 2016/679 of April 27, 2016. It involves asking the data controller to limit the processing of data when any of the following conditions are met:
- i.- personal data are inaccurate;
- ii.- processing is unlawful;
- iii.- the controller no longer needs the data;
- iv.- When the reasons for stopping data processing alleged by the affected party prevail over those of the data controller.
The right to data portability. It is in article 20 of the GDPR 2016/679 of April 27, 2016. It involves submitting a request to the data controller to provide the personal data of the data subject in a structured, commonly used, machine-readable format to transfer to another data controller when processing is done by automated means and is based on express consent. Right to object. Regulated in article 21 of the GDPR 2016/679 of April 27, 2016. It involves asking the data controller to process data following specific instructions provided by the individual. Right to withdraw consent. Regulated in article 13.2.c) of the GDPR 2016/679 of April 27, 2016. It is an order given by the data subject to the data controller notifying them of the withdrawal of consent given for the processing of their data. Rights not to be subject to automated individual decisions. It is a request to the data controller that all decisions with legal effects are not made solely by machines. To exercise the aforementioned rights, you can send a written request to the data controller’s address or send an email to privacy@kronospan.es with the subject “DATA PROTECTION” and attach a copy of your ID, NIE or passport to that email.
1.10.-How can a complaint be made?
If you believe that your rights have been violated, the competent body to ensure the correct application of the rules on information processing is the Spanish Data Protection Agency, located at Calle Jorge Juan n. 6, Madrid.
1.11.-What obligations do I have as a data subject?
The affected party must provide accurate and up-to-date information in all data collection processes, taking responsibility in case of breach of this obligation. Depending on the demand made by the affected party, the mandatory data is already marked in the collection forms. Failure to provide the mandatory data could harm the right to the requested service.
1.12.-Can the data controller create profiles?
To provide more personalized, careful and effective attention to the user, it is sometimes necessary to create profiles of service recipients. Profiles are not created without the direct involvement of a natural person.
