DATA CONTROLLER

PALLADIUM GESTIÓN, S.L.U. or which make use of the systems owned by PALLADIUM GESTIÓN, S.L.U.) is particularly aware of protecting the personal data of Users of the services of its Website and its clients. Through this Privacy Policy (or Data Protection Policy) the owner of this site, PALLADIUM GESTION, S.L.U., informs Users of the website on the uses to which the personal data collected is subjected, so that they may decide, freely and voluntarily, whether they wish to provide the requested information

PALLADIUM GESTION, S.L.U. reserves the right to modify this Policy in order to adapt it to new legislation, judicial criteria, practices of the sector or interests of the entity. Any modification to it will be announced with due notice, so that you are perfectly aware of its content. .

The data controller is PALLADIUM GESTION, S.L.U. with address for these purposes at: Avenida Bartolomé Roselló, 18, 07800 Ibiza (Balearic Islands). The processing activities carried out on our websites and on stays of clients at our hotels involves the processing of personal data by the group of entities linked with PALLADIUM GESTIÓN, S.L.U. You can obtain more information on all these entities at the following link enlace.

PURPOSES

The data controllers may process your personal data for the following purposes:

1. Management of the accommodation reservation at any of the hotels managed by PALLADIUM GESTION, S.L.U. This includes:

• Attending to your reservation request made through our website or Call Centre, or through a third party.
• Attending to your special requests and preferences associated with the reservation, entered in the open field for comments on the form available on our website.
• Sending of confirmation of the reservation guaranteed by credit card.
• Attending to contact requests for managing, cancelling or modifying your reservation through the “Reservations Contact” or through our Call Centre.

2. Management of the stay at all our hotels to offer you our best service and the best assistance possible at each one. For this purpose, the data controllers may:

• Attend to your needs, special requests and preferences stated by you during your stay at the hotel.
• Take into account the products and services contracted and enjoyed by you to offer you products and services that may interest you, based on statistical data produced by us.
• Analyse data on personal preferences, interests and requests made of hotel personnel, based on the information gathered during your stay, to make your current and future stays and experiences at hotels that make up PALLADIUM HOTEL GROUP optimal thanks to providing a personalised service.

3. 3. Management of the “Online Check-in”: the data controllers may send an email so that the data subject may voluntarily carry out initial management online regarding their check-in at the hotel.

4. Management of information and contact requests through the specific channels and/or forms available for this. This includes:

• Attending to your contact requests with PALLADIUM HOTEL GROUP.
• Responding to your requests for information on activities carried out by PALLADIUM HOTEL GROUP.
• Managing the subscription, and if applicable, unsubscription from the PALLADIUM COMMUNITY Newsletter, to send you updated information on the activities, products and services of PALLADIUM HOTEL GROUP, as well as for receiving exclusive promotions.
• Sending of commercial communications by any means (including electronic) to inform you of news, offers, events and our products or services which may interest you.

5. PALLADIUM GESTION S.L.U. manages the “Palladium Rewards” loyalty programme. This includes:

• Managing the subscription, and if applicable, unsubscription from the “Palladium Rewards” programme, as well as administrating the obtaining and redemption of user points within it.
• Information, and if applicable, registration for prize draws organised by or participated in by the data controller.
• Sending of communications related with your account, including, among others, points balance, category of your card or level, notifications and any other element that keeps the holder informed of their account status.

6. Receiving clients’ opinions through satisfaction surveys.

7. Information, and if applicable, registration for conferences or events organised by or participated in by the data controller.

8. Managing employment requests, through collection of CVs, in order to contact the data subject and undertake a selection process.

9. Sending “abandoned shopping cart” reminders: the data controller may send the data subject communications to remind them of the non-completion of contracting or a reservation that was initiated. The information included by the user on the website will be taken into account. This purpose will only be carried out if the user has expressly consented to it.

LEGITIMATE BASIS

The data controller is legitimised for processing your personal data based on:

• Execution of a service provision contract, by virtue of article 6.1.b) of the General Data Protection Regulation, for the formalisation and execution of the reservation.
• The explicit consent you have granted on the "Palladium Rewards” Programme, as established by article 6.1.a) of the General Data Protection Regulation, as well as the execution of a service provision contract, by virtue of article 6.1.b) of the aforementioned Regulation.
• The legitimate interest of PALLADIUM GESTION, S.L.U. as well as the rest of the companies owning hotel establishments managed by it, by virtue of article 6.1.f) of the General Data Protection Regulation, with regard to data on the stay and experience at the hotel. In this case, proportionality and relevance of this interest has been evaluated against the rights of the data subjects.
• The explicit consent you have granted, in the cases requested, for one or several specific purposes as set out in article 6.1.a) of the General Data Protection Regulation by completing forms and checking the box established for this purpose. In these cases, the data subject has the right to withdraw consent at any time, without this affecting the legality of processing based on consent prior to its withdrawal.
• Fulfilment of a legal obligation imposed on the data controller in accordance with article 6.1.c) of the General Data Protection Regulation, when any regulation requiring a certain processing of personal data to be carried out is applicable.

ORIGIN OF THE DATA

The personal data originates from the reservation made by the data subject, from the forms completed by them, made available by the data controller, or from the user experience collected during their stay at hotels managed by PALLADIUM GESTION, SLU.

In the case of the data not originating directly from the data subject, it will originate from the reservation made by the data subject through a third party (such as a travel agency or travel reservation page, for example).

RETENTION PERIOD 

The personal data provided will be retained for the corresponding period to comply with legal obligations or to respond to potential claims during the limitation period for civil claims.

Additionally, with the purpose of improving your experience during future stays at our hotels, we will keep the data related with your visit history for the period of seven years, unless you request otherwise, in which case it will be kept for the legally established periods and for the period that may be required by a judge or court. To learn about all retention periods, you can contact our Data Protection Officer.

SECURITY MEASURES

PALLADIUM HOTEL GROUP has adopted security measures to protect the confidentiality, integrity and availability of information with both organisational and technical measures. The entity has the following measures, among others:

a) Data blocking procedures. In accordance with article 32 of Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, the entity blocks your data to prevent its processing.

b) Security breach management procedures. The entity has technical measures to detect security incidents that may affect the data processing carried out. Once a security incident is detected, PALLADIUM HOTEL GROUP has established measures to resolve the incident, and if applicable, proceed to report it to the competent authorities and/or the data subjects.

c) Personal data pseudonymisation and encryption procedures. With this measure, PALLADIUM HOTEL GROUP guarantees that the data of the data subject is in a situation of maximum confidentiality.

d) Procedures to restore availability of and access to personal data in case of technical or physical incident.

PALLADIUM HOTEL GROUP regularly evaluates the efficacy of the technical and organisational measures to guarantee the security of processing.

DATA RECIPIENTS

The personal data that you provide the data controller may be communicated to the following categories of recipients:

• Third parties to which the entity is obligated to transfer information, such as public authorities, for the purpose of compliance with the requirements of these authorities and applicable regulations, if applicable (article 6.1.c) GDPR).
• The companies owning the hotels that make up PALLADIUM HOTEL GROUP in order to be able to make the reservation at them based on execution of a contract or pre-contractual measures (article 6.1.b) GDPR), and to show them the personal preferences, interests and requests from the information collected during previous stays, to provide you a personalised service, based on the legitimate interest of the data controller (article 6.1.f) GDPR), and if applicable, the consent granted in accordance with the “Palladium Rewards” programme.

The entities that act as data controllers do not commercialise, sell or carry out any similar activity with your personal data, only processing your personal data for the indicated purposes. These entities have service providers with access to personal data (Data Processors). Among these service providers, there may be companies located outside of the European Economic Area, therefore international data transfers may be carried out, in all cases complying with the appropriate guarantees in accordance with articles 44 and following of the GDPR. For undertaking international transfers with the providers of PALLADIUM GESTION, S.L.U. located in the USA, the data protection contractual clauses adopted by the European Commission are provided as a guarantee.

RIGHTS OF USERS

Nevertheless, the data subject of the personal data may in all cases exercise their rights, in accordance with the General Data Protection Regulation, which are the following:

• Right to request access to personal data regarding the data subject,
• Right to request its rectification or deletion, ,
• Right to request the limitation of its processing,
• Right to oppose processing,
• Right to data portability

The data subject may exercise these rights by request accompanied by a copy of their DNI identity document, specifying which of these rights they wish to exercise, sent to the data controller at the address: Avenida Bartolomé Roselló, 18, 07800 Ibiza (Balearic Islands) or by email to rgpd@palladiumhotelgroup.com

In case of considering your right to personal data protection to have been violated, you may file a claim before the Spanish Data Protection Agency (www.aepd.es).

Date of update: 1 January 2022