User registration on the website \/ Submission of forms<\/strong><\/p>\nTo access certain features, such as contacting us, the user must fill out a form. Personal data is requested in the registration form for this purpose. The data requested is necessary and mandatory to carry out such registration. If these fields are not provided, registration will not be completed.<\/p>\n
In this case, browsing data will be associated with the user’s registration data, identifying the specific user browsing the Website. This allows customizing the offer of products and\/or services that best fit the user.<\/p>\n
Each user’s registration data will be incorporated into FIDO HOTELS’ databases, along with the history of transactions made, and will be stored until the registered user account is deleted. Once the account is deleted, said information will be set aside from our databases, keeping transaction-related data set aside for 10 years without being accessed or altered, in order to comply with legally applicable time limits.<\/p>\n
Data not linked to transactions will be kept unless consent is withdrawn, in which case it will be deleted immediately (subject to legal deadlines).<\/p>\n
The legal basis for processing your personal data is the execution of a contract between the parties. Regarding electronic communications and promotions, as well as responding to information requests, the processing is legitimized by user consent.<\/p>\n
The processing purposes will be: a) Managing your access to the Website. b) Keeping you informed of the processing and status of your requests. c) Managing all utilities and\/or services offered by the platform to the user.<\/p>\n
We inform you that you may receive communications via email and\/or phone regarding potential incidents, errors, issues, and\/or status of your requests. Express user consent will be requested at registration for commercial communications. Users may revoke consent by contacting FIDO HOTELS via the means indicated above. In every commercial communication, users will be given the option to unsubscribe via a link or email address.<\/p>\n
Newsletter Mailing<\/strong><\/p>\nIf the Website allows subscribing to a Newsletter, personal data and an email address will be required. Such information will be stored in a database until the data subject unsubscribes or FIDO HOTELS ceases sending it.<\/p>\n
The legal basis is express consent provided by checking the designated box. Email data will be processed solely to manage newsletter delivery. Express consent is requested during registration, which can be revoked at any time. Unsubscribe links or email contacts will be provided in every communication.<\/p>\n
Group-Specific Processing Information<\/p>\n
WEBSITE OR EMAIL CONTACTS<\/strong><\/p>\n\n
\n- Purposes: Responding to inquiries\/requests, managing requested services, sending electronic information regarding requests, and sending commercial information\/events if expressly authorized.<\/li>\n
- Legal Basis: Consent of the data subject (given by submitting forms with the acceptance checkbox marked).<\/li>\n<\/ul>\n
<\/p>\n
CLIENTS<\/strong><\/p>\n\n- Purposes: Preparing\/following up on quotes, electronic communication regarding requests\/promotions, administrative\/logistics management, transactions, billing\/tax filing, and debt control\/recovery.<\/li>\n
- Legal Basis: Consent and execution of a contract.<\/li>\n
- Recipients & Processors: Data will not be transferred to third parties except under legal obligations (Tax Agency, financial entities, Law Enforcement). Processors under Art. 28 GDPR include Google Analytics (web analytics) and WhatsApp Business (Meta Platforms, Inc.), which may involve international transfers to the US under appropriate safeguards.<\/li>\n<\/ul>\n
<\/p>\n
GUESTS<\/strong><\/p>\n\n- Purposes: Reservation management, accommodation\/associated services (check-in, stay), stay-related communications, traveler registration compliance, administrative\/fiscal management, billing\/payments, satisfaction surveys, commercial communications (if authorized), and internal control\/fraud prevention.<\/li>\n
- Legal Basis: Contract execution, legal obligation compliance (traveler registry, tax), and consent for optional\/promotional processing.<\/li>\n
- Recipients: No third-party communications except legal obligations (State Security Forces, Tax Agency, Courts).<\/li>\n<\/ul>\n
<\/p>\n
SUPPLIERS<\/strong><\/p>\n\n- Purposes: Electronic inquiries\/commercial info, administrative\/logistics management, billing\/transactions, tax filing, and debt control.<\/li>\n
- Legal Basis: Contractual relationship or consent upon contact.<\/li>\n<\/ul>\n
<\/p>\n
LOYALTY CARD USERS<\/strong> (if applicable)<\/p>\n\n- Purposes: Account management, applying discounts\/benefits, point accumulation, program communications, personalized offers (with consent), habit analysis, and fraud prevention.<\/li>\n
- Legal Basis: Consent, contractual relationship execution, and legitimate interest in security\/fraud prevention.<\/li>\n<\/ul>\n
<\/p>\n
SOCIAL MEDIA CONTACTS<\/strong><\/p>\n\n- Purposes: Answering inquiries, managing requests, and community building.<\/li>\n
- Legal Basis: Contractual framework under network privacy policies (Instagram, Facebook, WhatsApp, LinkedIn). Data processed as long as the user follows the page.<\/li>\n<\/ul>\n
<\/p>\n
VIDEO SURVEILLANCE<\/strong><\/p>\n\n- Purposes: Facility security and employee control. Data may be shared with courts\/judges.<\/li>\n
- Legal Basis: Legitimate interest (Art. 6.1.f GDPR, Art. 22 LOPDGDD).<\/li>\n<\/ul>\n
<\/p>\n
JOB APPLICANTS<\/strong><\/p>\n\n- Purposes: Selection process management, interviews, evaluation, and sharing CVs with partners (if consent given).<\/li>\n
- Legal Basis: Unequivocal consent.<\/li>\n
- Retention: CVs kept for 1 year, then deleted if uncontacted.<\/li>\n<\/ul>\n
<\/p>\n
HUMAN RESOURCES<\/strong> (HR)<\/p>\n\n- Purposes: Labor relationship management, administrative\/tax\/Social Security filings, payroll, time tracking, collective insurance\/benefits, training, sanctions\/permits, and internal compliance.<\/li>\n
- Legal Basis: Employment contract execution, legal obligations, worker consent (for optional benefits), and legitimate interest.<\/li>\n<\/ul>\n
<\/p>\n
General Provisions & Policy Compliance<\/strong><\/p>\n\n- Third-Party Data: As a rule, only data provided directly by data subjects is processed. If third-party data is submitted, prior consent must be obtained.<\/li>\n
- Minors: Data of minors under 14 years old is not processed.<\/li>\n
- Security Measures: Technical and organizational measures (Art. 32 GDPR) implemented include TLS\/SSL encryption, access controls, data segregation, access logs, encrypted backups, confidentiality policies, system updates, and security audits.<\/li>\n
- Automated Decision-Making & Profiling: No fully automated decision-making is performed. Commercial profiles may be built for personalization, but no automated decisions are made based on them.<\/li>\n
- International Data Transfers: Data is primarily processed within the EEA. Transfers outside the EEA (e.g., Zcal, OpenAI, Google Analytics, cloud providers) utilize mechanisms like EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs).<\/li>\n<\/ul>\n
<\/p>\n
Data Subject Rights<\/strong><\/p>\nData subjects have rights to: access, rectification, erasure, restriction, data portability, lodging complaints with the Spanish Data Protection Agency (AEPD), and revoking consent. Exercise forms require electronic signatures or a copy of DNI and are resolved within 1 month.<\/p>\n
Retention Schedule Table<\/strong><\/p>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.6″ _module_preset=”default” custom_padding=”0px|||||” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.6″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.6″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
\n\n\n| Category \/ Data Type<\/td>\n | Applicable Document \/ Legislation<\/td>\n | Rtention Period<\/td>\n | Notes \/ Details<\/td>\n<\/tr>\n |
\n| Clients & Suppliers<\/td>\n | Invoices, contracts, commercial correspondence, banking records<\/td>\n | Mind. 6 Jyears (Art. 30 Commercial Code).<\/td>\n | Prescriptive actions apply depending on case.<\/td>\n<\/tr>\n |
\n| Tax Records<\/td>\n | Tax General Law.<\/td>\n | 4 years.<\/td>\n | VAT\/Indirect tax declarations recommended for 10 years.<\/td>\n<\/tr>\n |
\n| Anti-Money Laundering<\/td>\n | Law 10\/2010 Art. 25.<\/td>\n | 10 years.<\/td>\n | Compliance documentation.<\/td>\n<\/tr>\n |
\n| HR & Labor Records<\/td>\n | Payroll, Social Security, General Labor Law.<\/td>\n | 3 to 5 yeras depending on infraction type.<\/td>\n | General labor docs: 4 years (6 recommended).<\/td>\n<\/tr>\n |
\n| Resumes (CVs)<\/td>\n | Selection processes..<\/td>\n | Up to 2 post-selection<\/td>\n | Unless consent is revoked earlier.<\/td>\n<\/tr>\n |
\n| Worker Training<\/td>\n | Order\u00a0 TAS\/2307\/2007. Art. 5.2<\/td>\n | 4 years.<\/td>\n | Training records.<\/td>\n<\/tr>\n |
\n| Workday Time Logs<\/td>\n | Workers’ Statute \/ RDL 8\/2019.<\/td>\n | 4 years.<\/td>\n | Must remain available to workers & inspection.<\/td>\n<\/tr>\n |
\n| Worker Files & Dismissals<\/td>\n | RDL 5\/2000 \/ RD 425\/2005.<\/td>\n | 4 to 5 years post-termination.<\/td>\n | Recommended up to 6 to 10 years for certain docs.<\/td>\n<\/tr>\n |
\n| Occupational Risk Prevention<\/td>\n | RDL 5\/2000 Art. 4.<\/td>\n | 5 years.<\/td>\n | Medical\/safety compliance records.<\/td>\n<\/tr>\n |
\n| Marketing Data<\/td>\n | Databases \/ Website visitors.<\/td>\n | Duration of treatment.<\/td>\n | Until consent withdrawal.<\/td>\n<\/tr>\n |
\n| CCTV & Access Control<\/td>\n | Art. 22 LOPDGDD. AEPD Instructions.<\/td>\n | 30 days<\/td>\n | Destroyed after 1 month unless needed for legal proceedings.<\/td>\n<\/tr>\n |
\n| Corporate Records<\/td>\n | Commercial Code Art. 30.<\/td>\n | Min. 6 years post-dissolution.<\/td>\n | Recommended throughout company lifecycle.<\/td>\n<\/tr>\n |
\n| Spa Wellness Health Data<\/td>\n | Law 41\/2002 Art. 17.1.<\/td>\n | 5 years<\/td>\n | Clinical\/medical records.<\/td>\n<\/tr>\n |
\n| Insurance Policies<\/td>\n | General Insurance Law.<\/td>\n | 2 to 10 years depending on policy type.<\/td>\n | 2 years (damage), 5 (personal), 10 (life).<\/td>\n<\/tr>\n |
\n| Data Protection Compliance<\/td>\n | DSGVO \/ LOPDGDD.<\/td>\n | 3 years post-treatment.<\/td>\n | Rights request records, audit logs: 2 to 3 years..<\/td>\n<\/tr>\n |
\n| Biometric Data<\/td>\n | AEPD Guidelines \/ Workers’ Statute.<\/td>\n | Inactive: 6 months; Logs: 4 years.<\/td>\n | Non-employees access: 30 days.<\/td>\n<\/tr>\n |
\n| Academic Records<\/td>\n | Educational Center files.<\/td>\n | Permanent (transcripts) \/ 5 to 6 years (disciplinary\/scholarships).<\/td>\n | Center-specific retention rules.<\/td>\n<\/tr>\n |
\n| Guest Registration Check-in<\/td>\n | RD 933\/2021, LO 4\/2015.<\/td>\n | 3 years<\/td>\n | Citizen security registry requirement.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" PRIVACY POLICY \u201cEXTENDED INFORMATION\u201d LAST MODIFICATION: 16-07-2026 The Privacy Policy forms part of the General Conditions governing the Website www.fidohotels.es together with the Cookies Policy and the Legal Notice. FIDO HOTELS (HOTELERA TUC\u00c3N SA AND PONTENOVO SA) reserves the right to modify or adapt this Privacy Policy at any time. Therefore, we recommend that you […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"difl_page_category":[],"class_list":["post-2351","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/pages\/2351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/comments?post=2351"}],"version-history":[{"count":26,"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/pages\/2351\/revisions"}],"predecessor-version":[{"id":16678,"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/pages\/2351\/revisions\/16678"}],"wp:attachment":[{"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/media?parent=2351"}],"wp:term":[{"taxonomy":"difl_page_category","embeddable":true,"href":"https:\/\/fidohotels.es\/en\/wp-json\/wp\/v2\/difl_page_category?post=2351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |