This privacy policy applies to the website https://www.blau-varadero.com/ (hereinafter the ‘Website’).

Please read it carefully. It contains important information about the processing of your personal data and the rights granted to you under current legislation on this matter.

We reserve the right to update our privacy policy at any time in response to business decisions, as well as to comply with any legislative or case-law changes. If you have any queries or require clarification regarding our Privacy Policy or your rights, you may contact us via the channels set out below.

You confirm that the data you provide to us, now or in the future, is correct and accurate, and you undertake to notify us of any changes to it. Should you provide personal data relating to third parties, you undertake to obtain the prior consent of those concerned and to inform them of the contents of this policy.
In general, the fields on our forms marked as mandatory must be completed in order for us to process your requests.

1. Who is the data controller?
Unless otherwise specified, the data controller for the data collected on this website is ROXA HOSPITALITY, S.L.U., with registered office at Calle Manuel Azaña, 38, plt. 2, 07006, Palma de Mallorca (Balearic Islands) and email address recepcion@roxahospitality.com.

The Data Protection Officer for ROXA HOSPITALITY, S.L.U. is IURISTEC, S.L., with registered office at Calle Guillem Massot, 53, ground floor, 07003, Palma de Mallorca, and email address dpo@roxahospitality.com

2. What personal information do we collect?
The data we process is obtained:
- From the forms you complete and the requests you make on the website. We also process the data included in requests and enquiries we receive by email or via our call centre.
- From profiles and analytics derived from users’ browsing activity on the website, whether they are registered or not.

The categories of data we process typically consist of:
- Identification and contact details, such as your national identity card or passport number;
- Data relating to your booking;
- Financial and transaction data;
- Data relating to your browsing activity, for example the IP address from which you connect to the website, web logs, pages visited or actions carried out on the website. To this end, we use cookies and similar technologies which may involve tracking your browsing activity. Further information is available in our cookies policy at URL.
- Marketing tracking data
- Identification and contact details obtained from the social media profile you used to log in to our website. This data is processed solely for this purpose.
- Data generated by your use of social media, which you have chosen to share with us (for example, ‘likes’ and comments).

3. Why will we process your data?
Our users’ data will be processed for the purposes of managing our relationship with them, responding to their requests and enquiries, managing their bookings, administering and managing the security of the website, and complying with our legal obligations. This data will also be processed for analytical purposes and to improve the quality of our services. Furthermore, we will process your data to send you marketing communications by electronic means.
4. To whom may we disclose your data?

Your booking details may be disclosed to entities managed by ROXA HOSPITALITY, S.L.U. or to other companies within the Roxa Group’s hospitality division*, namely the destination hotels or the companies whose services are included in the contracted service, for the purpose of the proper processing and management of your bookings, requests or enquiries. This includes passing on to those hotels the bank card details you provided when making the booking, in order to cover any cancellation or no-show charges set out in the rate conditions. The processing of your bookings necessarily involves the aforementioned data processing; therefore, the process cannot be carried out if you object to it.

This disclosure may involve an international transfer of data, as the aforementioned entities are located outside the European Economic Area.

Furthermore, we will disclose your data to third parties where required by law, with your consent, or where your request necessitates such disclosure.

The sending of marketing communications and reminder emails regarding ongoing booking processes is based on your consent.

* You can view the companies managed by ROXA HOSPITALITY via the following link: www.roxa.es/hoteles-grupo-roxa-blau-hotel/

5. Legal basis for data processing

The basis for the processing of your data is the management of the legal relationship established with you, the provision of the services requested and compliance with legal obligations.

The following processing activities are based on the existence of a legitimate interest:
- The management of website security is based on our legitimate interest in ensuring the security of our systems.
- The compilation of statistics and quality control are based on our legitimate interest in evaluating our services.
- The sending of marketing communications is based on our legitimate interest in promoting our products or services, as well as on your consent to receive such communications by electronic means.
The following processing activities are based on your consent, although the withdrawal of such consent does not affect the provision of the contracted services:
- The creation of browsing profiles based on information obtained from cookies or similar technologies.

6. How long will we retain your data?

Generally speaking, we retain your data for the duration of your relationship with us and, in any event, for the periods set out in the applicable legal provisions and for as long as is necessary to address any potential liabilities arising from the processing. Transcripts of conversations with the Call Centre will be deleted within a maximum of 5 years, without prejudice to their retention for the periods necessary to manage any incidents or as required by the applicable legal provisions. We will delete your data once it is no longer necessary or relevant for the purposes for which it was collected. Access logs for restricted areas of the website will be deleted one month after they are created. Information relating to browsing will be deleted once the internet connection has ended and the relevant statistics have been compiled.

Data processed for commercial purposes will be retained until you request its deletion.

7. What are your rights?

You have the right to obtain confirmation as to whether or not we are processing your personal data and, if so, to access it. You may also request that your data be rectified where it is inaccurate or that incomplete data be completed, as well as request its erasure where, amongst other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, you may request that the processing of your data be restricted. In such cases, we will only process the data concerned for the establishment, exercise or defence of legal claims or for the protection of the rights of others. Under certain conditions and on grounds relating to your particular situation, you may also object to the processing of your data. In this case, we will cease processing the data unless there are compelling legitimate grounds for doing so which override your interests or rights and freedoms, or for the establishment, exercise or defence of legal claims.

Similarly, subject to certain conditions, you may request the portability of your data so that it may be transferred to another data controller.

You may withdraw any consent you may have given for specific purposes, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.

To opt out of processing for commercial purposes, you may:
- Send an email to the following email address: reservas@blauhotels.com
- Use the link provided for this purpose in our newsletters.
You also have the right to lodge a complaint with a data protection authority.
To exercise your rights, you must send us a request, accompanied by a copy of your national identity card or another valid form of identification, by post or email, to our Data Protection Officer at the addresses indicated in the section ‘Who is responsible for processing your data?’.
You can find further information about your rights and how to exercise them on the Spanish Data Protection Agency’s website at www.aepd.es