Official Website

AnyósPark Mountain Privacy Policy

Anyospark corporativa (redesign) -  -

Privacy Policy

PRIVACY POLICY

In accordance with the provisions of Law 29/2021 of 28 October on the Protection of Personal Data (LQPD) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), in the processing activities applicable to it, in accordance with article 3.2 of this regulation, all our clients are informed that collected personal data will be included and processed in the files owned by CEDA, S.A. (hereinafter "CEDASA") for the sole purpose of managing and providing accommodation, catering and/or activity services, and sending information about our products and services.

Our clients and their data are very important to us, therefore we undertake to:

• Not collect personal information without your consent.

• Collect your data in accordance with the principle of data minimisation, i.e. only data that are necessary, essential and not excessive for our purposes.

• Collect and process your data only for the purposes described in our policy and inform you about the recipients of your data.

• Only collect and process the data necessary to properly process your request or personalise the services you request from us.

• Commit to taking appropriate measures to ensure the confidentiality of your information and to prevent its disclosure to unauthorised third parties.

• Take all reasonable steps to ensure the security of a transfer in situations where data is transferred to authorised third parties.

• Inform you of your rights of access, rectification and objection in accordance with Law 29/2011 of 28 October.

DATA CONTROLLER

CEDA, S.A. is the data controller of client data.
NRT: A-700305-H

Registered Office: Ctra. d’Anyós, 59 – AD 400 La Massana

Telephone: + 376 73 71 73

Email: info@ anyospark.com

TYPES OF DATA

CEDASA may collect and process personal data provided directly and voluntarily by you, such as your name, address, email address, telephone number, date of birth, identity card number, etc. We do not request or process sensitive data such as race, ethnicity, political leaning, religious or philosophical beliefs, or sexual orientation.


PURPOSE OF PROCESSING AND LEGAL BASIS

Your data is collected when:

• Contacting our reservations department by telephone or email

• Filling in your details at our reception (check in)

• Making a reservation on our website

• Becoming a member of "AnyósPark Selection”

• Sending us an email

• Sharing a page or an offer by email or through social media

• Answering a satisfaction survey

• Managing the services you request from us

• Subscribing to our newsletter

The provision of personal data through the various forms and email addresses on this website implies acceptance of and consent to their processing in the manner indicated in this privacy policy.

In this way, consent or other legitimate bases, such as the execution of the contract, our legitimate interest and the fulfilment of legal obligations, will be used for the following purposes, with their respective legitimate bases, without your data being used or processed for any other purpose than that for which they were collected.

The personal data provided by data subjects will be used exclusively for the following purposes:

• To manage bookings and services, to register you as a member of "AnyósPark Selection” and to appropriately attend to your queries, comments, incidents or suggestions, in accordance with the execution of the contract, pre-contractual operations, your legitimate interest or your own consent.

• To improve and personalise our support and services, based on legitimate interest or your own consent.

• To manage and follow up on the relationship with our client, according to the execution of the contract, pre-contractual operations, your legitimate interest or your own consent.

• To keep you informed, whether by electronic means, mobile devices or via any other means provided for and envisaged, of offers and personalised discounts from CEDASA that may be of interest to you, in accordance with your own consent.

• Statistical analysis of visits to the website for commercial purposes, based on your consent.

• Management of your requests regarding access, rectification, objection, restriction and portability, based on compliance with legal obligations.

• Debt management and litigation, based on compliance with legal obligations and legitimate interest.

CEDASA informs you that it will not process your personal data for purposes other than those indicated in this section, except in the event of a legal obligation or court order.

Your personal data will not be subject to decisions based on automated processing with legal effects for the data subject.

With regard to the processing of your data for promotional or advertising purposes, as the data subject you will be given the opportunity to accept or refuse such processing, together with the relevant data collection form, so that you can voluntarily give your consent for such processing. Consent may be revoked at any time and at no cost to the data subject.


Legal basis for the processing of your data

The legal basis for the processing of your personal data is the free and lawful acceptance of the legal relationship by the user at the time of accepting this Personal Data Protection and Privacy Policy.

Likewise, the lawfulness of the processing of your data for each of the abovementioned personal data processing purposes is explained below:


• Reservation, registration and contracting of products: the legal basis for the processing of your personal data is the contractual and, where applicable, pre-contractual relationship established between the parties for the purpose of carrying out the provision of the services and/or products contracted or requested by the data subject and, in particular, for the purpose of carrying out the reservation of the services and products of our establishment that you have made, in accordance with the conditions set out in the section on contractual terms, as well as compliance with the corresponding commercial, fiscal and accounting obligations. All of this is based on the provisions of article 6.1 sections a) and b) of the LQPD. Refusal to provide the personal data requested for the reservation will therefore make it impossible to execute the contract or the reservation requested. For further information regarding the contracting of our products and services, please refer to the Terms and Conditions section. Once the reservation has been made, the data subject will receive a confirmation email with the details of the reservation.


• Register of traveller check-ins at hotel and catering facilities: the legal basis for the processing of your personal data is the legal obligation to collect, manage and disclose them to the competent law enforcement authorities, as established in the Regulation of the Register of Occupation of Tourist Accommodation (ROAT). This is based on the provisions of article 6.1 section c) of the LQPD. Refusal to provide the personal data requested will therefore make it impossible to stay in the establishment.


• Queries: the legal basis for the processing of your personal data is the ability to respond to enquiries freely made by data subjects. This processing is performed on the basis of the provisions of article 6.1 sections (a) and (b) of the LQPD.


• Access to the private “My booking” area: if the data subject has registered as a user to access, consult, modify or cancel the status of "my bookings" on the Website, the legal basis for the processing of their data is the contractual or pre-contractual relationship between the parties and to allow access to the information on the Website regarding the status of their booking, as well as to modify the details of the booking or cancel it, if they have registered as a user, as well as their acceptance and free and express consent to the processing of their data. This processing is lawful on the basis of the provisions of article 6.1, sections a) and b) of the LQPD. Refusal to provide the personal data requested will prevent access to this information on the website.


• Promotion of our own products and services: if the data subject has ticked the box corresponding to acceptance of receiving commercial communications (newsletters), the legal basis for the sending of advertising relating to products and services is the same voluntary and express consent of the data subject, which may be revoked at any time, without the revocation of consent for this purpose conditioning the execution of the room reservation contract, if applicable. This processing of personal data is based on the provisions of article 6.1 section a) of the LQPD. Refusal to provide the personal data requested will therefore make it impossible to subscribe to the newsletter or receive commercial communications containing information on our products and services. We inform you that you have the right to withdraw your consent to this processing at any time, without this affecting the lawfulness of the processing carried out based on the consent prior to its withdrawal. If you wish to withdraw your consent, please refer to the "Rights of Data Subjects" section.


• Completion of unfinished bookings: the legal basis for the data processing, in this case, is based on the acceptance and express consent of the data subject to such processing to enable the company to contact the data subject in the event of a technical issue that may occur at the time of finalising the booking or contract. This processing of personal data is based on the provisions of article 6.1 section a) of the LQPD. Therefore, refusal to provide the personal data requested for the reservation will make it impossible to carry out and conclude the requested contract or reservation.


• Communication of changes to the Privacy Policy: the legal basis for the processing of personal data in this case is based on the convenience of communicating any changes that may be made to the Company's Privacy Policy to the data subjects, as well as their voluntary acceptance of and consent to this processing, based on that which is established in article 6.1 sections a) and b) of the LQPD.


• Statistics: the legal basis for the processing of data to conduct statistical and market research on our products and services, without under any circumstances including automated decisions with legal effects for the data subject, is based on the voluntary acceptance and consent of the data subject to this processing, based on the provisions of article 6.1 section a) of the LQPD. We inform you that you have the right to withdraw your consent to this processing at any time, without this affecting the lawfulness of the processing performed based on the consent prior to its withdrawal. If you wish to withdraw your consent, please refer to the "Rights of Data Subjects" section.


STORAGE OF DATA

CEDASA will store your personal data for the duration of the contractual or commercial relationship, unless you exercise your right to erase your personal data, or your rights to object to or restrict the processing of such data, or, in our case, for the maximum period of time allowed by data protection legislation, including the limitation period for legal actions for any liability that may arise from the contractual relationship.

In the latter case, CEDASA will store the data in a duly blocked manner without making any use of them for as long as they may be required for the exercise or defence of claims or for as long as any type of judicial, legal or contractual liability may arise from their processing, which must be attended to and for which their retrieval is necessary.


MINORS

The CEDASA website is not intended for minors. In any case, we will not collect any personal data from minors under the age of 16 without the consent of their legal representative. The data of minors under 16 years of age will be collected at the time of registration at our hotels, due to legal obligation, and only the data necessary to fulfil this obligation will be collected.


TRANSFER OF DATA TO THIRD PARTIES

We do not sell, rent or share your personal information with third parties and will only disclose your personal information: (a) if necessary to fulfil a request you have made, such as the sending of newsletters; (b) if required by law or court order; (c) if necessary to protect our rights or property; or (d) if you have expressly consented to the sharing of your information.


EXERCISING RIGHTS RELATED TO DATA PROTECTION

RIGHT CONTENT ASSISTANCE CHANNELS
Access You may access your personal data that are contained in the files of Hotel CEDASA Mountain & Wellness Resort. lqpd@cisagroup.com

Rectification You will be able to modify your personal data if they are inaccurate.
Erasure You may request the deletion of your personal data.
Objection You may request that your personal data not be processed.
Restriction of processing You may request that the processing of your personal data be restricted in the following cases: if the accuracy of your personal data is contested; when Hotel CEDASA Mountain & Wellness Resort does not need to process your data, but you need them for the exercise or defence of claims; if you have objected to the processing of your data for the performance of a task that is in the public interest or for the satisfaction of a legitimate interest, while we verify whether the legitimate grounds for processing outweigh your objection.
Portability You may receive the personal data that you have provided to us in electronic form, as well as transfer them to another entity.
The user must specify the right they wish to exercise and provide a copy of their identification (e.g. identity card/passport). If we need additional information to verify your identity, we will notify you.

If you believe that we have not processed your personal data in accordance with the regulations, you can contact the Data Protection Officer at lqpd@cisagroup.com.

If you have given your consent, you have the right to withdraw it at any time without affecting the lawfulness of the processing carried out based on the consent prior to its withdrawal. Please send your request to lqpd@cisagroup.com or write to our registered office at Ctra. d’Anyós, 59 – AD 400 La Massana, Andorra.


SECURITY MEASURES AND LEVELS

CEDASA has adopted the necessary measures to maintain the required level of security for the nature of the personal data processed and the circumstances of the processing, in order to avoid, as far as possible and always in line with the state of the art, their alteration, loss, processing or unauthorised access.

CEDASA also guarantees that it has put in place mechanisms to:

1. Ensure the ongoing confidentiality, integrity and resilience of the processing systems and services.

2. Quickly restore availability and access to personal data in the event of a physical or technical incident.

3. Regularly review, evaluate and assess the effectiveness of the technical and organisational measures implemented to ensure the security of the processing.

4. Pseudonymise and encrypt personal data where appropriate.


INTERNATIONAL TRANSFERS

CEDASA does not carry out international data transfers for the purpose of providing our services. In any case, if a data processor acting on our behalf processes personal data in a third country, CEDASA will transfer the data on the basis of an adequacy decision or otherwise assess whether the third country ensures an adequate level of data protection, and will implement all measures and controls within its power to protect your personal data, including signing standard contractual clauses approved by the European Commission, adopting binding corporate standards and applying for approved and recognised certifications or codes of conduct.


COOKIES

Accessing our website may involve the use of cookies. Cookies are small pieces of information that are stored on each user's browser to allow the server to remember certain information for later use. This information allows us to identify you as a specific user and to store your personal preferences and technical information such as visits or specific pages you have visited.

Users who do not wish to accept the use of cookies, or who wish to be notified before cookies are stored on their computer, can configure their browser accordingly.

For more information, please see our Cookie Policy.


CLIENT CONSENT

As a user and client, you declare that you have read and expressly accepted this Privacy Policy when registering with CEDASA, granting your explicit and express consent for CEDASA to process your data for the purposes and services described herein.


CONFIDENTIALITY AND PROFESSIONAL SECRECY

The data collected in all private communications between CEDASA and its clients will be treated with the utmost confidentiality, whereby we commit ourselves to the obligation of secrecy of personal data, the duty to store them and to take all the necessary measures to prevent their alteration, loss and unauthorised access or processing, in accordance with the provisions of the data protection regulations in force.

In addition, information of any kind exchanged between the parties, which the parties agree is of a confidential nature, or which merely refers to the content of such information, shall also have the status of confidential information.


AMENDMENTS

CEDASA reserves the right to modify its Security and Data Protection Policy in order to adapt it to new legislative or jurisprudential developments, as well as those that may stem from existing codes of conduct on the subject, or from strategic company decisions, with effect from the date of publication of such a modification on our website.