I.- Who is responsible for processing your data?
The entity in charge of your data is Barceló Gestión Hotelera, S.L. (hereinafter, for this document, “BGH” or “Barceló”) with registered office at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca. If you have any queries regarding data protection, please get in touch with the Barceló Group Data Protection Office by sending an e-mail to firstname.lastname@example.org.
II.- Why do we process your data?
BGH hereby informs the Interested Party that Barceló will process their personal data, with the following purposes:
1. Managing bookings and requested services. There are two direct channels available to users to manage and confirm their purchases of BGH products and services: the website (Barcelo.com) or call center.
When products or services are booked over the phone, BGH will record the call in order to confirm and verify the bookings made by users. BGH shall always inform users that the call will be recorded, with users acknowledging that they consent to be recorded by continuing with the call. Any non-conformity means the user’s booking request cannot be processed or confirmed.
BGH shall process the personal data submitted by users via the data collection forms to manage bookings requested by users.
For the same purpose, BGH shall transfer users’ data to the company that owns the hotel, depending on the hotel chosen by users during the booking process. This data transfer may involve an international transfer to a country that does not provide the same personal data protection offered within the European Union. Under the provisions established in data protection regulations, the international transfer will be made to process the service requested by users. The only data transferred to said entities shall be information essential for processing the hotel booking chosen by the user and shall only be used for this purpose.
Likewise, BGH shall solely process the information required to process booking modifications or cancellation requests made by users.
If users provide information on their health in open form fields, or when expressly requested by the tour operator or Call Centre representative to provide specific services, BGH understands that said data are expressly provided voluntarily by the user, given that this information has not been requested previously and will only be used to process the user’s request (for example, rooms adapted to individual needs).
Legitimacy: this data processing is necessary for executing the contract.
2. Sending reminders of unfinished bookings (abandoned shopping baskets). If specifically requested by users, BGH may send said users reminders if they have not completed a booking they initiated using information entered by the users on the website payment form and only if the user expressly agreed to receive reminders when they initiated unfinished booking.
Legitimacy: BGH shall only carry out this processing if the user has given consent by ticking the appropriate consent request box displayed during the booking process. However, if users identified themselves as myBarceló users, BGH shall process the data based on a legitimate interest since the user is already part of the myBarceló programme and the sole purpose is to send a reminder of an unfinished booking.
3. For the fulfilment of accounting, legal, fiscal and administrative obligations.
Legitimacy: this data processing is necessary for executing the contract.
4. Electronic communications with information regarding offers and promotions about products and services offered by BGH.1. To offer the user products and services that may be of interest to them, they will be sent offers on products and services related to those contracted with BGH.
If applicable, users signed up to myBarceló following paragraph 10 may receive special commercial communications for programme users with discounts or exclusive offers aimed solely at such users. Legitimacy: this data processing is necessary to comply with the obligations under the Law on Information Society Services and Electronic Commerce, as well as to satisfy Barceló’s legitimate interest in guaranteeing internet and data security.5. For commercial communications about offers related to products and/or services already requested by users or booked previously with BGH that may be of interest to the users, personal data may be processed to create profiles based on internal sources (e.g. browser cookie data, historical data and statistics regarding BGH products). These results allow personalised products to be designed and analysed by segmentation different groups based on common patterns. These profiles will only be used to send personalised communications about the products and services offered by BGH.
BGH would like to inform users that, for marketing purposes and intending to improve its products continuously, it uses a provider located in the United States called Salesforce Inc., which involves an international transfer of data regarding its users. This provider complies with the Privacy Shield agreement, which regulates international transfers between entities located in the European Union and those located in the United States, ensuring that transfers are carried out in line with the agreed terms and that the provider processes the data in compliance with the agreed stipulations. Legitimacy: this data processing is required to satisfy the legitimate interests of BGH. 6. Sending commercial communications about offers unrelated to purchased services and/or products.BGH may send promotional offers about certain products available to users in the hotel (e.g. room features, SPA, Golf, Barceló Experience). Likewise, BGH may send information on activities related to tourism and leisure, as well as cultural activities, excursions, sporting events, etc. which may or may not be offered, together with the accommodation services available in our hotels. Legitimacy: data will only be processed if BGH has received user consent. 7. Disclosure of personal data to owner companies of Barceló hotels to offer personalised services for users in the hotel. BGH may transfer users’ data to the owner company of a Barceló branded hotel with which users have made a booking to improve the hotel's user experience. Accordingly, BGH shall provide the owner company of the hotel with information obtained from the relationship between BGH and users and information obtained from other sources under the provisions of paragraph 8.
This communication may entail an international transfer of data when the hotel to be sent the data is located outside the European Union. In any event, user data shall only be transferred with their express consent and only to the hotel chosen by the user to offer personalised services offered in the hotel in which the booking has been made.
Legitimacy: this data will only be processed if BGH has the user's consent.
8. Implementation of market analyses. To offer users more personalised services, BGH will create profiles based on data taken from user sales and take into account their tourism preferences, holiday experiences, and financial capacities. The data used in these profiles may have been obtained from data generated by users at the hotel where they stayed or from external sources (for example, the internet, social media). This information is handy for BGH to offer its users personalised products based on their commercial preferences as demonstrated by their use of services offered in the hotels, thus enabling BGH to enhance the user experience in terms of services provided and future bookings.
BGH informs that, to fulfil this purpose, it will also use its supplier located in the United States, called Salesforce Inc. The user can find information on international transfer in paragraph 5 and section IV.
Legitimacy: This processing will only be carried out if BGH has the user's consent. 9. Managing the subscription to receive newsletters electronically with information regarding BGH's offers and promotions about products and services. Users may request to subscribe to the BGH newsletter by ticking the box “I want to subscribe”. From then on, BGH may send users regular newsletters with information on products and services offered by BGH.
Legitimacy: data shall only be processed if BGH obtains the users' consent to mark the newsletter subscription option. 10. User registration for the myBarceló Loyalty Programme.BGH shall process identification data required to enable users to register with the myBarceló Loyalty programme, designed to enjoy specific discounts when booking BGH products, request information concerning hotels or regarding services or benefits solely available to myBarceló users.
Where applicable, myBarceló users may:
- Receive exclusive commercial communications about the Programme through the contact channels provided by users during the registration process (email, post or phone number).
- Receive special gifts as a reward for using the benefits and the special promotions offered by myBarceló.
If users wish to register by identifying themselves via Facebook, Google+ or Twitter, they should be aware that in such cases said entities will provide us with information related to their identity (name, surname(s) and/or relevant network ID), together with any information the users wish to share when using this option to register. Legitimacy: data shall only be processed if BGH has received users’ consent via one of the following channels:
- Through voluntary registration in the programme by users via the online registration form.
- Ticking the consent box when users register with the myBarceló Programme while booking a BGH product.
Through proactive user identification via Facebook or Twitter.
Notwithstanding the foregoing, BGH may send or offer special gifts to myBarceló users based on a legitimate interest, based on the relationship between BGH and the user.If myBarceló users provide personal data of a third party, said users should guarantee the veracity of the information disclosed to BGH and ensure that the third party has been informed and express consent has been obtained for the aforementioned transfer. 11. SMS alert programme for myBarceló users.After registering with the myBarceló Loyalty Programme, users will receive an SMS offering to subscribe to BGH’s SMS Alerts Programme, BGH Alerts. The Programme sends registered users SMS alerts relating to updates to their stays and alerts regarding promotions and abandoned online shopping baskets. To subscribe to the BGH Alerts Programme, users must be registered with the MyBarceló Loyalty Programme and answer YES to the SMS received to confirm a subscription to the BGH Alerts Programme. If help is required regarding the Programme, users must send an SMS with the word HELP. To unsubscribe from the Programme, users must send an SMS with the word STOP. Users subscribed to the BGH Alerts Programme shall receive two messages per month. Data and/or message rates established by their operator may apply. Legitimacy:data shall only be processed if BGH has obtained users’ valid consent by sending YES confirming their subscription to the Programme.12. Complaints management. To centrally manage any complaints submitted by users based on the services requested by users, BGH shall receive the information relating to the complaint issued in the hotel to process the said complaint and offer users the best possible solution. Accordingly, BGH will need to access the information generated by users in the hotel to handle the complaint issued in the best possible manner.When applicable, if the complaint warrants compensation for damage suffered by the user, BGH shall transfer this information to the insurance company contracted by BGH to investigate the damage suffered by the user.
Legitimacy: this processing is necessary for the execution of the contract. 13. Query management and other requests.BGH shall process data required to address queries or requests sent by users via the different contact forms available on the website and through the point of contact form via live chat sessions. Likewise, users can submit queries or requests over the phone. BGH informs users that calls may be recorded to handle users’ requests as effectively as possible and for security purposes. Legitimacy: BGH shall only process data if user consent has been obtained by ticking the boxes provided on the aforementioned contact forms or when understood by voluntarily submitting queries over the phone. 14. Monitoring of online reputation.BGH may carry out checks on the ratings submitted by users on websites such as TripAdvisor and the like to monitor its online reputation and make business decisions that ensure the continuous improvement of its services, contacting users who have had a negative experience to offer possible solutions. BGH understands that it has a legitimate interest in improving its services and protecting its brand. Legitimacy: this processing is based on the legitimate interest held by BGH to protect its brand’s online reputation and resolve claims and complaints made on websites such as those mentioned.15. Legal or administrative procedures. BGH, in the event of possible legal or administrative procedures that may arise from services offered or provided by BGH, shall process the necessary information to submit the relevant allegations, exercise its lawful right to defence, or file any claims deemed appropriate based on the facts.
Legitimacy: this processing is based on legal obligations established by administrative regulations (mainly the Common Law on Administrative Procedure) or is necessary to ensure that BGH can exercise its legitimate right to effective legal protection, both in its right to a defence as well as to lodging judicial complaints that it deems necessary, based on the Civil Procedures Act or the Criminal Procedures Act. 16. Submission of quality surveys. To assess the level of user satisfaction regarding the requested products and/or services, BGH shall send quality surveys to obtain users’ opinions on these products and services and continuously improve the quality of the services provided.Legitimacy: this processing is based on the legitimate interest of BGH. 17. Implementation of controls for the detection of fraudulent activities.To control and follow up on actions that may be considered fraudulent, either currently or in the future, BGH would like to inform customers that it analyses the transactions they make. This allows BGH to identify and analyse those customers it detects as acting fraudulently in detail during the booking process and, if necessary, to draw up a list of those temporarily excluded from the booking process. Legitimacy: this processing is based on the legitimate interest of BGH, given that it involves controlling and monitoring all the operations carried out by its users to detect possible fraudulent activities in the transactions that take place during the booking process.
III.- How long will we keep your data for?
Any personal data that can be accessed shall be processed and stored while the contractual relationship is ongoing or for the purpose for which they were collected. After this, BGH shall store personal data, in a duly secure manner, after the termination of the contractual relationship or when they are no longer required for the purpose for which they were collected, to make such data available to any competent Public Administration services, Judges and Courts, or the Prosecution Service during the statutory time limit for actions that may have arisen from the relationship held with the user and/or legally established retention periods. Once said time frames have passed, BGH shall proceed with the physical deletion of your data.
If users have given their consent for the processing purposes indicated in this clause, BGH shall retain their information provided the consent initially given by the user has not been withdrawn via the methods established in section V.
IV.- Who will we share your data with?
BGH may communicate data to:
- Holding companies of Barceló brand hotels. This communication may entail an international transfer of data. They will receive any personal data required to manage the booking or manage the request submitted by users.
- Insurance brokerage and insurance company of BGH should users suffer damages that entitle them to compensation.
- Competent Public Bodies, Judges and Courts.
- Besides the aforementioned data sharing, BGH works with third parties who provide services and have access to the customers' personal data, which they process in representation and on behalf of BGH as a result of providing said services. Specifically, BGH hires third parties to supply, for example, and not limited to, services in the following sectors: legal advice, multidisciplinary professional services, tech services, IT services. Providers include Salesforce Inc., a company located in the United States that complies with the Privacy Shield.
V.- What rights do you have when providing us with your data?
Users may, if they so wish, exercise their right to access, amend and delete their data, as well as request that the processing of their data be limited, oppose said processing, request the portability of their data, and request not to be subject to individual decisions based on automated processing, using the following:
- By writing to the postal address provided above.
- By emailing your request to email@example.com.
Users may withdraw their consent for the data processing carried out based on their consent by following the steps described in the previous paragraph.
Users may oppose the processing of their data based on the legitimate interests of BGH, particularly concerning receiving commercial communications, the creation of commercial profiles and receiving surveys.
VI.- How have we obtained your data?
The personal data processed by BGH is that which has been gathered through:
- Our direct channels:
- Website (www.barcelo.com).
- Call centre for telephone enquiries.
- Companies owning the hotels if user consent has been obtained.
- Internet and social media, if user consent has been obtained.
VII.- With which authority can you exercise your right to claim?
Users may file a claim with the Agencia Española de Protección de Datos [Spanish Data Protection Agency] regarding any response received from BGH in addressing their rights. In any event, users are hereby informed that any claims relating to the processing of personal data shall be managed and processed by the Data Protection Officer of the Barceló Gestión Hotelera, S.L., located at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca, or by sending an email to: firstname.lastname@example.org, attaching to this request, in both cases, a copy of their National Identity Document, Tax ID number, or an official document that identifies them.