Privacy Policy
Privacy Policy
INFORMATION PURSUANT TO ART. 13 OF EU REGULATION 679/2016
1. Introduction
For Hotel Gran Laguna, S.L., your privacy and the security of your personal data are particularly important, which is why we collect and process them with the utmost care and attention, while adopting specific and adequate technical and organizational measures to ensure the full security of the processing.
We therefore inform you, pursuant to art. 13 of the European Regulation 2016/679 (“GDPR” or “Regulation”) and of the Privacy Code (“Privacy Code”), as amended by Legislative Decree 101/2018 (jointly, the “Legislation”), that the processing of your personal data takes place according to methods adequate to guarantee security and confidentiality and is carried out, using paper, IT and telematic tools, as detailed in this privacy policy.
2. Data Controller
The processing of your personal data is carried out by Hotel Gran Laguna, S.L. (hereinafter also just “Hotel Gran Laguna” or “Controller”), with registered office in Calle Dr. Jose Naveiras, 24 A. CP 38001 Santa Cruz de Tenerife, as Data Controller pursuant to and for the purposes of the Regulation.
For any questions or requests related to the processing of your personal data, you may contact the Company at any time by sending a request to the following contacts:
Data Controller
Company Name: Hotel Gran Laguna, S.L.
Registered office address: C/ Nava y Grimón 18, 38201 San Cristóbal de La Laguna (Santa Cruz de Tenerife)
Telephone contact details: +34 922 24 01 30
E-mail contact details: reservas@lalagunagranhotel.com
3. Type of Data Processed, Purposes, and Legal Basis of Processing
The personal data that the Company processes are those you provide while browsing or using the online services offered by the Company through the website https://www.lalagunagranhotel.com/.
The Company may therefore collect data about you such as personal details including first and last name, e-mail, telephone, your requests and browsing data.
No special categories of data pursuant to art. 9 GDPR or data relating to criminal convictions and offences pursuant to art. 10 GDPR are processed.
Your personal data, once collected, are processed for the following purposes:
To analyze your user experience on our websites and the services we offer, as well as to ensure the proper functioning of our web pages and their content. The processing carried out for these purposes is based on a legitimate interest of the Controller, and does not require specific consent from the data subject.
To fulfill obligations provided for by laws, regulations, and European legislation. The processing carried out for these purposes is necessary for the fulfillment of legal obligations and to make the requested service available to you, and does not require specific consent from the data subject.
Subscription to our Newsletter service. The processing carried out for these purposes is performed with the specific and free consent provided by the user.
To carry out direct promotional activities, through the periodic sending of newsletters and other promotional tools to the e-mail address that you spontaneously provided when registering on the Site. The processing carried out for this purpose is performed with the specific consent provided by the user, except for commercial communications relating to products and/or services similar to those already purchased and/or subscribed to by the user, for which the processing is based on a legitimate interest of the Controller.
Your personal data is processed exclusively by Company personnel specifically authorized and designated pursuant to art. 4 paragraph 10 of the Regulation and art. 2-quaterdecies of the Privacy Code, who have been adequately trained in relation to the regulatory obligations regarding privacy and who process data following precise instructions from the Data Controller.
4. Data Processors pursuant to art. 28 and Data Recipients
Your personal data will also be transmitted to third parties we use. These subjects have been selected by us and offer adequate guarantees of compliance with the rules on the processing of personal data and, in the event they process data in the name and on behalf of Hotel Gran Laguna, S.L., they have been appointed as Data Processors pursuant to art. 28 of the Regulation and are required to carry out their activities according to the specific instructions given by the Company and under its control.
These third parties may belong to the following categories: financial operators; internet providers; companies specializing in IT services, consulting companies, cloud service providers. Furthermore, your data may be communicated to third-party companies operating in the publishing sector and to companies operating in the following sectors with which Hotel Gran Laguna, S.L. could conclude partnership agreements related to the digital marketing activity carried out for hotels. A specific and updated list of these subjects is available at the Controller’s headquarters and can be consulted upon request by the data subject.
For administrative purposes, we inform you that your data may be communicated by the Controller to other companies within the Group.
It is understood that your personal data will not be communicated to third parties so that they can use them for their own promotional purposes and will in no way be disseminated.
Your data may also be transmitted to Public Bodies to comply with legal obligations or to the Police Forces and to Judicial and Administrative Authorities, in accordance with the law, for the investigation and prosecution of crimes, the prevention and safeguarding against threats to public security, as well as to allow the Company to exercise or defend a right of its own or of third parties before the competent Authorities, as well as for other reasons related to the protection of the rights and freedoms of others.
5. Mandatory or optional nature of providing data
Without prejudice to the freedom of the data subject to provide personal data, please note that:
providing data for purposes A) and B) referred to in paragraph 4 is mandatory. Failure to provide the data will make it impossible for the Company to establish any relationship with you and to allow you to use the site;
providing data for purposes C) and D) referred to in paragraph 3 is optional. Failure to provide the data will make it impossible to subscribe to the newsletter service and use the promotional services offered by the Company.
6. Extra-EU Data Transfer
Some of the third parties to whom the data is transferred may be based in countries outside the European Union, also by virtue of the use of cloud services implemented by the Company. Such transfer is carried out to States that offer an adequate level of data protection, as established by specific decisions of the European Commission.
The transfer of your personal data to third parties resident or located in countries that do not belong to the European Union and that do not ensure adequate levels of protection will be carried out only with your consent or upon conclusion between the Company and said parties of specific agreements, containing safeguard clauses and appropriate guarantees for the protection of your personal data, so-called “standard contractual clauses”, also approved by the European Commission, or if the transfer is necessary for the conclusion and execution of a contract between you and the Company or for the management of your requests.
7. Data Retention
We inform you that your data will be kept for a limited period of time, which varies depending on the type of processing activity and the specific purposes thereof, as indicated below:
data collected in the context of using services offered by the Company: this data is kept for the entire duration of the service until its termination, the cancellation of the User's subscription to the service, or the relative withdrawal of consent;
data collected for sending information material via newsletter or for carrying out promotional activities (purposes C) and D) referred to in paragraph 3): until the user's request to interrupt the activity and in any case within 2 years from the data subject's last interaction of any kind with the Company.
At the end of these periods, your data will be permanently deleted or, in any case, irreversibly anonymized by the Company.
8. Your Rights
We inform you that you have the right to exercise the following rights in relation to the personal data covered by this policy, as provided and guaranteed by the Regulation:
Right of access and rectification (Articles 15 and 16 of the Regulation): you have the right to access your personal data and to request that they be corrected, modified, or integrated. If you wish, we will provide you with a copy of your data in our possession.
Right to erasure of data (Art. 17 of the Regulation): in the cases provided for by current legislation, you can request the erasure of your personal data. Once your request has been received and analyzed, we will cease processing and delete your personal data, if found legitimate.
Right to restriction of processing (Art. 18 of the Regulation): you have the right to request the restriction of the processing of your personal data in the event of unlawful processing or if the accuracy of the personal data is contested by the data subject.
Right to data portability (Art. 20 of the Regulation): you have the right to request to obtain, from the Data Controller, your personal data in order to transmit them to another Data Controller, in the cases provided for by the referenced article.
Right to object (Art. 21 of the Regulation): you have the right to object at any time to the processing of your personal data carried out on the basis of our legitimate interest, explaining the reasons justifying your request; before accepting it, the Company will have to evaluate the reasons for your request.
Right to lodge a complaint (Art. 77 of the Regulation): you have the right to lodge a complaint with the competent Supervisory Authority for the protection of personal data if you believe that a violation of your rights has occurred, or is ongoing, with reference to the processing of your personal data.
At any time, you can exercise your rights with reference to the specific processing of your personal data by the Company.
Without prejudice to what has been stated so far, we remind you that the above rights can also be exercised by anyone who has an interest of their own, or acts to protect you, as your representative, or for family reasons deserving of protection, pursuant to art. 2-terdecies of Legislative Decree 101/2018.
These rights can be exercised via email at the address reservas@lalagunagranhotel.com or by ordinary mail to the address: Hotel Gran Laguna, S.L. ,C/ Nava y Grimón 18, 38201 San Cristóbal de La Laguna (Santa Cruz de Tenerife).
Further information regarding the rights of the data subject can be obtained by requesting a full extract of the aforementioned articles from the Data Controller.
9. Security Measures
The Company adopts appropriate security measures to safeguard the confidentiality, integrity, completeness, and availability of the data subject's personal data. Technical, logistical, and organizational measures are put in place with the aim of preventing damage, accidental loss, alterations, improper and unauthorized use of the processed data.
Furthermore, the Controllers cannot be held responsible for untruthful information sent directly by the user (e.g., correctness of the e-mail address or postal address), as well as information concerning them that has been provided by a third party, even fraudulently.
10. Changes to this policy
The constant evolution of our services may involve changes in the characteristics of the processing of your personal data described above. This privacy policy may undergo changes and additions over time, as necessary due to new regulatory interventions regarding the protection of personal data, or the evolution/modification of our services.
We therefore invite you to periodically check the contents of our policy: where possible, we will try to promptly inform you about the changes made and their consequences.
The updated version of the privacy policy, in any case, will be published on the Company's page, indicating the date of its last update.