Through this notice, TRAMO, SA (hereinafter “TRAMO”), informs users of the Website https://www.hotelcasasagnier.com in compliance with Regulation (EU) 2016 of the European Parliament and of the Council of 27 April 2016 (GDPR) as well as the Organic Law on the Protection of Data and Guarantee of Digital Rights 3/2018 of 5 December 2018, on the protection of the data of individuals, the processing of such data and their free circulation (known in Spanish as LOPDGDD), as well as any other applicable legislation, of its personal data protection policy for the purposes of allowing them to expressly, freely and on a voluntary basis provide “TRAMO” with the personal data requested from them as a result of asking for information for the purchase of different products and services offered in the area of hotels and food services.
Unless specifically established otherwise, you need to complete all data required in the form or similar document in a true, accurate, complete and updated manner. Otherwise, “TRAMO” may, depending on the case, not register the user or refuse to supply the requested specific service. All data provided by the user/data subject will be processed in accordance with the characteristics detailed below.
INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA
Identification of the data controller: “Owner company: TRAMO, SA, Tax ID No. (NIF/CIF): A08376543, Registered office: Rambla de Catalunya 104, 08808 Barcelona, Email address info@hotelcasasagnier.com
User or data subject: The person who provides us with their data and agrees to our processing of them.
PURPOSE OF THE PROCESSING
All data provided will be processed for the following purposes:
- To respond to the requests made by the data subject.
- To respond to orders related to the products/services.
- To maintain any relationship that may be established.
- To manage, administer, inform, provide and improve the services that are purchased.
- For commercial communications relating to our products, goods and services.
- Bulletins, blogs and newsletters.
- Forums for dialogue and communication.
The personal data provided will be retained for the period specified in the consent, for as long as the commercial relationship is maintained, the data subject does not request their deletion or they are necessary for the purposes of the processing. The data will not be destroyed when there is a legal provision requiring their retention. In this case the data will be blocked, only remaining available to public administrations, judges and courts to address any possible liabilities arising from the processing during the statute of limitations period.
No automated decisions, including the creation of profiles, are currently made based on your personal data. In the event that these types of automated decisions are made in the future, your prior consent will be obtained.
LEGAL BASIS FOR THE DATA PROCESSING
Any processing carried out with your personal data will have had your prior and express consent. You will be informed of any issues required by law in advance so that you can provide your informed consent.
You may withdraw this consent at any time, as detailed below in this document.
RECIPIENTS, ASSIGNMENTS AND TRANSFERS OF DATA
Your data will not be transferred to countries outside of the European Union, unless necessary to comply with the purposes and you previously and expressly authorise us to do so.
RIGHTS OF THE DATA SUBJECTS
You may exercise the rights detailed below at any time by writing to “TRAMO”, at the address Rambla de Catalunya 104, 08808 Barcelona, or by sending it an email to info@hotelcasasagnier.com
The request must contain the name, surname(s) and documentation certifying the identity of the data subject or their legal representative, as well as a document certifying the representation, the reason why the request is made, address for notification purposes, date and signature of the applicant and any documents certifying the request made. If the request does not meet the specified requirements, its correction will be requested.
The rights of the data subjects are access, rectification, restriction of the processing, portability, objection and deletion. Their definitions are as follows:
Right to access:
The data subject will have the right to obtain confirmation from the data controller of whether the personal data concerning them are being processed or not and, if they are, the right to access the personal data and the following information:
a) the purposes of the processing
b) the categories of personal data being processed
c) the recipients or categories of recipients to which the personal data have been communicated or will be communicated, particularly recipients in third party countries or international organisations
d) where possible, the expected retention period for the personal data or, where this is not possible, the criteria used to determine this period
e) the existence of the right to request, from the data controller, the rectification or deletion of personal data or the restriction of the processing of the data subject’s personal data, or to object to this processing
f) the right to file a claim before a supervisory authority
g) when the personal data have not been obtained from the data subject, any information available regarding their source
h) the existence of automated decisions, including the creation of profiles, referred to in article 22, sections 1 and 4 of the GDPR and at least, in these cases, significant information on the logic applied, as well as the importance and expected consequences of this processing for the data subject.
When personal data are transferred to a third-party country or international organisation, the data subject will have the right to be informed of the appropriate guarantees under article 46 of the GDPR regarding the transfer of data. The data controller will provide a copy of the personal data subject to processing free of charge.
The data controller may charge a reasonable fee, based on administrative costs, for any other copy requested by the data subject. When the data subject submits the request electronically, and unless they request for it to be provided otherwise, the information will be provided in an electronic format of common use.
Right to rectification:
The data subject will have the right to obtain from the data controller, without undue delay, the rectification of any inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject will have the right to complete any personal data that are incomplete, including through an additional declaration.
Right to be forgotten:
The data subject will have the right to obtain from the data controller, without undue delay, the deletion of any personal data concerning them, the data controller being obliged to remove the personal data without undue delay when any of the following circumstances occur:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed
b) the data subject withdraws their consent forming the basis for the processing in accordance with article 6 of the GDPR section 1, sub-section a), or article 9, section 2, sub-section a), and this processing is not based on any other legal basis
c) the data subject objects to the processing in accordance with article 21 of the GDPR, section 1, and no other legitimate grounds for the processing prevail, or the data subject objects to the processing in accordance with article 21, section 2
d) the personal data have been processed illegally
e) the personal data must be deleted to comply with a legal obligation established in the Law of the Union or the Member States, which applies to the data controller
f) the personal data have been obtained in regard to the offer of information society services listed in article 8 of the GDPR, section 1
When the data controller has made public the personal data over which the data subject has exercised their right to be forgotten, the data controller must adopt, taking into account the technology available and the cost of its application, the reasonable measures to communicate the request to delete the data, as well as any link to those data or any copy or replica of them, to the third parties processing that information.
This right will be limited by other rights such as the right to the freedom of expression and information, due to compliance with any legal obligation, or when there are reasons of public interest.
The right to restriction of processing:
The data subject will have the right to obtain, from the data controller, a restriction of the processing of the data when any of the following conditions are met:
- a) the data subject challenges the accuracy of the personal data, for a period that allows the data controller to verify their accuracy
- b) the processing is illegal and the data subject opposes the deletion of the personal data and instead requests a restriction over their use
- c) the data controller no longer needs the personal data for the purposes of the processing, but the data subject needs them to make, exercise or defend claims
- d) the data subject has objected to the processing by virtue of article 21 of the GDPR, section 1, while it is verified whether the legitimate grounds of the data controller prevail over those of the data subject
When the processing of personal data has been restricted by virtue of section 1, these data may only be subject to processing, except for their retention, with the data subject’s consent or to make, exercise or defend claims, or with a view to protecting the rights of another natural or legal person, or for reasons of important public interest to the Union or a certain Member State.
Any data subject who has obtained the restriction of processing in accordance with section 1 will be informed by the data controller before this restriction is lifted.
Right to object:
The data subject will have a right to object, at any time and for reasons related to its particular situation, to the personal data concerning them being subject to processing based on the provisions of article 6 of the GDPR, section 1, sub-sections i) or f), including the creation of profiles based on these provisions.
The data controller will cease processing the personal data, unless it demonstrates compelling legitimate reasons for the processing that prevail over the interests, rights and freedoms of the data subject, or to make, exercise or defend claims.
When the processing of personal data is for the purpose of direct marketing, the data subject will have the right to object to the processing of the personal data concerning them at all times, including the creation of profiles, to the extent that this is related to the aforementioned marketing.
When the data subject objects to processing for direct marketing purposes, the personal data will cease to be processed for these purposes.
When the personal data are processed for purposes of scientific or historic research or for statistical purposes in accordance with article 89, section 1, the data subject will have the right, for reasons related to their particular situation, to object to the processing of the personal data concerning them, unless this is necessary to fulfil a mission carried out for reasons of public interest.
Right to data portability:
The data subject will have the right to receive the personal data relating to them which have been provided to a data controller, in a structured format of common use and machine-readable, and to transfer them to another data controller without this being prevented by the controller to whom they had been provided, when:
a) the processing is based on consent in accordance with article 6 of the GDPR, section 1, sub-section a), or article 9 of the GDPR, section 2, sub-section a), or in a contract in accordance with article 6, section 1, sub-section b), and
b) the processing is carried out automatically.
When exercising their right to data portability in accordance with section 1, the data subject will have the right for their personal data to be transferred directly from controller to controller when technically possible.
The exercising of the aforementioned right in section 1 of this article will be without prejudice to article 17. This right will not apply to the processing necessary in order to comply with a mission carried out, or when exercising public powers conferred on the data controller.
The data controller will communicate any rectification or deletion of personal data or restriction of processing made in accordance with article 16, article 17 section 1, and article 18, to each of the recipients to whom the personal data were communicated, unless this is impossible or requires a disproportionate effort. The data controller will inform the data subject of these recipients if so requested.
WITHDRAWAL OF CONSENT
The data subject, who at the time granted their consent to the processing of their personal data, may also withdraw it with equal ease. The withdrawal of consent will not lead to the illegality of the processing carried out previously.
The data subject will have the right to make a complaint to the competent supervisory body. In Spain, this is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
If the personal data may be subsequently processed for different purposes, the data controller will inform the data subject of this fact.
SECURITY MEASURES
“TRAMO” states that it has adapted the company to the GDPR and the LOPDGDD, adopting all technical, organisational and legal measures necessary to guarantee the security of the data and prevent their alteration, loss, processing or access by unauthorised individuals, taking into consideration the state of the technology, the nature of the data stored and the risks to which they are exposed, from human actions or from the physical/natural environment.
“TRAMO”, as data controller, is only liable for those data obtained directly from its website.
The website may contain links to other websites that may be of interest to users. “TRAMO” does not accept any liability for these links and the data that may be collected, since it cannot either control what they will do with them or provide any guarantee about the fulfilment of appropriate privacy policies. Any users accessing the content of these websites must read the conditions of use and privacy policies established on those websites and always do so at their sole responsibility.
If you have any queries, questions or recommendations regarding our Privacy Policy, you can send them to us by email at the following address: dpd@hotelcasasagnier.com
“TRAMO, SA” © All rights reserved
