Privacy Policy

Last update: September 2019
The Privacy Policy forms part of the General Terms and Conditions governing this website.

Who is responsible for processing your data?

HERITAGE MADRID 2017 SL (HOTEL HERITAGE)
Address: Calle Orfila, 8, 28010 Madrid
CIF (Tax ID): B87942827
Contact: Phone: +34 910 88 70 70
Email: bookings@heritagemadridhotel.com

You may contact the Data Controller through any of the contact methods provided.
We reserve the right to modify or adapt this Privacy Policy at any time.
We recommend reviewing it regularly. If you have registered and access your account or profile, you will be informed of any modifications.

Clients

For what purposes will we process your personal data?
Your data will be processed for the purpose of managing your reservation, your stay at the hotel, and any related requests, as well as for other services offered, and to ensure payment of any related expenses.
For this purpose, we will collect identifying and contact details, as well as financial and other information you may provide.
Your data will be communicated to Law Enforcement Authorities as required by law, and to travel agencies or tour operators involved.
Data will be kept for at least 6 years in compliance with tax, commercial, consumer, and traveler registry laws.

The legal basis for this processing is the execution of a contract.

Website or Email Contacts

The Controller will process the data you provide through the contact form or when contacting us via email or phone—such as identifying and contact details, or other data you may include.
We may also process, anonymously, your IP address, operating system, browser type, and the duration of your visit.

The purposes of data processing are:

To respond to inquiries, requests, or applications.
To manage the requested service.
To provide information electronically related to your request.
To perform analyses and improvements to the website.
To improve our commercial strategy.

If you create a user account on the website to manage your orders and/or reservations, your data will be processed so you can use the features of that account.

Data processing is based on either contract execution or the acceptance and consent of the user, as applicable.
When you complete a form and click “send,” this implies that you have been informed and expressly consent to the processing of your data under this Privacy Policy.
If you do not check the privacy policy acceptance box, the form submission will not be allowed.

We do not process minors’ data without proper authorization. Therefore, please refrain from providing such data if you are underage or from submitting data of third parties who are minors.
HOTEL HERITAGE assumes no liability for breach of this requirement.

Newsletter Contacts

On the website, you may subscribe to our newsletter by providing your email address.
We will store only your email in our database and send you periodic emails until you unsubscribe or we stop sending emails.
You will always have the option to unsubscribe in every communication.

Social Media Contacts

Personal data available on social media profiles, as well as any information provided when contacting us via these channels, will be processed for the following purposes:

To respond to inquiries, requests, or applications.
To manage the requested service, respond to your request, or handle a specific inquiry.
To establish a user–controller relationship and build a community of followers.

In this case, processing is based on the acceptance of a contractual relationship within the relevant social network, according to its own Privacy Policies. We recommend users review these policies.

Hotel Heritage can only view or remove data within the limits of its profile permissions.
Data will be processed for as long as the user allows it through social network interactions.
Any rectification or restriction of information or publications must be managed directly by the user via their social media profile settings.

Job Applicants

What data do we use from your CV?
The Controller will process CVs and the data contained within them, as well as information related to job applications and selection processes, including identification and contact details, for the following purposes:

Organizing recruitment and selection processes.
Scheduling job interviews and assessing candidates.

The legal basis for this processing is the explicit consent of the candidate, understood as granted by submitting their application.
After one year from receipt, CVs will be securely deleted.

Do we include third-party personal data?

As a general rule, we only process data provided by the data subjects themselves.
If you provide us with third-party data, you must first inform and obtain consent from those individuals. Otherwise, you release us from any liability for noncompliance with this requirement.

What security measures do we apply?

You can rest assured: we have adopted an optimal level of protection for the personal data we handle and implemented all available technical and organizational measures, according to the current state of technology, to prevent loss, misuse, alteration, unauthorized access, or theft of personal data.

Who will your data be shared with?

Your data will not be shared with third parties unless required by law.
Specifically, it may be communicated to:

The Spanish Tax Agency and financial institutions for payment processing.
Data processors necessary for fulfilling contractual obligations.

In case of purchases or payments, if you use an online platform, app, or payment gateway, your data will be processed in that environment, always with maximum security.
Our web development, maintenance, and hosting providers may access data only as instructed, under contracts requiring them to maintain the same level of privacy as we do.

Any international data transfers involving U.S.-based applications will comply with the Privacy Shield framework, ensuring adherence to European privacy standards.

What are your rights?

You have the right to:

Know whether we process your data.
Access your personal data.
Request correction of inaccurate data.
Request deletion of your data when no longer necessary or when consent is withdrawn.
Request restriction of processing under certain circumstances, in which case we will retain your data only as required by law.
Data portability, providing your data in a structured, commonly used, machine-readable format—or transferred directly to another controller, where applicable.
File a complaint with the Spanish Data Protection Agency (AEPD) or another competent authority if you believe we have not handled your request properly.
Withdraw your consent at any time.

If you update your data, please let us know so we can keep our records accurate.

Would you like a form to exercise your rights?

We have forms available for exercising your rights—request them by email, or you may use those provided by the AEPD or other entities.
Forms must be signed electronically or accompanied by a photocopy of your ID.
If someone represents you, please include a copy of their ID or an electronic signature.
Forms may be submitted in person, by post, or via email to the address listed at the beginning of this policy.

How long do we take to respond to rights requests?

Response times depend on the specific right, but we will reply within one month of your request, or within two months if the matter is particularly complex (in which case you’ll be informed).

Do we use cookies?

If we use cookies other than those strictly necessary, you can review our Cookie Policy through the corresponding link on our website homepage.

How long will we retain your personal data?

Personal data will be retained while you remain associated with us.
After your relationship ends, data processed for each purpose will be retained for the legally required periods, including the time a court may request them under applicable limitation periods.
Data will be kept as long as legally required, or—if no legal obligation exists—until you request deletion or withdraw your consent.

We will retain all information and communications related to your purchase or service provision for as long as product or service warranties are valid, to address possible claims.