DATA PRIVACY POLICY

At HotelAdariaVera.com we take the privacy of our customers and users very seriously. Therefore, we understand that the processing of personal data provided by our customers and users must guarantee the security and integrity of all data and information obtained. Based on the above, HotelAdariaVera.com declares that the processing of the personal data of its customers and users will be in accordance with the provisions of EU Regulation 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (hereinafter, General Data Protection Regulation) as well as the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights. We inform you that the fields marked as “mandatory” in our various forms must be duly completed for the correct development and processing of the requests or queries raised. Notwithstanding the aforementioned in previous paragraphs, HotelAdariaVera.com reserves the right to update and/or modify this Data Privacy Policy when necessary. In order for the customer or user to remain duly informed of the applicable Privacy Policy, we recommend reading this document carefully, especially each time a customer decides to formalize a travel booking.

What is the scope of this Privacy Policy?

This Privacy Policy will extend to all kinds of tourist, commercial, and information services that HotelAdariaVera.com provides to its customers and users, whatever the tool or channel used. In accordance with the above, we indicate that the Privacy Policy set forth in this document is applicable to the company's websites, its mobile applications, newsletters, social networks, registered user accounts, electronic communications, communications via SMS or telephone, as well as any other existing means of communication.

Who is responsible for the processing of customer and user data?

The data controller is the commercial company ACTIVOS TURISTICOS VERA, S.L., with Tax ID (CIF) B27667542, with registered office at Av. de Bellisens 42, office 129, CP 43204 – Reus (Tarragona).

What type of information is obtained and stored?

The customer or user who provides the information and personal data described in this Privacy Policy expressly undertakes to guarantee the correctness and veracity of the data provided. Likewise, in the event of providing personal data of third parties, the customer or user undertakes to obtain the prior consent of said third parties and to inform them of the application and consequences of this Privacy Policy. The personal data obtained by HotelAdariaVera.com and which will be processed in accordance with what is described in this Privacy Policy are those cited below: a) Information related to a booking: When a booking is made, the customer must indicate their name and surname, ID/Passport, email address, telephone number, payment details, data necessary for the contracting and execution of an insurance contract (if applicable), the number and name of their companions and, where appropriate, preferences for their stay and the customer's current account number (in case refunds are necessary); b) Subscription to a commercial newsletter: If applicable, to receive commercial communications about products and services offered by HotelAdariaVera.com, the customer's or user's email address will be requested. c) Information related to contact forms: Through the contact form enabled for this purpose, customers and users can establish direct communication with HotelAdariaVera.com by indicating their personal data, for example: name and surname, email, and contact telephone number; d) Information about profiles and web browsing: Each time a user visits our website, regardless of whether a booking is formalized or not, HotelAdariaVera.com may collect certain information such as the user's IP address, the date and time of web visits, the browser used, or the operating system being used. You can obtain more information in the “Cookies Policy” section. The various bookings that a user has made can also be collected, all for the purpose of creating profiles and developing personalized promotions and services according to user preferences.

Where is the information obtained stored?

In accordance with the provisions of the General Data Protection Regulation and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, ACTIVOS TURISTICOS VERA, S.L. informs you that the data obtained will be included in different processing activity records, with the maximum security measures being applicable to all of them. ACTIVOS TURISTICOS VERA, S.L. uses "cloud contracting" systems for the storage of its customers' personal data. For this, it uses providers located both inside and outside the European Union. However, all providers located outside the European Union comply with the guidelines of the Privacy Shield between the US and the European Union: Google LLC; Amazon Web Services, Inc.

For what purpose is the data obtained processed?

HotelAdariaVera.com uses the data provided by customers and users for the following purposes:

• Booking management: Our company uses customers' personal data to manage their booking.
- Customer comments (surveys): HotelAdariaVera.com may use the contact information of its customers to invite its users to write comments that will be published on the web portal for the view of other users. The aim is to evaluate the quality of the services provided and attend to suggestions from our customers and users.
- Commercial actions: HotelAdariaVera.com may carry out different marketing actions aimed at those who are or have been its customers on some occasion with the aim of providing them with commercial advertising that we consider may be of interest to them (newsletter).
- Information about web browsing: Used to obtain statistical data on user visits to the different web platforms or mobile applications, as well as to display personalized information about our company's products and services.
- Participation in promotional, commercial campaigns or contests: Participation in such campaigns implies the express consent of the user for the processing and transfer of their data in accordance with the provisions of the legal bases of the campaign in which they participate.
- Compliance with legal obligations: The personal data obtained are stored to respond to the legal obligations applicable to our company (for example: accounting, tax, commercial, administrative obligations).
- Detection and prevention of fraudulent activities: The personal data obtained are stored to detect, prevent, and avoid fraudulent activities or those that go against contractual good faith.

Legitimization of data processing

The usual legal bases that allow the processing of customer and user data are: a) The execution of the signed contract itself: For the correct development, management, execution, and control of the formalized contractual provision (travel booking), it is necessary for the customer or user to provide their personal data. b) The consent of the interested party: For some of the cases of obtaining information described in this Privacy Policy, it is based on the consent of the interested party, expressed clearly upon accepting the Privacy Policy applicable to the services (for example: newsletter subscription). c) By legal obligation: On certain occasions, HotelAdariaVera.com is obliged to store personal data and make it available to the administrative or judicial authorities that request it. d) Legitimate interest: In certain cases, the legal basis used for the processing of personal data may be the legitimate interest of the company. We inform you that opposition to certain data processing may lead to the impossibility of providing the service. Consequently, HotelAdariaVera.com declines any type of responsibility that could derive from this fact.

To whom may personal data be communicated?

The customer or user of HotelAdariaVera.com services expressly consents and authorizes ACTIVOS TURISTICOS VERA, S.L. to transmit their personal data to third parties or companies in order to guarantee an adequate provision of the service. Our company may share the personal data of its customers and users in the following cases:

• Financial service providers: HotelAdariaVera.com may use payment gateways from banking entities, among others, with the aim of correctly developing the provision of contracted services as well as validating and verifying the payment of contracted services. The third parties involved in any of these external services will be subject to confidentiality agreements and will only be permitted to use our customers' personal information in accordance with the purposes described in this privacy policy.
- Electronic messaging services: For the correct contractual development and in order to be able to issue all documentation necessary for the customer, HotelAdariaVera.com uses the services of external electronic messaging providers such as Gmail (Google Platform). The company Google complies with the standards and guidelines set by the US-EU Privacy Shield, and proof of this can be obtained here.
- Competent administrative and/or judicial authorities: HotelAdariaVera.com may share the personal data of its customers with the competent administrative or judicial authorities in the event that the latter require the company to provide data of a specific customer. These requirements include court orders, subpoenas, and orders derived from legal proceedings or criminal investigations.
- Collaborating financial entities: In order to detect, prevent, and resolve activities that could be fraudulent, HotelAdariaVera.com may communicate personal data to financial entities that collaborate in the process of purchasing and paying for the contracted services.

For how long is personal data kept?

The information provided by the customer to HotelAdariaVera.com will be stored under strict security criteria and will only be processed in accordance with the purposes described in this section. Likewise, we inform you that, once the contractual provision has ended or your requests have been resolved, the information obtained will be stored for legal reasons (tax, accounting, or similar), and made available to the competent public entities. However, the data may be kept for longer for historical or statistical archiving purposes, unless the interested party wishes to exercise their rights of opposition, cancellation, or suppression. Likewise, we indicate that the data processed for commercial purposes, including possible commercial profiles created, will be kept as long as the interested party does not express their desire to delete them.

How can HotelAdariaVera.com use its customers' comments?

Once you have enjoyed your stay at the booked accommodation, HotelAdariaVera.com may provide you with a form in which you can include any comments you deem appropriate in relation to the accommodation in question in order to inform other travelers about the quality of the accommodation's services and, in turn, be able to communicate with HotelAdariaVera.com so that it can improve the quality of its services. The user can choose the name with which their comment appears, being able to change it whenever they deem it convenient. The user accepts that their comments appear visibly published on the HotelAdariaVera.com website, on its social media profiles, in its mobile device applications, in the commercial communications that may be sent by HotelAdariaVera.com, as well as on the websites and mobile device applications owned by the accommodation about which the comments are made. We indicate that all opinions and information incorporated into the responses to the mentioned surveys as well as regarding the comments inserted in the HotelAdariaVera.com profiles on the different social networks will become public information (accessible to the rest of the users). Consequently, customers and users are recommended to take the necessary precautions when publishing comments or sharing personal information. HotelAdariaVera.com is not responsible for the comments made by users, as they are the ones who assume full responsibility for any repercussions that may arise from their statements. HotelAdariaVera.com will have the power not to publish, delete, or omit those comments that are intended to be insults or may be considered offensive, obscene, or that infringe upon the right to honor, privacy, and self-image of any person.

What are the rights that assist customers and users?

In accordance with the provisions of the General Data Protection Regulation and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, HotelAdariaVera.com informs you that you can exercise free of charge the rights of access, rectification, cancellation (suppression), limitation, or opposition by sending a letter to the following email address: legal@petitshotels.es or by post addressed to ACTIVOS TURISTICOS VERA, S.L. – Av de Bellisens 42, office 129, CP 43204 – Reus (Tarragona). The consent given for the processing of your personal data will always be revocable. Likewise, we indicate that in certain cases you have the right to the portability of your personal data.

How can I resolve my doubts about the processing of my personal data?

HotelAdariaVera.com provides the user, within its internal organizational structure, with the appropriate personnel to resolve all doubts you may have in relation to the processing of your personal data. They can be contacted in the following way: Legal Department (legal@petitshotels.es).