Privacy Policy

1. Data controller

2. Data we may process

Depending on the relationship with Hamsa House, we may process:

• first name and surname;
• identity document or passport;
• contact details;
• arrival and departure dates;
• data relating to hotel bookings;
• data relating to temporary stay enquiries and agreements;
• information necessary to substantiate the temporary reason for the rental;
• billing and payment data;
• communications with Hamsa House;
• any other data voluntarily provided by the data subject.

Where it is necessary to substantiate a temporary reason linked to circumstances that may reveal specially protected information, only the information strictly necessary to manage the relationship and comply with the corresponding legal obligations will be requested.

3. Purposes and legal bases

Enquiries and contact forms

The data will be used to handle and respond to the enquiry made. Legal basis: pre-contractual measures requested by the data subject and, depending on the case, a legitimate interest in handling communications relating to our activity.

Hotel bookings

The data will be processed to manage the booking, accommodation, billing, payments, guest service and compliance with the corresponding administrative obligations. Legal basis: performance of the contract and compliance with legal obligations.

Temporary Stay enquiries

The data will be used to assess the enquiry, check availability, verify compliance with the requirements for temporary contracting, prepare a proposal, formalise and perform the rental agreement where appropriate, manage payments, the deposit, incidents and contractual termination, and comply with legal obligations linked to the rental. Legal basis: implementation of pre-contractual measures, performance of the contract and compliance with legal obligations.

Guest registration and reporting

Identification data and other legally required information about guests may be collected, registered, retained and reported to law enforcement bodies and other competent authorities to comply with the obligations established by public security and guest registration regulations. Legal basis: compliance with a legal obligation.

Legal obligations

Data may be processed where necessary to comply with tax, accounting, administrative, security, accommodation, housing or other legally applicable obligations. Legal basis: compliance with a legal obligation.

Marketing communications

Hamsa House will only send promotional communications where there is a valid legal basis for doing so. Where processing depends on consent, it may be withdrawn at any time.

4. Recipients

Data may be disclosed or made available to:

• public administrations and competent authorities where there is a legal obligation;
• law enforcement bodies, where appropriate under guest registration and public security regulations;
• banks and payment service providers;
• booking engine providers;
• technology, hosting, website maintenance and email providers;
• professional advisers;
• providers necessary for hotel or contractual management;
• other data processors providing services to ROYAL PLAZA BARCELONA, S.L.

Data will not be disclosed to third parties for their own marketing purposes without a legal basis permitting it.

5. International transfers

Some technology providers may involve international transfers of data. Where these occur, the safeguards required by the GDPR will be adopted, such as adequacy decisions, standard contractual clauses or other legally provided mechanisms.

6. Retention

Data will be retained for as long as necessary to fulfil the purpose for which it was obtained and, subsequently, duly blocked during the limitation periods for the corresponding legal liabilities. Contractual, tax and accounting documents will be retained for the legally required periods. Data subject to specific guest registration obligations will be retained for the legally established period.

7. Rights

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent where processing is based on it. Requests may be sent to recepcion@hamsahouse.es, stating “Protección de Datos” (Data Protection) in the subject line and sufficiently identifying the applicant. Additional documentation may only be requested where there are reasonable doubts about their identity.

Data subjects may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Security

ROYAL PLAZA BARCELONA, S.L. will adopt appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, disclosure or unauthorised access.

9. Updates

This policy may be updated to adapt it to changes in legislation, changes in processing or new services.