PRIVACY POLICY
1- WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?
The controller of the personal data and owner of the website https://hostalempuries.com is HOSTAL EMPURIES S.L, a trading company with registered office at Platja del Portitxol s/n, 17130 L’Escala (Girona), and Tax ID (CIF): B-58836065, registered in the Mercantile Register of Girona (hereinafter, the Hotel or the data controller).
THE HOTEL has taken the technical and organisational measures necessary to comply with data protection regulations.
The contact details of THE HOTEL in relation to privacy and the protection of your personal data are:
+34 972 770 207
info@hostalempuries.com
2- WHAT TYPE OF PERSONAL DATA DO WE PROCESS AND FOR WHAT PURPOSE?
For reasons of confidentiality, we collect as little data as possible from our customers, beyond the data they provide to us voluntarily or the data that we are required by law to collect and retain in the case of bookings made through the booking engines.
We may collect and process the following categories of personal data:
a. Name, title, gender.
b. Your contact details and address, your telephone number if you make a booking by telephone and give it to us, your email address if you make a booking from your email, or the data required by the booking engine to make a booking.
Details and date of your booking, information about your stay and preferences, as well as your credit card details. Your credit card details. If you make a booking electronically, the system may ask you for a selfie in order to verify the authenticity of the documentation provided. Your image will only be used for those purposes and will only be kept for as long as is strictly necessary.
Please note that when you make a booking through the booking engine, your data will be processed by the company that operates it, as controller, applying its own privacy policy, which is available on the booking page itself. We recommend that you read it. That data will be disclosed to us in order to manage the booking you have made through the booking engine.
c. In the case of our employees, identification data, social security data, bank details and all data necessary for the performance of the employment relationship.
d. Identification data of our suppliers and, where they are companies, of their contact persons.
e. Information collected when you use our website and other digital media, where applicable.
When you use our website, we may record your IP address, browser type, operating system, referring website and web browsing behaviour.
f. Information relating to social media.
Depending on your social media settings, we may receive information from your social media provider. For example, when you sign in with a social media account to use our services, we may receive your social media profile, including contact details, interests and contacts. For further information on the personal data we receive from your social media provider and how to change your settings, please consult the website and privacy policy of your social media provider.
g. Information you choose to share with us.
You may choose to share information with us, for example, by adding a comment on LinkedIn or Facebook.
h. Images captured by our video surveillance cameras inside our establishment.
2.1.-Your personal data will only be used for the following purposes:
a. To register you in our database if you make a booking or contract any of our services.
b. To carry out the necessary commercial and administrative procedures with the users of our website and our customers or potential customers.
c. At THE HOTEL we process the information you provide to us in order to respond to any request for information you send us, provide you with information about our services, manage your bookings and the provision of our services both internally and externally, as well as the purchases we make from our suppliers, or to comply with the legal obligations arising from such activities.
d. To send commercial and advertising communications by email, social media or any other electronic or physical means, where you have expressly consented to receiving such commercial communications by electronic means. If you have registered in our customer database, we may send you commercial information related to our services without requiring your prior consent.
e. To contact you in order to respond to your enquiries and handle your complaints.
f. To contact you in order to obtain your opinion on the quality of our services or the treatment received.
g. Likewise, any data that may be collected while you browse will be processed in order to provide access to the online content of the website, as well as to deal with requests from website users and to keep a statistical record of visits (IP addresses, browser data, country, page accessed, etc.) so as to help us develop better services and products, optimise our offer, provide a more effective customer service and improve the design and content of our websites.
h. The data of our customers and suppliers will be processed, within the contractual relationship that binds them to us, in compliance with the administrative, tax, accounting and employment obligations required under current legislation.
i. Objection or withdrawal. You may object to or withdraw your consent to receiving marketing communications at any time by following the instructions in the relevant marketing communication or by contacting us via our email address info@hostalempuries.com
j. If you complete any of the forms on our website, you will need to provide certain personal data, which will be processed for the purpose for which it is requested.
In accordance with the LSSICE, we inform you that THE HOTEL does not engage in SPAM practices and therefore does not send commercial emails without the necessary legal basis. In any case, you will always have the option of withdrawing your consent to receive our communications.
We will not process your personal data for any purpose other than those described in this Policy, except where required by law or by court order.
Your personal data will not be subject to decisions based on automated processing that produce effects on you.
3- WHAT IS THE LEGAL BASIS FOR THE PROCESSING OF YOUR DATA?
The legal basis for the processing of your personal data is your express consent given for the purposes described above, which will be requested when you ask us for information, or by ticking the corresponding box when providing your data in any of our personal data collection forms.
Where a commercial relationship arises between you, whether as a customer, supplier or employee, and THE HOTEL, the legal basis for the processing of your personal data will be the performance of the contractual relationship thus created and, where applicable, compliance with the corresponding legal obligations.
If you do not provide us with your personal data or do not accept our privacy policy, THE HOTEL will not process your personal data, but this may also mean that we are unable to send you information or, where applicable, to provide you with our services.
Curricula vitae
If the user sends their CV to the Hotel, by email or through the “work with us” section of our website, we inform you that the data provided will be processed in order to include you in any recruitment processes that may arise, analysing the applicant’s profile with the aim of selecting the best candidate for the vacant position at the Hotel. Should there be any change to your data, please inform us in writing as soon as possible in order to keep your data duly up to date.
We inform you that your CV and the data it contains will be kept for a maximum period of one year, after which the data will be erased, guaranteeing full confidentiality both in its processing and in its subsequent destruction. In this regard, once that period has elapsed, if you wish to continue taking part in the Hotel’s recruitment processes, please send us your CV again.
However, if you are hired by the Hotel, your CV will be kept, together with the rest of your employment file, for as long as your contractual relationship with the Hotel continues.
Commercial information.
Any communication sent will be incorporated into THE HOTEL’s information systems.
If you provide us with your email address and accept this privacy policy, we inform you that THE HOTEL may carry out the following activities and/or actions, unless you tell us otherwise:
– Sending any information, including commercial information about news, new developments, etc., and any information related to our activities or to the services contracted by our customers. The legal basis for this processing is our legitimate interest within the commercial relationship established with you.
4- RETENTION PERIOD How long will we keep your data?
The personal data you provide to us will be kept for as long as necessary to handle the information you request from us, to manage your bookings or to perform any contract entered into between THE HOTEL and third parties. Where we hold your identification data in our database for the purpose of sending commercial information, it will be kept for as long as the legal basis that legitimises its retention and use remains in place. You may cancel your data at any time so as not to receive commercial information.
Once the data has fulfilled the purposes for which it was collected, we will delete it permanently. However, we will keep your data for longer where necessary to comply with legal obligations. Likewise, it may be necessary to keep it for the time required for any legal liabilities arising to become time-barred.
The data you provide to us to begin a recruitment process at THE HOTEL will be kept for a maximum period of one year. Thereafter, if you have not joined THE HOTEL and are not involved in a recruitment process, it will be deleted and we will not keep a copy.
The personal data of our employees will be kept for the duration of their employment relationship with THE HOTEL and, thereafter, for the periods provided for by law.
The personal data of candidates who have been shortlisted by a temporary employment agency (ETT) and provided to us within the framework of a recruitment process will only be kept by us for the duration of that process and thereafter if the candidate is finally selected by THE HOTEL. Otherwise, it will be returned to the temporary employment agency or destroyed, as instructed by the agency, and we will not keep a copy of it, except that it may be kept temporarily for a subsequent recruitment process.
5- TO WHICH RECIPIENTS WILL YOUR DATA BE DISCLOSED?
Within our organisation, your personal data will be processed by duly authorised staff and, if necessary or practical to fulfil the purposes indicated above, it may be processed by third parties.
The categories of recipients to whom your personal data may be disclosed are as follows:
a. Third parties appointed as data processors, such as IT providers, consultants and advisers, and other companies providing ancillary services.
b. Public bodies and authorities, including the Police, solely for the purpose of complying with the applicable legal obligations.
c. Other providers to whom your personal data may, where applicable, be disclosed, such as financial institutions, fraud detection service providers, where applicable, etc.
d. Social media providers.
In any case, all the third parties mentioned above will have previously signed the corresponding confidentiality undertaking, following our instructions in accordance with current personal data protection regulations, will be subject to the duty of professional secrecy or will act in compliance with a legal obligation.
The information you provide to us through this website will be hosted on THE HOTEL’s servers.
6.- WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?
If you wish to exercise the rights granted to you by data protection regulations, please send us an email at the following address info@hostalempuries.com stating in the subject line the right you wish to exercise and attaching a copy of your national identity document or passport.
The rights recognised by current regulations which, where applicable, you may exercise are:
Right of access to data:
You have the right to obtain confirmation from THE HOTEL as to whether or not your personal data is being processed and, where processing is confirmed, THE HOTEL will give you access to it by providing you with the following information:
-The purposes of the processing.
-The categories of data concerned.
-The period or criteria for retaining the data.
Right to rectification of data:
You will have the right to have THE HOTEL rectify your data where it is inaccurate or incomplete, by means of a supplementary corrective statement.
Right to erasure of data:
The data subject will have the right to have THE HOTEL erase their data where:
-The processing is unlawful.
-The data subject has withdrawn their consent.
-The data is no longer necessary in relation to the purposes for which it was collected or processed.
-The data subject has exercised the right to object and there are no overriding legitimate grounds for the processing.
-The data must be erased to comply with a legal obligation of THE HOTEL.
The data subject will not have the right to have THE HOTEL erase their data where the processing is necessary:
-To exercise the right of freedom of expression and information.
-To comply with a legal obligation of THE HOTEL.
-For the establishment, exercise or defence of legal claims.
-For reasons of public interest based on current legislation, on grounds of public health or for historical, statistical or scientific research purposes.
Right to data portability:
You have the right to have THE HOTEL transmit your data to another controller or to the data subject themselves, in a structured, commonly used and machine-readable format, where the processing is carried out by automated means and is based on:
-The consent of the data subject for specific purposes.
-The performance of a contract or pre-contract with the data subject.
The right to data portability will not apply where:
-The transmission is technically impossible.
-It may adversely affect the rights and freedoms of third parties.
-The processing is carried out for a task in the public interest based on current legislation.
Right to restriction of processing:
The data subject will have the right to object to the processing of their data carried out by THE HOTEL on grounds relating to their particular situation, where the processing is based on:
-Direct marketing.
-Profiling.
-The legitimate interest of the controller or third parties, provided that the interests or rights and freedoms of the data subject do not override it, particularly where the data subject is a child.
-Historical, statistical or scientific research, unless the processing is necessary for reasons of public interest.
Even if the data subject objects to the processing of their data, THE HOTEL may continue to process it provided that its legitimate interest overrides the interests or rights and freedoms of the data subject in legal proceedings that justify it.
THE HOTEL must inform the data subject of the right to object to the processing of their data explicitly, clearly and separately from any other information, at the time of the first communication.
Right to object:
This is the right to have your data not processed, or to have the processing stopped, where your consent is not required for the processing, owing to the existence of a legitimate and well-founded reason relating to your specific personal situation that justifies it, and provided that no law provides otherwise.
Right not to be subject to profiling:
The data subject will have the right not to be subject to profiling whose purpose is to take individual decisions based on automated data processing and intended to evaluate, analyse or predict the following personal aspects:
-Performance at work.
-Economic situation.
-Health.
-Personal preferences or interests.
-Reliability.
-Behaviour.
-Location or movements of the person.
Where profiling is based solely on automated processing:
-The data subject will have the right to be informed if the decision that may be taken may produce legal effects that significantly affect them.
-The data subject will have the right to obtain human intervention on the part of THE HOTEL, to express their point of view and to contest the decision, if the processing has been authorised by:
-The explicit consent of the data subject.
-A contract between THE HOTEL and the data subject.
The right not to be subject to profiling will not apply where the decision that may be taken as a result of it is authorised by:
-The explicit consent of the data subject.
-A contract between THE HOTEL and the data subject.
-Processing based on current legislation.
7-COMPLAINT TO THE SUPERVISORY AUTHORITY:
If you consider that THE HOTEL has infringed any of your rights protected by personal data protection regulations, or that it has breached any obligation in relation to the protection of Personal Data, you have the right to lodge a complaint with the competent supervisory authority, which in Spain is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), located at Calle Jorge Juan, 6. 28001 – Madrid.
Tel. 901 100 099 – 912 663 517
You may also lodge an electronic complaint through the electronic office available on its website https://www.aepd.es
8-LEGISLATION AND JURISDICTION
This privacy policy is governed in each and every one of its terms by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
It is also governed by Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). Likewise, our website is governed by Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSICE).
Users of this Website are subject to Spanish legislation and jurisdiction, to which they expressly submit, the Courts and Tribunals of GIRONA being competent to resolve all disputes arising from or related to its use.
9- ADDITIONAL INFORMATION
-SOCIAL MEDIA (PRIVACY POLICY)
We inform you that THE HOTEL may have a presence on social media. The processing of the data of persons who become followers of THE HOTEL’s official pages on social media (and/or make any link or connection through social media) will be governed by this section, as well as by the terms of use, privacy policies and access rules of the social network concerned in each case, as previously accepted by the user.
THE HOTEL will process your data for the purposes of properly managing its presence on the social network, informing you of the provider’s activities, products or services, and for any other purpose permitted by the rules of the Social Networks.
The publication of the following content is prohibited:
– Content that is allegedly unlawful under national, EU or international regulations, or that carries out allegedly unlawful activities or contravenes the principles of good faith.
– Content that violates people’s fundamental rights, breaches online etiquette, causes annoyance or may give rise to negative opinions among our users or third parties and, in general, any content that THE HOTEL considers inappropriate.
– And, in general, content that contravenes the principles of legality, honesty, responsibility, protection of human dignity, protection of minors, protection of public order, protection of privacy, consumer protection and intellectual and industrial property rights.
Furthermore, THE HOTEL reserves the right to remove, without prior notice, from the website or from the corporate social network any content considered inappropriate.
Communications sent through social media will be incorporated into a file owned by THE HOTEL, which may send you information of interest to you.
You can access further information, as well as consult the companies that form part of our group, in this privacy policy.
In any case, if you send personal information through the social network, THE HOTEL shall be exempt from liability in relation to the security measures applicable to this platform, and the user, should they wish to know them, must consult the corresponding specific terms and conditions of the network in question.
SECURITY MEASURES:
The data you provide to us will be treated confidentially. THE HOTEL has adopted all the technical and organisational measures and all the levels of protection necessary to guarantee the security of data processing and to prevent its alteration, loss, theft, or unauthorised processing or access, in accordance with the state of technology and the nature of the data stored. Likewise, it is also guaranteed that the processing and recording in files, programs, systems or equipment, premises and centres comply with the requirements and conditions of integrity and security established in current regulations.
LANGUAGE
The language applicable to this Privacy Policy is Spanish. Therefore, should there be any contradiction in any of the versions provided in other languages, the Spanish version shall prevail.
10- UPDATE
This Privacy Policy was last updated in October 2025 but may be updated at any time. We recommend that you consult it each time you access our website in case it has been amended.