1. INFORMATION FOR THE DATA SUBJECT

CASTLE MONT OPCO, S.L. (Gran Hotel Monterrey), hereinafter the RESPONSIBLE PARTY, is responsible for the processing of the personal data of the data subject and for informing them that their data will be processed in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Accordingly, it provides the following information on data processing:

1. Purpose of data processing: the purpose of processing the data is to maintain a commercial relationship with the data subject. The expected data processing operations are as follows:
   1. The sending of commercial advertising notifications by email, fax, SMS, MMS, or any other electronic or physical means that exists, now or in the future, through which commercial communication is possible. These notifications will be sent by the RESPONSIBLE PARTY and will be related to its own products and services, or to those of its partners or suppliers with whom it has entered into promotional agreements. In this case, the third parties will not under any circumstances be granted access to the personal data.
   2. The carrying out of statistical studies.
   3. Processing/management of requests and queries made by the data subject through any of the contact channels made available to them.
   4. Sending of website newsletter.
2. Criteria for the holding of data: Personal data will be held as long as a mutual interest exists for maintaining the purpose of the data processing. When the holding of data is no longer necessary for this purpose, the data will be erased using the proper security measures, ensuring its anonymity or total destruction.
3. Transfer of data: Personal data will not be transferred to third parties, unless stipulated otherwise by law.
4. Rights of the data subject:
   1. Right to withdraw consent at any time.
   2. Right to access, rectify, transfer and remove the data, as well as to restrict or oppose its processing.
   3. Right to lodge a complaint before the competent supervisory body (agpd.es) if the data subject considers that the processing is not in line with the data protection regulations in force.
5. Contact details in order for data subjects to exercise their rights:

Data subjects may exercise their rights, in accordance with the established legal provisions, by writing to the RESPONSIBLE PARTY at its postal address: CASTLE MONT OPCO, S.L.(Gran Hotel Monterrey), Avda. Vila de Tossa, 27, 17310 Lloret de Mar (Girona); or at its email address: privacidad@granhotelmonterrey.com
 

1. OBLIGATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE DATA SUBJECT

By ticking the corresponding boxes and filling in the data fields marked as required in the contact form or displayed in download forms, data subjects expressly, freely and unequivocally accept that their data is necessary in order for their request to be processed by the RESPONSIBLE PARTY. The inclusion of data in the remaining fields is voluntary. The data subject guarantees that the personal data transferred to the RESPONSIBLE PARTY is true and accurate, and undertakes to notify the RESPONSIBLE PARTY of any modification.
 
The RESPONSIBLE PARTY informs data subjects and expressly guarantees that their personal data will not be transferred to third parties under any circumstances, except in cases where the said transfer is necessary in order for the RESPONSIBLE PARTY to provide a service. In such cases, the transfer will always be carried out in accordance with the provisions of the GDPR.
All the data requested through the website are compulsory, since it is necessary in order to provide the data subject with an optimal service. In the event of the data subject failing to provide all the data, the RESPONSIBLE PARTY cannot guarantee that the information and services it provides are fully in line with the data subject’s needs.
 

1. SECURITY MEASURES

In accordance with the provisions in force concerning personal data protection, the RESPONSIBLE PARTY hereby states that it fulfils all the provisions of the GDPR for the processing of personal data under its responsibility, and that it clearly complies with the principles listed in article 5 of the GDPR. As such, the data subject’s data is processed in a licit, loyal and transparent manner, in accordance with and restricted to the declared purposes of its processing.
The RESPONSIBLE PARTY guarantees that it has implemented the proper technical and organisational policies in order to apply the security measures set forth in the GDPR with the goal of safeguarding the rights and freedoms of data subjects. It also guarantees that it has provided the data subjects with the information necessary in order for them to exercise these rights.