Who is responsible for processing your data?

The entity responsible for processing your personal data is the company that owns the Hotel, identified as such in the document signed by the guest at check-in. You can contact this company by addressing Paseo del Club Deportivo, 1, 28223 Pozuelo de Alarcón (Madrid) or via email at juridico@grupobelagua.com.

For what purpose do we process your personal data?

We process the personal data you provide us with the following purposes:

• Managing the relationship with the customer and providing, billing, and collecting services, as well as managing reservations. Providing data for this purpose by our customers is mandatory; otherwise, the contract cannot be fulfilled. When you stay at any of the Hotels of the AC Hotels by Marriott or Autograph Collection brands, Grupo Marriott records your preferences or requests made during your stay (e.g., preferred rooms, items, food and drink, services you enjoy, or dietary restrictions), as explained at www.espanol.marriott.com/about/privacy.mi. When you subsequently stay again at any of the Hotels of the AC Hotels by Marriott or Autograph Collection brands, the establishment can access this information to personalize and improve your stay and experience with us.
• Channeling requests for information, suggestions, and complaints that you may send us, contacting the sender of the information, responding to your request or query, and following up afterward. Providing data for this purpose is voluntary, although, if not provided, the request, query, or complaint cannot be responded to. Therefore, the communication of your personal data for these purposes is a necessary requirement for us to address those requests.
• Complying with legal duties of registration and communication to the competent authorities of the data of travelers staying at our establishment or making a reservation to stay in it.
• If you become our friend or follower on social networks, we will process your data to keep you informed of our activities through these channels. Providing data for this purpose is voluntary, although, if not provided, you cannot be our friend or follower on the corresponding social network. The categories of data processed for this purpose are identification data.

How long will we process your data?

We only retain your data for the period necessary to fulfill the purpose for which they were collected, comply with legal obligations imposed on us, and address any responsibilities that may arise from fulfilling the purpose for which the data were collected.Data for managing the relationship with customers and suppliers and billing and collecting services will be retained for as long as the contract is in force. Once this relationship ends, if applicable, the data may be retained for the time required by applicable legislation and until any potential liabilities arising from the contract expire. Preferences and requests made during your previous stays at Hotels of the AC Hotels by Marriott or Autograph Collection brands will be processed by the Hotel of the brand where you book a subsequent stay and only during that stay.

Data processed to address requests, queries, or complaints will be retained for the time necessary to respond to them and consider them definitively closed. Subsequently, they will be retained as a communication history for one year unless you request their deletion earlier.
Data necessary to comply with legal duties of registration and communication to the competent authorities of traveler data will be retained for a period of three years.

Data provided through social networks will be retained as long as you remain our friend or follower on the corresponding platform.

What is the legal basis for processing your data?

The legal basis for processing your data is the execution of the accommodation contract and ancillary services requested by you. The Hotel’s access to the preferences and requests made during your previous stay at other hotels of the AC Hotels by Marriott or Autograph Collection brands is based on this contract and, additionally, on the legitimate interest in offering better customer service. This legitimate interest is prevalent, as its purpose is precisely to improve the guest’s stay and experience, carried out for their benefit and limiting the processing of data to those necessary for that purpose and for the duration of the stay at the Hotel. However, you can object at any time to your data being processed for this purpose.

The processing of personal data to respond to your requests for information, inquiries, and complaints is based on the consent of the interested party. This consent can be withdrawn at any time, although this will not affect the lawfulness of the processing carried out previously.

Data for the registration and communication to authorities of traveler data is processed by legal imperative. Data provided through social networks will be processed based on your consent, which can be revoked at any time, although this will not affect the lawfulness of the processing carried out previously.

The categories of data processed in each case are those requested in each form or contract through which you provide your data and, in the case of preferences or requests, the data indicated above.

To whom will your data be communicated?

Data will be communicated to the following entities:

Financial entities through which the management of collections and payments is articulated.

Competent Public Administrations, including judges and courts, in the cases provided by law and for the purposes defined therein.

Additionally, as indicated above, the preferences and requests data collected by Grupo Marriott during your stay will be processed by other hotels of the AC Hotels by Marriott or Autograph Collection brands for better service provision.

What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation about whether we are processing personal data concerning them or not. Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Under the conditions provided in the General Data Protection Regulation, interested parties may request the limitation of the processing of their data or its portability, in which case we will only retain them for the exercise or defense of claims.In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. If you have given consent for a specific purpose, you have the right to withdraw it at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. In such cases, we will stop processing the data or, if applicable, stop doing so for that specific purpose, unless there are compelling legitimate reasons, or for the exercise or defense of possible claims.

Additionally, data protection regulations allow you to object to being subject to decisions based solely on automated processing of your data, where appropriate.

The aforementioned rights are characterized as follows:

• Their exercise is free of charge, unless the requests are manifestly unfounded or excessive (e.g., repetitive), in which case a fee proportional to the administrative costs incurred may be charged or the request may be refused.
• You can exercise the rights directly or through your legal or voluntary representative, proving the representation.
• Your request must be responded to within one month, although, considering the complexity and number of requests, the period may be extended by another two months.
• We are obliged to inform you about the means to exercise these rights, which must be accessible and cannot deny you the exercise of the right for the sole reason of choosing another means. If the request is submitted electronically, the information will be provided by these means when possible, unless you request otherwise.
• If, for any reason, the request is not processed, we will inform you, no later than one month, of the reasons for this and the possibility of claiming before a Supervisory Authority.

To facilitate the exercise of these rights, we provide the following links to the request forms for each of them:

• Access Right Request Form 
• Rectification Right Request Form 
• Opposition Right Request Form 
• Deletion Right Request Form (“Right to be Forgotten”) 
• Processing Limitation Right Request Form
• Portability Right Request Form 
• Right Not to be Subject to Automated Individual Decisions Request Form 

All the mentioned rights can be exercised through the contact means with the entity listed at the beginning of this clause.

In the event of any violation of your rights, especially when you have not obtained satisfaction in exercising them, you can file a complaint with the Spanish Data Protection Agency (contact details accessible at www.aepd.es), or another competent supervisory authority. You can also obtain more information about your rights by contacting these organizations.

How do we protect your personal data?

We are firmly committed to protecting the personal data we process. We use reasonably reliable and effective physical, organizational, and technological measures, controls, and procedures aimed at preserving the integrity and security of your data and ensuring your privacy.

Additionally, all personnel with access to personal data have been trained and are aware of their obligations regarding the processing of your personal data.

In the contracts we sign with our suppliers, we include clauses requiring them to maintain the duty of confidentiality regarding the personal data they have accessed by virtue of the assignment, as well as to implement the necessary technical and organizational security measures to ensure the confidentiality, integrity, availability, and permanent resilience of the personal data processing systems and services. All these security measures are periodically reviewed to ensure their adequacy and effectiveness.

However, absolute security cannot be guaranteed, and no security system is impenetrable, so if any information under our control is compromised as a result of a security breach, we will take appropriate measures to investigate the incident, notify the Supervisory Authority, and, if applicable, those users who may have been affected so that they can take appropriate measures.

What is your responsibility as the data subject?

By providing us with your personal data, the person doing so guarantees that they are over 14 years old and that the data provided is true, accurate, complete, and up-to-date.

To this end, the data subject is responsible for the truthfulness of the data and must keep it properly updated to reflect their real situation, being responsible for any false or inaccurate data they may provide, as well as for any direct or indirect damages that may arise.

If you provide data of third parties, you assume the responsibility of informing them in advance of all the provisions of Article 14 of the General Data Protection Regulation under the conditions established in that provision.