Privacy policy
1. Initial information
Your personal information is very important to EXCEL HOTELS & RESORTS, S.A. That is why we process it confidentially and securely. We are committed to guaranteeing the privacy of personal data at all times and to not collecting unnecessary information.
To access our website you do not need to register beforehand. If you need more information, you can contact us through the form that you can find on our website, as long as you agree with our Privacy Policy, which you must accept to confirm your express consent for the data processing carried out for the purposes stated.
In accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as with Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, we provide you with information on the processing of your data through this Privacy Policy.
2. Who processes your data?
Company Name: EXCEL HOTELS & RESORTS, S.A. (hereinafter “Excel Hotels & Resorts”).
Tax ID (NIF): A38083101
Address: Calle Santa Rosa 5 (apartamentos Royal Palm, urbanización Oasis del Sur), Arona, 38650, Tenerife.
Email: gdpr@onahotels.com
3. Joint responsibility for processing
The user is hereby informed that the management of CVs will be carried out under the joint responsibility of the companies that make up the Ona Hotels & Apartments brand, Excel Hotels & Resorts and Ona Vacation Club, with the data controllers being as follows:
• Clubotel La Dorada, S.L.
• Apartur Marinas de Nerja, S.L.
• Galatea Marbella, S.L.U.
• Ona Campanario Management, S.L.
• Cala Pi Maintenance, S.L.
• Inmobiliaria Aucanada, S.L.
• Excel Hotels & Resorts, S.A.U.
• Wimpen Leisure Management, S.A.
• Bahía Blanca Leisures, S.L.
• Ogisaka Costa Blanca, S.L.
4. What data do we collect, for what purposes and for how long?
| DATA PROCESSING | PURPOSE AND LEGAL BASIS | RETENTION PERIOD |
| Functioning of the Website | To ensure the proper functioning of the website, as well as its all its features, personal data will be processed to the extent strictly necessary to provide and ensure the security of the application and information, with the legitimate basis being the legitimate interest pursued by the controller, in accordance with Art. 6.1.f) of the GDPR. | To ensure the proper functioning of the website, as well as its all its features, personal data will be processed to the extent strictly necessary to provide and ensure the security of the application and information, with the legitimate basis being the legitimate interest pursued by the controller, in accordance with Art. 6.1.f) of the GDPR. The data collected will be kept for the time strictly necessary to fulfil the purpose for which they were collected and in any case to determine the possible liabilities that may arise from this purpose, taking into account the periods established in the corresponding regulations. |
| Members' Area | The data will be processed in order to manage membership documents, as well as to send club news and newsletters, in accordance with Art. 6.1.b) of the GDPR and Art. 21.2 of the Spanish Information Society Services and E-Commerce Law (LSSI-CE), respectively. | The data will be kept until the request has been resolved. In any case, they may be kept in order to determine the possible liabilities that may arise from this purpose. |
| Contact | To respond to requests and/or queries made by the user, with the legal basis of the processing being express consent in accordance with Art. 6.1.a) of the GDPR. | The data will be kept until the request has been resolved. In any case, they may be kept in order to determine the possible liabilities that may arise from this purpose. |
| Payment of maintenance fees | Personal data will be processed in order to manage the payment process, comply with the contractual and legal obligations arising in relation to members, with the legal basis for the processing being the contractual relationship in accordance with Art. 6.1.b) of the GDPR, as well as a legal obligation, in accordance with Art. 6.1.c) of the GDPR. | The data collected will be kept for the time strictly necessary to fulfil the purpose for which they were collected and in any case to determine the possible liabilities that may arise from this purpose, taking into account the periods established in the corresponding regulations. |
| Sending of information about the company and newsletter | Subscription to the company's news, promotions and offers, with the legal basis for the processing being express consent in accordance with Art. 6.1.a) of the GDPR. | The data will be kept for the duration of the subscription to the Newsletter or until the exercise of the right to objection or erasure of the data by the data subject. In any case, they may be kept in order to determine any possible liabilities that may arise from this purpose. |
| Email management | The purposes of data processing are to respond to queries received, as well as to manage the commercial and/or professional relationship, with the legal basis being the contractual relationship between the Data Controller and the data subject, in accordance with Art. 6.1.b) of the GDPR. | The data collected will be kept for the time strictly necessary to fulfil the purpose for which they were collected and in any case to determine the possible liabilities that may arise from this purpose, taking into account the periods established in the corresponding regulations. |
| Work with us | The data will be processed in order to add your application to a database to allow you to participate in the selection process, as well as to receive information on any of the vacancies on offer. The processing of personal data is justified by the express consent provided in accordance with Art. 6.1.a) of the GDPR. | The data will not be kept for longer than necessary for the purpose for which they were collected, unless there is a legal obligation to do so. In this case, they will be kept for a maximum period of one year. |
5. To whom will the data be disclosed?
Unless we have a legal obligation to disclose your personal data or you have given us your express consent to do so, we will not disclose your personal data to third parties.
The user is informed that EXCEL HOTELS & RESORTS, S.A is part of a group of companies under the brand name Ona Hotels & Apartments, whose main establishment is CLUBOTEL LA DORADA, S.L., where the data are stored and managed, with the legal basis being the legitimate interest in transmitting personal data within the business group for its own internal administrative purposes.
6. Are international transfers of data carried out?
No international data transfers to third countries outside the European Union are carried out.
7. What rights do you have as a user and how can you exercise them?
7.1 Right to access
As a user, you can ask us to explain what we do with your personal data.
You can also ask us for information about the purpose of the processing of your personal data, how long we keep your data for, what rights you have as a user, whether your data has been transferred to a third country or an international organisation, the existence of automated decisions or whether profiling is carried out on the website, among other things.
7.2 Right to rectification
If the personal data you have provided us with is inaccurate or incomplete, you have the right to correct or complete it. Please contact us and we will correct the data in accordance with your request.
7.3 Right to the restriction of processing
As a user you can request the restriction of the processing of your personal data when:
• You dispute the accuracy of your personal data for a period of time that allows us to verify its accuracy.
• If the processing is unlawful and you object to the erasure of your personal data and, instead of erasure, you request that their use be restricted.
• If we no longer need your data for the purposes of processing, but you need it to make, exercise or defend claims.
7.4 Right to erasure
You can request that we erase your personal data immediately. We are obliged to delete this data immediately if the data are no longer required for the purpose for which they were collected. In addition, you can ask us to erase your data if you change your mind in terms of consent, if you object and there are no justified reasons for the processing, if your data is processed incorrectly, if it has to be erased in order to comply with a legal obligation or if your data are obtained in relation to a legal offer.
7.5 Right to information
If you have exercised your right to rectification, erasure or restriction, we are obliged to inform all recipients to whom your personal data have been disclosed of said rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.
As a user, you have the right to be informed by the data controller about who these recipients are.
7.6 Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. In addition, you have the right to transfer this data to another data controller without us being able to prevent this.
7.7 Right to object
As a user, you have the right to object at any time to the use of the personal data made available to us for specific personal reasons.
We will stop processing your personal data unless we have compelling legitimate grounds for using them, if these grounds prevail over your interests, rights and freedoms or if the processing is for the purpose of making, exercising or defending claims.
7.8 Right to revoke the data protection declaration of consent
As a User you have the right to change your declaration of consent regarding data protection at any time. This change of decision regarding consent will not affect the lawfulness of the processing that took place based on the consent given prior to its withdrawal.
7.9 Automated individual decisions, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for the User or significantly affects the User in a similar way.
7.10 Right to lodge a complaint with a supervisory authority
As a User you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place where the infringement takes place, if you believe that the processing of personal data entails a breach of the GDPR.
7.11 How can you exercise your rights?
The user may request the exercise of their rights by sending an email to gdpr@onahotels.com.
Likewise, in order to facilitate the exercise of the rights established in Articles 15 to 22 of the General Data Protection Regulation (EU) 2016/679 and Articles 12 to 18 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, and without their use being compulsory, a number of application forms for the different rights are made available to data subjects.
• Access
• Opposition
• Erasure
• Restriction of processing
• Rectification
• Portability
8. Do I have to provide all the information requested in the data collection forms?
For the forms on the Website, you must complete those marked as “required”. Failure to complete the required personal data fields or doing so partially may mean that EXCEL HOTELS & RESORTS, S.A. will not be able to respond to your requests and, consequently, EXCEL HOTELS & RESORTS, S.A. will be held harmless from any liability if the services requested are not provided or provided only partially.
The personal data provided by the User to EXCEL HOTELS & RESORTS, S.A. must be current to ensure that the information in the records is up to date and error-free. The User shall be responsible for the accuracy of the data provided.
9. What security measures do you have in place?
We inform you that we take care of and use your personal data in accordance with the current regulations on data protection and information society services.
We have implemented the necessary technical and organisational security measures to guarantee the security of the User’s personal data and prevent its alteration, loss, processing and/or unauthorised access in accordance with the state of the art, the nature of the data stored and the risks to which they are exposed, whether from human action or the physical or natural environment, in accordance with the provisions of current legislation.