PERSONAL DATA PROTECTION POLICY FOR THE WEBSITE

We provide you with this Privacy Policy in order to inform you in detail about how we process your personal data and protect your privacy and the information you provide to us.

If, in the future, we should make changes to this Privacy Policy, we will notify you via this website or by other means so that you will be aware of the new privacy conditions that will be adopted.
We inform you below, in the form of questions and answers, of the conditions under which our entity processes your personal data:

Who is responsible for the processing of your data?

• Identity: FRATEROMAR S.L., with VAT B-76066729
• Postal address: CL. ACATIFE, 2 - PUERTO DEL CARMEN (TIAS) 35510 LAS PALMAS. ESPAÑA
• Telephone number: (+34) 928 51 34 00
• E-mail: lopd@plusfariones.com

For what purposes do we process your personal data?
We process the personal data you provide for the following purposes:

a) The management of the relationship with the customer and the billing and collection of the services. The provision of data for this purpose by our customers is obligatory, otherwise the fulfilment of the contract will be prevented.

b) The management of relations with our suppliers, as well as the invoicing and payment of services. For this purpose, it is obligatory for the supplier to provide us with their data, otherwise the contract cannot be fulfilled.

c) To channel requests for information, suggestions and complaints that you may send us, to contact the sender of the information, to respond to your request or query and to follow up subsequently. Providing the data for this purpose is voluntary, although, if you do not do so, we will not be able to respond to your request, query or complaint. Therefore, the communication of your personal data for these purposes is a necessary requirement for us to be able to deal with such request

d) The sending of commercial communications of our services. Through these communications, users will be informed about the different services offered by the COMPANY and by the other entities that operate under the Grupo Plus Fariones brand, as well as the events organised by them. The entities that make up Grupo Plus Fariones, all of which are dedicated to the hotel sector, are: Frateromar, S.L.U., Apartamentos Fariones Playa, S.L. and Suite Hotel Fariones, S.A.

e) If the recipient is our client, we will send them these commercial communications about the services and events of the entity, unless they express their wish to the contrary by ticking the corresponding box at the time of providing their details or, subsequently, by informing us by any means.

f) On the other hand, if you do not contract our services, we will not send you commercial information from EMPRESA, unless you expressly authorise us to do so. Similarly, even if you are our client, we will not send you commercial communications from other entities that operate under the Plus Fariones brand if you do not give your consent to do so. The authorisation is voluntary and your refusal would only mean that you would not receive commercial offers of our products or services.

g) In relation to the sending of the aforementioned communications, based on the information provided, we may draw up commercial profiles, in order to offer you the products and services that best suit your interests.

h) To process registrations for events and activities in which users wish to participate. In this case, the images or videos taken of the participants in particular during the development of the same may be published, with your prior consent, on the website of the entity, in its social networks, in corporate magazines, noticeboards and any other similar media owned by the company, in order to promote such activities or events. The provision of the data is voluntary, both for registration to the event and for the production of images and videos, although in the event of not providing the data, they will not be able to register for the same nor will the images and videos be used for the indicated purposes.

i) In the event that you send us your CV, we will process it in order to have information about those people who wish to do an internship and/or work with us in order to be able to carry out the corresponding personnel selection processes.

j) The entities that operate under the Plus Fariones brand have a centralised e-mail address for the reception of candidates' CVs (empleo@plusfariones.com). If the CV is sent to this address, the data will be processed by each of these entities as independent data controllers for the purposes indicated in the previous point. The provision of your data for this purpose is voluntary, although, if you do not provide them, you will not be able to participate in our personnel selection processes.

k) The entities that make up Grupo Plus Fariones, all of which are dedicated to the hotel sector, are: Frateromar, S.L.U., Apartamentos Fariones Playa, S.L. and Suite Hotel Fariones, S.A.

l) To manage the reservations requested by users: The delivery of the data for this purpose is mandatory, not being able to process reservations and provide the corresponding services otherwise.

m) In the event that you become a friend or follower of ours on social networks, we will process your data to keep you informed of our activities and promotions through these channels. Providing the data for this purpose is voluntary, although, if you do not do so, you will not be able to be our friend or follower on the corresponding social network. The categories of data processed for this purpose are identification data.

For how long will we process your data?

We only keep your data for the period of time necessary to fulfil the purpose for which they were collected, to comply with the legal obligations imposed on us and to meet any possible liabilities that may arise from the fulfilment of the purpose for which the data were collected.

The data for the management of the relationship with customers and suppliers and the billing and collection of services will be kept for this purpose for as long as the contract is in force. Once this relationship has ended, if applicable, the data may be kept for the time required by the applicable legislation and until any liabilities arising from the contract expire.

The data processed to deal with requests, petitions, queries or complaints will be kept for the time necessary to respond to them and to consider them definitively closed. Subsequently, they will be kept as a record of communications for a period of one year, unless you request their deletion before then.

The data for the sending of commercial communications will be kept indefinitely, until, where appropriate, you express your wish to delete them or your wish to stop receiving such communications.

The data of potential clients who do not contract our services and who do not wish to receive commercial information will be deleted when it is confirmed that the contract will not be carried out. In the event that the previous relationship between the parties, even if not yet consummated, could give rise to possible liabilities, the data will be kept until the statute of limitations expires.

The data for the processing of registrations for events and activities, including photographs and videos taken, may be kept for the duration of the event or activity, as well as for the promotion of the same, and even afterwards, in order to respond to possible legal liabilities arising as a result of the same.

The data you provide us with or that we obtain in order to take part in a specific open personnel selection process will be kept until said process is concluded and then cancelled, unless the candidate is selected, in which case it will be incorporated into their employee file. If unsuccessful candidates wish us to retain their CVs for future selection processes, they must expressly request this by e-mail. In the latter case, as well as when you provide us with your CV spontaneously, simply so that we can take it into account in future selection processes, the data will be kept for a maximum of one year from the last update. You must keep the personal data you provide us with up to date, in particular with regard to training and professional experience.

Occasionally, during selection processes, job portals may be used to search for candidates who match the professional profiles that are of interest to us, subject to the Privacy Policies of such platforms. The categories of personal data processed in these cases are as follows: identification data, personal characteristics data, employment details data, academic and professional data and any other information that the candidate has posted on the job portal or included in their CV.

The booking data will be kept for the duration of your stay, as well as for the provision of the services requested and, even afterwards, for as long as required by the applicable legislation and until any liabilities arising from the service offered expire. In order to comply with the documentary registration obligations provided for in the regulations for the protection of public safety, the user registration data will be kept for a period of 3 years from the end of the service or service contracted.

The data provided through social networks will be kept for as long as you remain a friend or follower of ours on the corresponding platform.

What is the legal basis for the processing of your data?

The legal basis for the processing of customer and supplier data is the execution of the contractual relationship. The processing of personal data for the purpose of responding to your requests for information, enquiries, queries and complaints is based on the consent of the person concerned. This consent may be withdrawn at any time, but this does not affect the lawfulness of any processing previously carried out.

The prospective offer of our services to our customers is based on the satisfaction of the legitimate business interest of being able to offer them the contracting of other products or services and thus gain their loyalty. This legitimate interest is recognised by the applicable legal regulation (General Data Protection Regulation), which expressly permits the processing of personal data on this legal basis for direct marketing purposes. However, we remind you that you have the right to object to this processing of your data by any of the means provided for in this clause.

The prospective offer of the services of the rest of the hotels that operate under the Plus Fariones brand, as well as the sending of commercial communications of the COMPANY's services to those who, having shown interest in them, are not or have not become our clients, is based on the consent of the interested party. This consent may be revoked at any time, with no consequences other than to stop receiving advertising and without affecting the processing of data previously carried out.

Data for the processing of registrations for events and activities, including the taking of images and the making of videos, will be processed on the legal basis of the consent of the person providing the data. This consent may be withdrawn at any time, but this does not affect the lawfulness of any processing previously carried out.

The legitimate basis for the processing of CVs that you submit to us or that we obtain from employment platforms for a specific open recruitment process is the existence of a pre-contractual relationship. In addition, further data may be collected during interviews or selection processes, the processing of which has the same basis.

The legal basis for processing the data contained in your CV, if you have asked us to store it after a recruitment procedure or if you have sent it to us spontaneously, is your consent, which can be revoked at any time. However, data processing carried out previously will not lose its lawfulness because the consent has been withdrawn.

The data for the management of reservations will be processed on the basis of the contractual relationship between the parties. If the guest has an allergy or health problem and provides us with information about it, we will process it on the basis of their consent, which is expressed by the provision of their data, in order to provide them with the corresponding services according to their needs. This consent may be revoked at any time, without affecting the lawfulness of the data previously provided. It is not obligatory for the client to provide their health data, although this could mean that the services we provide may not be adapted to their needs.

The data provided through social networks will be processed on the legal basis of your consent, which you may revoke at any time, although this will not affect the lawfulness of the processing previously carried out.

To which recipients will your data be communicated?

The data will be communicated to the following entities:

a) The competent Public Administrations, including judges and courts, in the cases provided for in the Law and for the purposes defined therein.

b) The financial institutions through which the management of collections and payments is carried out.

c) Companies with which services additional to those of accommodation have been contracted (e.g. excursions, car hire).

d) The State Security Forces and Corps for compliance with Public Safety regulations.

e) To the other entities of the Plus Fariones Group dedicated to the hotel sector (Apartamentos Fariones Playa, S.L. and Suite Hotel Fariones, S.A.) for the correct management of the services requested and offered by them (room reservations, registration for events or excursions, etc.).

Although it is not a transfer of data, it may be that third party companies, acting as our suppliers, access your information to carry out the service. These third parties access your data on our instructions and may not use it for any other purpose. They do so in strict confidence and on the basis of a contract in which they undertake to comply with the requirements of the current data protection regulations.

What are your rights when you provide us with your data?

Any person has the right to obtain confirmation as to whether or not we are processing personal data concerning him or her. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. Under the conditions provided for in the General Data Protection Regulation, data subjects may request the limitation of the processing of their data or their portability, in which case we will only retain them for the exercise or defence of claims.

In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data. If you have given consent for a specific purpose, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. In such cases, we will stop processing the data or, as the case may be, we will stop processing the data for that specific purpose, except for compelling legitimate reasons, or for the exercise or defence of possible claims.

In addition, data protection regulations allow you to object to being subject to decisions based solely on automated processing of your data, where appropriate.

The above-mentioned rights are characterised by the following:

• They may be exercised free of charge, except in the case of manifestly unfounded or excessive requests (e.g. repetitive nature), in which case a fee may be charged in proportion to the administrative costs incurred or a refusal to act.
• You may exercise your rights directly or through your legal representative or volunteer.
• Your request must be responded to within one month, although, taking into account the complexity and number of requests, the deadline may be extended by a further two months.
• We are obliged to inform you about the means of exercising these rights, which must be accessible and without being able to refuse you the exercise of the right on the sole ground that you choose another means. If the request is made by electronic means, the information will be provided by electronic means where possible, unless you ask us to do otherwise.
• If, for whatever reason, the request is not acted upon, we will inform you, at the latest within one month, of the reasons for this and of the possibility to complain to a supervisory authority.
In order to facilitate the exercise of the above-mentioned rights, we provide below links to the application form for each of these rights:

o Form for exercising the right of access
o Form for exercising the right of rectification
o Form for exercising the right of objection
o Form for exercising the right to erasure ("right to be forgotten")
o Form for exercising the right to limit the processing of personal data
o Form for exercising the right of portability
o Form for exercising the right not to be subject to automated individual decisions

All the aforementioned rights may be exercised through the means of contact listed at the beginning of this clause. If there is any doubt as to the identity of the applicant, he/she must provide proof of identity by attaching a photocopy or scanned copy of his/her ID card or equivalent document, or a document accrediting representation, if the right is exercised through a representative.

In the event of any infringement of your rights, especially when you have not obtained satisfaction in exercising them, you may file a complaint with the Spanish Data Protection Agency (contact details available at www.aepd.es), or any other competent supervisory authority. You can also obtain more information about your rights by contacting these bodies.

How do we protect your personal data?

We are committed to protecting the personal data we process. We use reasonably reliable and effective physical, organisational and technological measures, controls and procedures aimed at preserving the integrity and security of your data and ensuring your privacy.

In addition, all staff with access to personal data have been trained and are aware of their obligations in relation to the processing of your personal data.

In the case of the contracts we sign with our suppliers, we include clauses requiring them to maintain the duty of secrecy with respect to the personal data to which they have had access by virtue of the assignment, as well as to implement the necessary technical and organisational security measures to guarantee the permanent confidentiality, integrity, availability and resilience of the systems and services for the processing of personal data.

All these security measures are regularly reviewed to ensure their adequacy and effectiveness.

However, absolute security cannot be guaranteed and no security system is impenetrable so, in the event that any information under our control and subject to processing is compromised as a result of a security breach, we will take appropriate steps to investigate the incident, notify the Supervisory Authority and, where appropriate, those users who may have been affected to take appropriate action.

What is your responsibility as the data subject?

By providing us with personal data, the person who does so guarantees that he/she is over 14 years of age and that the data provided is true, accurate, complete and up to date.

To this effect, the interested party is responsible for the veracity of the data and must keep them suitably updated so that they correspond to their real situation, taking responsibility for any false or inaccurate data that they may provide, as well as for any damages, direct or indirect, that may arise.

If you provide data of third parties, you assume the responsibility of informing them beforehand of all the provisions of article 14 of the General Data Protection Regulation under the conditions established in said precept.

How have we obtained your data?

In those cases in which the user registration is carried out through social networks, the personal data that we will process will come from the social network in question, to which, previously, the interested party will have provided said data for the purposes set out in its corresponding privacy policies. The categories of data that we will collect from the social network in question are those that appear on our registration form and that you have provided to that social network. If, in order to register on our website, more data than those provided by the social network are required, you must additionally complete them on our registration form, subject to the privacy conditions set out in this Policy.