PRIVACY POLICY

The Privacy Policy forms part of the General Conditions governing this website.

Who is responsible for the processing of your data?

HIBISCUS LANZAROTE S.L. Domicilio: Calle Suecia 22, 35510 Puerto del Carmen, LANZAROTE. Tfno: 928 514 359 Mail: rgpd@hibiscus-hotels.com You can contact us in any way you wish to communicate with us. We reserve the right to modify or adapt this Privacy Policy at any time. We encourage you to review it, and if you have registered and log in to your account or profile, you will be informed of any changes. If you are one of the following groups, please consult the drop-down information:

+ GUESTS

For what purposes will we process your personal data?

We inform you that your data will be processed for the purpose of managing your booking, your stay at the hotel and guaranteeing the payment of the expenses derived from said stay. Your data will be communicated to the Security Forces and Bodies in compliance with the provisions of current legislation, as well as to the travel agencies or operators involved. The data will be kept for at least 6 years in compliance with tax, commercial, consumer and travellers’ book-register regulations.

What is the legal basis for processing your data?

The legal basis is your consent and compliance with the legal obligations established by Order INT/321/2021, of 31 March, which amends Order INT/1922/2003, of 3 July, on register-books and entry forms for travellers in hotel and catering establishments and other similar establishments, with regard to documentary registration obligations, Royal Decree 393/1974, of 18 August and by Order INT/1922/2003 of 3 July.

+ WEB OR EMAIL CONTACTS

What data do we collect through the website?

We may treat your IP address, what operating system or browser you use, and even the duration of your visit, anonymously. If you provide us with data in the contact form, you will be identified so that we can contact you, if necessary.

For what purposes will we process your personal data?

• To answer your queries, requests or petitions.
• To manage the requested service, answer your request, or process your request.
• Information by electronic means, related to your request.
• Commercial or event information by electronic means, provided that express authorisation has been given.
• To carry out analysis and improvements on the Web, about our products and services. To improve our commercial strategy.

What is the legitimacy for the processing of your data?

The acceptance and consent of the interested party, granted through a voluntary action, as in cases where to make a request it is necessary to fill in a form and click on the send button, the completion of the same necessarily implies that it has been informed and has expressly given its consent to the content of the clause attached to the form or acceptance of the privacy policy. All our forms have the symbol * in the obligatory data. If you do not provide these fields, or do not tick the checkbox for acceptance of the privacy policy, we will not allow the information to be sent.

How long will we keep personal data?

Until the revocation of the consent given.

+ NEWSLETTER CONTACTS

What data do we collect through the newsletter?

On the website, you can subscribe to the newsletter if you provide us with an email address, to which the newsletter will be sent. We will only store your email address in our database and will send you periodic emails until you unsubscribe or we stop sending emails. You will always have the option to unsubscribe, in any communication.

For what purposes will we process your personal data?

To manage the requested service. Information by electronic means, related to your request. Commercial or event information by electronic means, as long as there is express authorisation. To carry out analyses and improvements in the sending of mailings, in order to improve our commercial strategy.

What is the legitimacy for the processing of your data?

The acceptance and consent of the data subject. In those cases where you subscribe, it will be necessary to accept a checkbox and click on the send button. This necessarily implies that you have been informed and have expressly given your consent to receive the newsletter.

How long will we keep personal data?

Until the revocation of the consent given.

+ CLIENTS

For what purposes will we process your personal data?

• Drawing up the budget and monitoring it by means of communications between both parties.
• Information by electronic means, related to your request.
• Commercial or event information by electronic means, as long as there is express authorisation.
• To manage the administrative, communications and logistics services carried out by the Responsible Party.
• Invoicing and declaration of the appropriate taxes.
• Carrying out the corresponding transactions.
• Control and collection management.
• During the card payment process, the following personal data will be collected by the Bank that owns the Virtual POS: type of connection, date and time, IP address, device information, email address, mobile phone, browsing data, transaction data and data required by 3D Secure security protocols, for the sole purpose of detecting and preventing unauthorised payment transactions.

What is the legitimacy for the processing of your data?

The existence of a contractual relationship between the parties. The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures at the request of the data subject.

For how long will we keep personal data?

For the duration of the relationship between the parties and for the statute of limitations arising therefrom.

+QUALITY SURVEYS

For what purposes will we process your personal data?

• To assess the degree of quality in the service provided.
• To improve the services offered, in accordance with ISO standards.

What is the legal basis for processing your data?

The legal basis is the express consent of the respondent. For how long will we keep personal data? Until the revocation of the consent given.

+PROVIDERS

For what purposes will we process your personal data?

• Information by electronic means, concerning your request.
• Commercial or event information by electronic means, provided there is express authorisation.
• To manage the administrative, communications and logistics services provided by the Controller.
• Invoicing.
• To carry out the corresponding transactions.
• Invoicing and declaration of the appropriate taxes.
• Control and collection procedures.

What is the legal basis for the processing of your data?

The legal basis is the acceptance of a contractual relationship, or otherwise your consent to contact us or offer us your products by any means.

How long will we keep personal data?

For the duration of the relationship between the parties and for the limitation periods arising therefrom.

+CONTACTS SOCIAL NETWORKS

For what purposes will we process your personal data?

• To answer your queries, requests or petitions.
• To manage the requested service, answer your request, or process your request.
• To get in touch with you and create a community of followers..

What is the legal basis for the processing of your data?

The bases that legitimise the processing is the voluntary consent of the interested party to contact and, where appropriate, the acceptance of a contractual relationship in the corresponding social network environment. The processing of data within the Social Network will be carried out in accordance with its privacy policies.

How long will we keep personal data?

We can only consult or unsubscribe your data in a restricted way when you have a specific profile. We will treat them for as long as you let us by following us, being a friend or by clicking “like”, “follow” or similar buttons. Any rectification of your data or restriction of information or publications must be done through the configuration of your profile or user in the social network itself.

+JOB SEEKERS

For what purposes will we process your personal data?

Organisation of selection processes for the recruitment of employees. To summon you for job interviews and evaluate your application. If you have given us your consent, we may pass it on to partner or related companies for the sole purpose of helping you find a job. If you tick the checkbox to accept the privacy policy, you give us your consent to transfer your job application to the entities that make up the group of companies with the aim of including you in their personnel selection processes. We also inform you that one year after receiving your curriculum vitae, we will proceed to its secure destruction.

What is the legal basis for processing your data?

The legal basis is your unequivocal consent by sending us your CV.

How long will we keep personal data?

For a minimum period of 1 year or until the revocation of the consent given.

Do we include personal data of third parties?

No, as a general rule we only process the data provided to us by the owners. If you provide us with data of third parties, you must previously inform and request their consent, or else we will be exempt from any liability for failure to comply with this requirement.

What about data of minors?

We do not process data of children under 14 years of age. Therefore, please refrain from providing them if you are not of that age or, if applicable, from providing data of third parties who are not of the aforementioned age. HIBISCUS LANZAROTE S.L. disclaims any liability for failure to comply with this provision.

Will we communicate with you by electronic means?

• We will only do so in order to process your request, if it is one of the means of contact that you have provided us with.
• If we send commercial communications, they will have been previously and expressly authorised by you.

What security measures do we apply?

You can rest assured: We have adopted an optimal level of protection for the Personal Data we handle, and we have installed all the technical means and measures at our disposal according to the state of technology to prevent the loss, misuse, alteration, unauthorised access and theft of Personal Data.

To which recipients will your data be communicated?

Your data will not be passed on to third parties, unless legally obliged to do so. Specifically, they will be communicated to the State Tax Administration Agency and to banks and financial institutions for the collection of the service provided or product purchased, as well as to the persons or entities in charge of the processing necessary for the execution of the agreement. In case of purchase or payment, if you choose any application, website, platform, bank card, or any other online service, your data will be transferred to that platform or will be processed in its environment, always with maximum security. During the card payment process, data will be collected by the bank that owns the Virtual POS. When we order it, the web development and maintenance company or the hosting company will have access to our website. They will have signed a service contract that obliges them to maintain the same level of privacy as we do. International data transfers may be made when using American applications, however, such transfers will be made to entities that have demonstrated that they comply with the level of protection and guarantees in accordance with the parameters and requirements set out in the current legislation on data protection, such as the European Regulation, or when there is a legal authorisation to make the international transfer.

What rights do you have?

• To know whether or not we are processing your data.
• To access your personal data.
• To request rectification of your data if it is inaccurate.
• To request the deletion of your data if they are no longer necessary for the purposes for which they were collected or if you withdraw your consent.
• To request the limitation of the processing of your data, in certain cases, in which case we will only keep them in accordance with the regulations in force.
• To submit your data, which will be provided to you in a structured, commonly used or machine-readable format. If you prefer, we can send it to the new data controller you designate. This is only valid in certain cases.
• To file a complaint with the Spanish Data Protection Agency or competent supervisory authority if you believe that we have not dealt with you correctly.
• To revoke your consent for any processing for which you have consented, at any time.

If you modify any data, please let us know so that we can keep them up to date.

Would you like a form for exercising your rights?

• We have forms for exercising your rights, ask us for them by email or, if you prefer, you can use the forms prepared by the Spanish Data Protection Agency or third parties.
• These forms must be signed electronically or be accompanied by a photocopy of your ID card.
• If someone is representing you, you must attach a copy of their DNI, or have them sign it electronically.
• The forms can be submitted in person, sent by letter or by mail to the address of the person responsible at the beginning of this text.

How long does it take us to reply to the Exercise of Rights?

It depends on the right, but a maximum of one month from your request, and two months if the issue is very complex and we notify you that we need more time.

Do we use cookies?

If we use other types of cookies that are not necessary, you can consult the cookie policy in the corresponding link at the top of our website.

How long will we keep your personal data?

• Personal data will be kept for as long as you remain linked to us.
• Once you disengage, the personal data processed for each purpose will be retained for the period of time that you have been linked to us legally stipulated periods, including the period in which a judge or court may require them in accordance with the statute of limitations for legal actions.
• The data processed will be kept until the aforementioned legal periods expire, if there is a legal obligation to keep them, or, if there is no such legal period, until the interested party requests their deletion or revokes the consent granted.
• We will keep all information and communications relating to your purchase or the provision of our service, for the duration of the guarantees of the products or services, in order to attend to possible claims.