This privacy policy applies to the website iberostar.com (hereinafter, the “Website”) and to the booking platform booking.iberostar.com, accessible from the Website (hereinafter, the “Booking Platform”).
Please read this policy carefully. Here, you will find important information about how your personal data will be processed and what your rights are under the relevant legislation in force.
We reserve the right to update this privacy policy at any time due to business decisions and to comply with possible changes to legislation or case law. If you have any doubts or need further clarification with regards to this privacy policy or your rights, please contact us through the channels indicated below.
You declare that the information you provide, now and in the future, is correct and truthful and undertake to inform us of any changes to said information. When providing the personal data of a third party, you agree to obtain prior consent from the party in question and to inform them of the content of this policy.
Generally speaking, the fields in our forms that are marked as mandatory must be completed in order for us to process your requests.
1. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?
Unless otherwise specified, the entity responsible for processing the data collected via the Website is the company IBEROSTAR HOTELES & APARTAMENTOS, S.L., with registered address at C/ General Riera 154, 07010, Palma de Mallorca, Balearic Islands, Spain (hereinafter, IBEROSTAR).
Depending on the location of the hotel affected by your requests, the entity responsible for the processing of the data provided on the Booking Platform and during the booking process (hereinafter, THE MARKETER) will be:
-
For hotels located in Europe, the Middle East and Africa (EMEA zone): PORTAL INTERACTIV, S.L., with registered address at C/ General Riera 154, 07010 Palma de Mallorca, Balearic Islands, Spain.
-
For hotels in America and the Caribbean: VISIT US, Inc., with registered address at 9250 NM, 36th St, STE 360, Doral, Florida 33178, USA and whose representative in Spain is PORTAL INTERACTIV, S.L., with registered address at C/ General Riera, 154 de Palma de Mallorca.
For any queries about the protection of your personal data, you can contact the Data Protection Officer of IBEROSTAR at privacy.dpd@grupoiberostar.com
2. WHY ARE YOUR DATA PROCESSED AND WHAT IS THE LEGAL BASIS?
IBEROSTAR will process your data for the following purposes:
b) Handling requests, queries and complaints
c) Handling of calls by the call center
d) Quality control
e) Processing of browsing data
f) Consolidation of the data of Iberostar customers for internal administrative purposes
g) Publicity purposes and marketing profiles
THE MARKETER will process your data for the following purposes:
a) Managing bookings and providing the requested services.
In the following sections you will find detailed information on this processing.
2.1. Processing of data under the responsibility of IBEROSTAR
a) Handling requests, queries and complaints
The personal data included in requests, queries or complaints formulated via the Website or in our call center will be processed in order to be dealt with. When they relate to the booking you have made, the requests, queries or complaints formulated will be communicated to THE MARKETER or, where appropriate, to the destination hotel or the relevant tourism providers themselves. This may result in the international transfer of your data if the recipient of the information is outside the European Economic Area. All this processing is necessary to fulfil a contract, apply precontractual measures at your request, or to defend against customer complaints, as appropriate.
The processing of health data that you may provide in any complaints is done in accordance with Article 9.2.f) of the GDPR, where such processing is necessary for the formulation, execution or defense of complaints. Likewise, depending on the nature of your complaint, the recipients of the data included may be, among others, administrations or public bodies, official agencies, attorneys, judges and tribunals or insurance companies.
Online check-in: The data provided in the online check-in process and the image of your identity document will be used to pre-complete the traveler section. The image of your identity document is processed using an optical character recognition program (OCR) to extract the necessary information for the section and is deleted as soon as that process has been completed.
The information provided in the traveler section will be communicated to the destination hotel to speed up your check-in at the hotel when you arrive. The hotels will communicate the guest check-in sections to the competent authorities when required by local health, security or traveler control regulations. Please find more information on the check-in and control of travelers in hotels operating under the Iberostar brand and its derivatives in the PRIVACY POLICY FOR IBEROSTAR CUSTOMERS AND GUESTS.
b) Handling of calls by the call center
The telephone number provided in the call request form on the Website is processed by the IBEROSTAR call center in order to make the call as requested. This processing is necessary in order to adopt the pre-contractual measures linked to your request. This telephone number will be deleted once your request has been dealt with. The data that you provide to the agent during the call, for example, to make a booking or a complaint, will be processed to deal with your request as indicated in the section of this policy called “Dealing with requests, queries and complaints.”
We prepare statistics from the telephone numbers of the people who call or who request a call from our call center. These statistics are produced using aggregated data with the aim of identifying the countries from or to which calls are made, as well as reviewing the volume of repeat calls in order to determine the number of calls received from a single telephone number.
This processing is based on our legitimate interest in measuring the volume of calls received by or made from our call center and in identifying the markets concerned.
How has this interest been weighed up in respect of your rights and liberties? Find out more.
When weighing up this interest in respect of your rights and liberties, it was determined that the processing had a limited impact on the privacy of the data subjects since it does not involve collecting new data and is done using aggregated data.
The calls received or made by our agents are recorded for security and quality management purposes. These recordings are deleted after a maximum period of 10 months, except when they must be stored longer in order to manage any possible incidents or complaints. The foregoing is understood without prejudice to the storage of the recordings for the time required to handle any possible responsibilities arising from the processing or the deadlines set by the applicable legal measures.
On the one hand, the recording of the calls is based on our legitimate interest in being able to verify the content of the conversation held between our clients and agents, especially in relation to the contracting of products or services and the management of claims or complaints; on the other hand, it is based on evaluating and managing the quality of our customer service. If you do not wish for your call to be recorded, please inform the agent who is helping you.
How has this interest been weighed up in respect of your rights and liberties? Find out more.
When weighing up this interest in respect of your rights and liberties, it was determined that the processing falls within the reasonable expectations of our clients as it is a widespread practice and that these recordings could also benefit said clients, for example, in the event of a discrepancy about the content of a booking or the management of a complaint, with no significant threat to their privacy provided they have the option to object to their data being processed, the limited number of people with access to the recordings, and a short storage period.
The history of calls that are made or received by the call center is retained in an active state for a period of 10 months and, in any case, during the period allowed for dealing with the applicable legal provisions and during the time necessary to deal with the potential liabilities arising from the processing.
c) Quality control
To assess the quality of the products and services of hotels operating under the Iberostar brand and its derivatives, (hereinafter “Iberostar products and services”), IBEROSTAR may use the contact details that you have provided on the Website or Booking Platform to send you satisfaction/opinion surveys. There is no obligation for you to complete these surveys and this does not prejudice the provision of the services that you have booked. This processing is based on the legitimate interest of IBEROSTAR in evaluating and managing the quality of services and products offered by Iberostar and improving its customer service.
Any comments and reviews regarding the hotels operating under the Iberostar brand and its derivatives that you submit using the corresponding opinion form will be published on the Website, together with the username that is provided, meaning that they become public information. You should be especially careful when you decide to share your personal information.
How has this interest been weighed up in respect of your rights and liberties? Find out more.
In order to weigh up this interest in respect of your rights and liberties, it has been determined that:
- The processing is consistent with the reasonable expectations of the interested parties, as they are customers who have booked or used a service and they are surveys regarding your experience with this booking or use. Furthermore, the data used to contact these customers have been provided by the data subjects themselves.
- The impact of the processing on the privacy of the data subjects is limited, as the purpose of the contact is limited to requesting the opinion of the data subjects regarding the service that they have booked or used, with them also benefiting from this processing, as it improves the quality of the services and the level of customer service.
d) Processing of browsing data
IBEROSTAR processes the navigation data of users of its Website and the Booking Platform for the purposes indicated below. To that end, we use cookies and similar technologies. You can find more information about the cookies we use and how to disable them in our COOKIES POLICY.
Metrics: IBEROSTAR creates statistics from the browsing data on the Website and the Booking Platform (IP address, pages visited and actions taken) to measure and analyze how our customers and users use these digital means and measure the performance of our online advertising campaigns.
This processing is based on the consent requested from you to use analytical cookies and our legitimate interest in assessing and managing the quality of our products and services.
How has this interest been weighed up in respect of your rights and liberties? Find out more.
In order to weigh up this interest in respect of your rights and liberties, it was determined that this processing had a limited impact on the privacy of the data subjects, as it corresponded to reasonable expectations and did not pose significant threats since it was carried out on aggregate data, with the consent of the data subjects with respect to the metrics performed through the use of cookies.
Selective advertising: If you have authorized the use of selective advertising cookies, IBEROSTAR will process the information generated by your browsing (online ID, IP address, pages visited and actions carried out) to analyze your actions on the Website with the purpose of showing you personalized advertising based on a profile created from your browsing habits. This processing is based on the consent requested to use this type of cookies.
Profiling and advertising aimed at audiences on Facebook (Facebook Custom Audiences): IBEROSTAR processes the data collected through the cookies of this Website and, if you have given consent for your data to be processed for profiling purposes, through those collected via a previous relationship with Iberostar (previous hotel bookings and stays, questions asked, affiliation with loyalty programs, registered user on the Website, etc.) in order to create your profile as an Iberostar guest. The purpose of all this is to show, through Facebook, personalized ads about Iberostar brand products and services to you and other Facebook users with a similar profile to yours.
To this end, we share identifiers with Facebook that may allow them to recognize you as a user of their social network (Facebook ID, if we have it, email address or any identifier that allows Facebook to identify you). Identifiers are sent to Facebook using coding techniques (irreversible hash function) that do not allow Facebook to know the piece of data if it is not already in their possession.
We also process data that is related to the interaction of Facebook users with our ads in order to measure the results of the advertising campaigns on this social network and to analyze their effectiveness.
This data processing is based on the consent that you have provided for the use of cookies for profiling and targeted advertising to audiences on social media. You can obtain detailed information about this processing and about how to revoke your consent or exercise your rights in our POLICY ON PROFILING AND TARGETED ADVERTISING TO AUDIENCES ON SOCIAL MEDIA
e) Consolidation of the data of IBEROSTAR customers for internal administrative purposes
The data of customers, financial data, booking data, and in general the data on transactions of goods and services generated by companies that operate hotels under the Iberostar brand and its derivatives (hereinafter jointly “hotels operating under the Iberostar brand”) are consolidated in IBEROSTAR databases for the following administrative purposes:
Creation of a customer registry at chain level: The data of customers of hotels operating under the Iberostar brand are consolidated so we have a registry of customers of the chain, to unify the forms and coding of information and enable centralized management of the operating procedures common to all hotels, for example, communicating the check-in notice of travelers to the competent authorities, when required by applicable regulations. This information is consolidated in the Iberostar hotel management tool (PMS central).
Control of the management and analysis of business data: We also use the information obtained from the consolidation of Iberostar customer data to generate reports and analyze business data for the purposes of business intelligence and management control. These analyses and reports provide results in the form of aggregate data and are used to produce statistics, patterns and forecasts to facilitate business decision-making, optimize processes, measure the performance of the products and services offered by the Iberostar brand and establish commercial strategies.
This processing is based on the legitimate interest of IBEROSTAR to transmit personal data of customers within the Iberostar brand and its derivatives for internal administrative purposes and have a consolidated vision of their transactions to make business decisions.
Please find more information on this processing in the PRIVACY POLICY APPLICABLE TO THE CONSOLIDATION OF IBEROSTAR CUSTOMER DATA FOR INTERNAL ADMINISTRATIVE PURPOSES
f) Publicity purposes and marketing profiles
IBEROSTAR consolidates the data of customers and potential customers of Iberostar in a commercial database that it uses for the purposes of direct marketing and for the creation of commercial profiles. These data are obtained from bookings and stays and, in general, from the interactions of our customers and potential customers with the digital media and the hotels and services managed with the Iberostar brand, always with the knowledge of the interested parties. These data are processed for the following commercial purposes:
Sending non-personalized marketing communications and management of distribution lists (segmentation): IBEROSTAR processes the identifying data and contact details provided on the Website and/or Booking Platform, along with the data regarding your status of customer, language and market of origin to send non-personalized marketing communications regarding products and services offered by the Iberostar brand and management of their distribution lists.
The consolidation of this information for this purpose is based on the legitimate interest of IBEROSTAR to create and use a marketing database of customers of the chain for direct marketing purposes.
Sending marketing communications regarding the chain electronically is based on Art. 21.2 of Law 34/2002 of July 11, regarding services of the electronic communications and marketing sector which replaces Directive 2002/58/EC (e-privacy directive) in Spain.
In order to manage the distribution lists, IBEROSTAR classifies the recipients of its communications based on their condition of customer of the chain, language and market of origin. This processing consists of simple classification based on objective criteria and does not intend to create commercial profiles, predictions or behavioral analyses and is based on the legitimate interest of IBEROSTAR in segmenting the recipients of its communications.
You can request to be removed from the distribution lists of the chain at any time via the link in our emails or by emailing lopd@iberostar.com.
Please find more information on this processing and find out how the interest of IBEROSTAR has been weighed up in respect of your rights and liberties in the PRIVACY POLICY APPLICABLE TO THE PROCESSING OF DATA OF IBEROSTAR CUSTOMERS FOR MARKETING PURPOSES.
Creation of a marketing profile to personalize the services and marketing communications of the chain: The data consolidated in IBEROSTAR’s marketing database is used to carry out behavioral analyses and create predictive models aimed at understanding and predicting the desires and needs of our customers, actions related to the purchasing of our products and services and the factors that determine them.
If you have authorized the personalization of IBEROSTAR services and communications, IBEROSTAR will include the data that you have provided in the forms on the Website and Booking Platform, the data generated from your bookings and the data from social networks that you have decided to share via the social media login and your browsing data on your marketing profile. This profile will be enhanced with the information generated from your interactions with other companies that operate services and hotels under the Iberostar brand and its derivatives.
Please find more information on the data we include in our marketing profiles and the sources of these data in the PRIVACY POLICY APPLICABLE TO THE PROCESSING OF DATA OF IBEROSTAR CUSTOMERS FOR MARKETING PURPOSES.
We will use the data included in your profile to personalize the treatment and services provided by the companies that operate services and hotels under the Iberostar brand and its derivatives that you interact with, for example, to wish you a happy birthday or to take into account the preferences that you have shown during your stays, such as the type of room that you prefer. In order to do so, the companies that operate services and hotels under the Iberostar brand and its derivatives that you interact with will access your profile.
What does this personalization involve?
The hotels in the chain and the companies that operate hotels under the Iberostar brand and its derivatives with which you come into contact or contract a service will consult the data of your profile to personalize the handling of your request and the provision of said service. This personalization will be done according to the standards of the chain as defined by IBEROSTAR. Your profile will only be consulted when you contact or interact with the hotels and companies of the chain and this will be done by connecting to the customer relationship management (CRM) tool of IBEROSTAR located in the European Union. Your profile data will not be incorporated into the systems of the hotels or companies of the chain making that consultation. However, please bear in mind that when these hotels and companies are located outside the European Economic Area (EEA), the consultation of your profile may mean that said data is transferred to countries that do not offer the equivalent level of protection of personal data found in Europe. The chain has adopted organizational and technical measures to guarantee a level of protection appropriate to the personal data being processed, regardless of the location of the hotels and companies that operate services and hotels under the Iberostar brand and its derivatives. These include the formalization of clauses approved by the European Commission between IBEROSTAR and the hotel and companies that operate services and hotels under the Iberostar brand and its derivatives located outside the EEA, the use of secure connections, strict control of access to the profile data and the establishment of standards aimed at persons authorized to access said information. For more information regarding the guarantees offered by these clauses, please contact our Data Protection Officer.
Your profile will also allow us to determine when to send you a marketing communication based on the frequency of your bookings or times of the year when you have stayed or usually stay at our establishments and personalize our offers based on the type of product likely to interest you, taking into account your past bookings, the amounts spent or the products you have inquired about without booking them, for example, to promote products oriented to family holidays if you have traveled with your family, have inquired about this type of product on the Websites or have requested a quote for this type of stay.
Although no automated, individual decisions are made that would have legal effects on our customers or would significantly affect them in a similar way based on this profile, we inform you of your right to object to the adoption of such decisions in accordance with the provisions of Article 22 of Regulation (EU) 2016/679.
All of this processing and these data flows are based on the consent requested from you, without this consent impacting the provision of the services contracted. You can revoke your consent at any time by emailing lopd@iberostar.com.
For more information on the marketing profiles created by IBEROSTAR, you can view the PRIVACY POLICY APPLICABLE TO THE PROCESSING OF DATA OF IBEROSTAR CUSTOMERS FOR MARKETING PURPOSES.
2.2. PROCESSING OF DATA UNDER THE RESPONSIBILITY OF THE MARKETER
a) Booking management and provision of the requested services
THE MARKETER will process the data provided on the booking forms to manage said bookings and the provision of the services requested. When following up your requests, our agents will be able to contact you by email or by telephone (for example to resolve any potential problems in the booking process).
What data will be processed for this purpose and how have they been obtained? Find out more.
The categories of data processed to manage bookings are as follows:
- Identity and contact data of the person making the booking;
- Booking or service request data (hotel, stay dates, number and age of guests and services requested);
- Data relating to payment methods;
- Data on goods and services transactions.
These data are obtained either directly from you or from third parties who have processed the booking or requested the service on your behalf, for example, the booking office or travel agency you used to book your stay.
Booking data will be shared with the destination hotel. In the event that your reservation contains accessory services provided by third party suppliers or that your requests affect such services, the personal data necessary to process said booking/service request will be shared with the corresponding suppliers, for this purpose only. Please note that when the services requested are to be provided outside the European Economic Area, these communications may involve the transfer of your data to countries that do not offer the same level of protection as the EU in terms of personal data.
The bank card information you provided when booking to cover any potential penalties for cancellations or no-shows, as established in the terms and conditions of the rate, are tokenized and will not be communicated to the destination hotel.
All this processing, these communications and, if applicable, international transfers of these data, are required to finalize the booking, provide the services requested or implement pre-contractual measures at your request.
Financial and transaction data relating to goods and services generated by your bookings will be processed to manage accounting and administration tasks and to fulfill the MARKETER’s legal obligations with regard to accounting and tax.
The booking data will be consolidated in IBEROSTAR databases for internal administrative purposes, sending business communications and, if authorized, to create marketing profiles. Please find more information in the sections “Consolidation of data of Iberostar clients for internal administrative purposes” and “Publicity purposes and commercial profiles” of this policy.
3. TO WHOM IS YOUR DATA COMMUNICATED?
Your data will only be disclosed in the situations described in the previous sections of this policy or to third parties due to legal obligations, with your prior consent or when required to provide you with the services requested.
4. HOW LONG WILL WE STORE YOUR DATA?
Without prejudice to the specific storage periods stated in the previous sections of this policy, in general, the data obtained on the Website and the Booking Platform will be stored for the duration of your relationship with IBEROSTAR and the MARKETER, in any event for the periods stipulated in the applicable legal provision and for the time required to deal with possible liability arising from the processing. Your data will be deleted once they are no longer required or relevant for the purposes for which they were collected. Your data will be deleted when no longer relevant to, or necessary for, the purposes for which they were collected.
I want to know more.
The client data consolidated for internal administrative purposes of Iberostar will be stored according to the criteria indicated in the PRIVACY POLICY APPLICABLE TO THE CONSOLIDATION OF DATA OF IBEROSTAR CLIENTS FOR INTERNAL ADMINISTRATIVE PURPOSES.
The data processed by IBEROSTAR for business purposes, including marketing profiles, will be stored as long as you do not object to processing or request their deletion, with application of the storage criteria indicated in the PRIVACY POLICY APPLICABLE TO THE PROCESSING OF DATA OF IBEROSTAR CUSTOMERS FOR MARKETING PURPOSES.
5. WHAT ARE YOUR RIGHTS?
You have the right to receive confirmation of whether or not we are processing your personal data and, in such a case, to access the data. Likewise, you can request for any incorrect data to be rectified or for incomplete data to be completed; you can also request the removal of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, you can request for the processing of your data to be limited. In such a case, we will only process the affected data for the filing, processing, or response to complaints, or with a view to protect the rights of other parties. In certain situations and for reasons related to your specific circumstances, you may object to the processing of your data. In this case, we will stop processing the data unless legitimate, compelling grounds are given that prevail over your interests, rights, and liberties, or in order to file, process, or respond to complaints.
Additionally, under certain circumstances, you may ask for your data to be transferred to another controller to be processed.
You can revoke the consent you have granted for certain purposes without this affecting the lawfulness of the processing undertaken before consent was withdrawn.
You have the right, at any given time, to revoke your consent or oppose the processing of your data for the purposes of direct marketing, including for the creation of commercial profiles. In said case, we will cease to process your personal data for such purposes. You also have the right to object to automated, individual decision-making that would produce legal effects over you or would significantly affect you in a similar way when this right exists in accordance with the stipulations of Article 22 of Regulation (EU) 2016/679.
To stop receiving business communications from IBEROSTAR or to revoke your consent for your data to be included in a marketing profile, email lopd@iberostar.com. To be removed from our distribution lists, you can also follow the link in our emails. To unsubscribe from our text messages, send an email to lopd@iberostar.com or text the word STOP to 96134.
You also have the right to file a complaint with a data protection authority. You can find the list and the contact information for European data protection agencies on the European Commission website at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.
In order to exercise your rights, you must send us a request by post or by email to the addresses indicated in the section “Who is responsible for processing your personal data?”
For further information about your rights and how to exercise them in the privacy portal of the Iberostar Group, visit https://www.grupoiberostar.com/en/privacy-portal and the Spanish Data Protection Agency website (http://www.aepd.es).
