PRIVACY POLICY

The Privacy Policy is part of the General Conditions that govern this Website.

Who is responsible for processing your data?

HIBISCUS LANZAROTE S.L. Address: Calle Suecia 22, Puerto del Carmen. Lanzarote, Canary Islands (Spain). Phone: 928 514 359 Email: rgpd@hibiscus-hotels.com You can contact us in any way to communicate with us. We reserve the right to modify or adapt this Privacy Policy at any time. We recommend reviewing it, and if you have registered and access your account or profile, you will be informed of the modifications. If you are part of the following groups, check the information below:

+ GUESTS

For what purposes will we process your personal data?

We inform you that your personal data will be processed for the purpose of managing your reservation, formalizing and managing your stay at the hotel, attending requests related to the contracted services, and ensuring payment of the expenses derived from said stay. Likewise, certain data may be processed to comply with the legal obligations applicable to lodging establishments, in particular those relating to documentary registration and communication of information about the people staying in the establishment. Your data may be communicated, where appropriate, to the Security Forces and Bodies in compliance with current regulations, as well as to travel agencies, tour operators, booking platforms, or other intermediaries who have been involved in the booking or management of your reservation. The data will be kept for the time necessary to fulfill the indicated purposes and, in any case, for the periods required by tax, commercial, consumer, and travel document registration regulations. In general, certain data may be kept for a minimum period of 6 years when necessary to comply with these legal obligations.

What is the legal basis for processing your data?

The legal basis for the processing of your personal data is the execution of the contractual or pre-contractual relationship derived from the reservation and stay at the hotel, as well as compliance with the legal obligations applicable to the establishment. In particular, the processing may be carried out in compliance with the regulations on the documentary registration and information of people staying in accommodation establishments, including Royal Decree 933/2021, of October 26, as well as the applicable regulations on guest register books and entry records. When the processing is based on your consent, this can be withdrawn at any time, without affecting the lawfulness of the processing carried out before its withdrawal. ⚠️ IMPORTANT NOTICE ABOUT POSSIBLE FRAUDS AND UNOFFICIAL COMMUNICATIONS HIBISCUS LANZAROTE S.L. will not request additional payments, bank details, passwords, verification codes, or sensitive information through links received via WhatsApp, SMS, social networks, or other unofficial channels on the occasion of a supposed modification, incident, cancellation, or confirmation of your reservation. If you receive a communication requesting payment, providing bank details, or accessing an unverified link, do not take any action without first checking the authenticity of said communication. For your security:

• Do not provide personal or banking data through unofficial channels.
• Do not share passwords, verification codes, or passwords.
• Do not access payment links received via WhatsApp, SMS, social networks, or suspicious messages.
• Do not download attachments from unverified communications.

If in doubt, contact the hotel directly through the official channels published on our website before making any payment or providing information.

+ WEBSITE OR EMAIL CONTACTS

What data do we collect through the Website?

We may process your IP, the operating system or browser you use, and even the duration of your visit, anonymously. If you provide us with data in the contact form, you will identify yourself to be able to contact you if necessary.

For what purposes will we process your personal data?

• Answer your queries, requests, or petitions.
• Manage the requested service, answer your request, or process your petition.
• Provide information electronically related to your request.
• Provide commercial information or events electronically, provided there is express authorization.
• Carry out analysis and improvements on the Website, on our products and services. Improve our commercial strategy.

What is the legal basis for processing your data?

The acceptance and consent of the interested party, granted through a voluntary action, such as in cases where it is necessary to complete a form and click on the “send” button, performing it will necessarily imply that you have been informed and have expressly consented to the content of the clause attached to that form or acceptance of the privacy policy. All our forms have an * symbol on the mandatory data. If you do not provide those fields, or do not check the privacy policy acceptance checkbox, the information will not be sent.

How long will we keep the personal data?

Until the consent granted is revoked.

+ NEWSLETTER CONTACTS

What data do we collect through the newsletter?

On the Website, you can subscribe to the Newsletter, if you provide us with an email address, to which the Newsletter will be sent. We will only store your email in our database, and we will proceed to send you emails periodically until you request to unsubscribe or we stop sending emails. You will always have the option to unsubscribe in any communication.

For what purposes will we process your personal data?

• Manage the requested service.
• Provide information electronically related to your request.
• Provide commercial information or events electronically, provided there is express authorization.
• Carry out analysis and improvements in sending mailing, to improve our commercial strategy.

What is the legal basis for processing your data?

The acceptance and consent of the interested party. In cases where you subscribe, it will be necessary to accept a checkbox and click on the send button. This will necessarily imply that you have been informed and have expressly consented to receiving the newsletter.

How long will we keep the personal data?

Until the consent granted is revoked.

+ CUSTOMERS

For what purposes will we process your personal data?

• Preparation of the budget and monitoring of it through communications between both parties.
• Provide information electronically related to your request.
• Provide commercial information or events electronically, provided there is express authorization.
• Manage administrative, communication, and logistics services carried out by the Data Controller.
• Invoicing and declaration of the corresponding taxes.
• Carry out the corresponding transactions.
• Control and collection management.
• During the payment process through a card, data will be collected by the Banking Entity that owns the Virtual POS: connection type, date and time, IP address, device information, email address, mobile phone, navigation data, transaction data, and data required by 3D Secure security protocols, for the sole purpose of detecting and preventing unauthorized payment operations.

What is the legal basis for processing your data?

The existence of a contractual relationship between the parties. The processing is necessary for the execution of a contract in which the data subject is a party or at the request of the data subject.

How long will we keep the personal data?

During the validity of the relationships between the parties and for the periods of prescription derived from them.

+ QUALITY SURVEYS

For what purposes will we process your personal data?

• Assess the quality level of the provided service.
• Improve the services offered, in accordance with ISO compliance.

What is the legal basis for processing your data?

The legal basis is the express consent of the survey respondent.

How long will we keep the personal data?

Until the consent granted is revoked.

+ SUPPLIERS

For what purposes will we process your personal data?

• Provide information electronically related to your request.
• Provide commercial information or events electronically, provided there is express authorization.
• Manage administrative, communication, and logistics services carried out by the Data Controller.
• Invoicing.
• Carry out the corresponding transactions.
• Invoicing and declaration of the corresponding taxes.
• Control and collection management.

What is the legal basis for processing your data?

The legal basis is the acceptance of a contractual relationship, or failing that, your consent when contacting us or offering your products via a channel.

How long will we keep the personal data?

During the validity of the relationships between the parties and for the periods of prescription derived from them.

+ SOCIAL MEDIA CONTACTS

For what purposes will we process your personal data?

• Answer your queries, requests, or petitions.
• Manage the requested service, answer your request, or process your petition.
• Interact with you and create a community of followers.

What is the legal basis for processing your data?

The bases that legitimize the processing are the voluntary consent of the interested party to get in touch and, where appropriate, the acceptance of a contractual relationship in the context of the corresponding social network. The processing of data within the Social Network will be carried out in accordance with their Privacy policies.

How long will we keep the personal data?

We can only consult or unsubscribe your data in a limited way since you have a specific profile. We will process them as long as you allow us to follow you, be friends, or give us a “like,” “follow,” or similar buttons. Any modification of your data or restriction of information or publications should be done through the settings of your profile or user in the social network itself.

+ JOB APPLICANTS

For what purposes will we process your personal data?

• Organization of selection processes for the hiring of employees.
• Invite you to job interviews and evaluate your candidacy.
• If you have given us your consent, we may share it with collaborating or related companies, solely to help you find employment.
• If you check the privacy policy acceptance checkbox, you give us your consent to share your job application with the entities that make up the group of companies in order to include you in their personnel selection processes.

Additionally, we inform you that after one year from the receipt of your CV, we will proceed to its secure destruction.

What is the legal basis for processing your data?

The legal basis is your unequivocal consent, by sending us your CV.

How long will we keep the personal data?

For a period of 1 year or until the consent granted is revoked.

Do we include personal data of third parties?

As a general rule, we only process the data provided by the owners. If you provide us with data of third parties, you must, beforehand, inform and request the consent of those individuals, or otherwise exempt us from any responsibility for non-compliance with this requirement.

And data of minors?

We do not process data of minors under 14 years old. Therefore, refrain from providing them if you are not of that age or, if applicable, from providing data of third parties who are not of that age. HIBISCUS LANZAROTE S.L. exempts itself from any responsibility for non-compliance with this provision.

Will we send communications electronically?

• They will only be made to manage your request if it is one of the contact channels you have provided.
• If we send commercial communications, they will have been previously and expressly authorized by you.

What security measures do we apply?

You can rest assured: We have adopted an optimal level of protection of the Personal Data we handle, and we have implemented all the technical means and measures at our disposal according to the state of technology to avoid loss, misuse, alteration, unauthorized access, and theft of Personal Data.

To which recipients will your data be communicated?

Your data will not be transferred to third parties, except for legal obligation. Specifically, they will be communicated to the State Tax Administration Agency and to banks and financial entities for the collection of the service provided or product purchased, as well as to the data processor entities necessary for the execution of the agreement. In the case of a purchase or payment, if you choose an application, website, platform, bank card, or any other online service, your data will be transferred to that platform or treated in its environment, always with the utmost security. During the payment process via card, data will be collected by the Banking Entity that owns the Virtual POS. When ordered, the web development and maintenance company, or the hosting company, will have access to our website. They will have signed a service provision contract that commits them to maintain the same level of privacy as us. International data transfers may be carried out when using American applications; however, these transfers will be made to entities that have demonstrated compliance with the level of protection and guarantees according to the parameters and requirements provided for in the current data protection regulations, such as the European Regulation, or when there is a legal authorization for the international transfer.

What rights do you have?

• To know if we are processing your data or not.
• To access your personal data.
• To request the rectification of your data if they are inaccurate.
• To request the deletion of your data if they are no longer necessary for the purposes for which they were collected or if you withdraw the consent granted.
• To request the limitation of the processing of your data, in certain cases, in which case we will only keep them in accordance with current regulations.
• To port your data, which will be provided to you in a structured, common use, or machine-readable format. If you prefer, we can send them to the new controller you designate. This is only valid in certain cases.
• To make a complaint to the Spanish Data Protection Agency or competent control authority if you believe we have not served you correctly.
• To revoke the consent for any treatment for which you have consented, at any time.

If you modify any data, we appreciate that you let us know to keep them updated.

Do you want a form to exercise your Rights?

• We have forms to exercise your rights, ask us for them by email or if you prefer, you can use those prepared by the Spanish Data Protection Agency or third parties.
• These forms must be signed electronically or accompanied by a photocopy of your ID.
• If you are represented by someone, you must attach a copy of their ID, or they must sign it with their electronic signature.
• The forms can be submitted in person, sent by mail, or by email to the Data Controller’s address at the beginning of this text.

How long will it take for us to respond to your Rights Exercise?

It depends on the right, but at most within one month from your request, and two months if the matter is very complex and we notify you that we need more time.

Do we use cookies?

If we use types of cookies other than necessary ones, you can check the cookie policy at the corresponding link from the beginning of our website.

How long will we keep your personal data?

• Personal data will be kept for as long as you are linked with us.
• Once you unlink, the personal data processed for each purpose will be kept for the legally prescribed periods, including the period in which a judge or court may require them considering the statute of limitations for legal actions.
• The processed data will be kept as long as the aforementioned legal deadlines exist, if there is a legal obligation to keep them, or if there is no legal deadline, until the data subject requests their deletion or revokes the consent granted.
• We will keep all information and communications related to your purchase or the provision of our service, as long as the guarantees of the products or services last, to address possible claims.