The entity in charge of your data is Barceló Gestión Hotelera, S.L. (hereinafter, for this document, “BGH” or “Barceló”) with registered office at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca. If you have any queries regarding data protection, please get in touch with the Barceló Group Data Protection Office by sending an e-mail to dpo@barcelo.com.

BGH informs the interested party that their data will be processed by Barceló for the following purposes: 

1. Processing of bank card details by the payment service provider. In the event that the user books their accommodation through the channels indicated in paragraph 1, their card details will be automatically provided to the payment service provider, in order to make the relevant charges in relation to the booking. The payment service provider will keep the card details for a limited period of time, solely for the purpose of charging any additional charges that may arise as indicated in the Terms and Conditions of the booking (possible booking extensions, charges for changes or cancellations, etc.).

BGH will not retain the user's card details, but they will be stored in a secure environment by the payment service provider in accordance with their respective regulations. In this regard, BGH will only process the confirmation of payment of the booking or additional charges, as well as the bank card token (a specific code linked to the card, but which does not allow the use of the card) in order to request the provider to collect the additional charges.

Legitimacy: This processing is necessary for the performance of the contract.

2. Management of the booking and contracted services. There are two direct channels available to users to manage and confirm their purchases of BGH products and services: the website (Barcelo.com) and the call centre.

When products or services are booked over the phone, BGH will record the call in order to confirm and verify the bookings made by the user. BGH will always inform users that the call will be recorded, with users acknowledging that they consent to be recorded by continuing with the call. Any non-conformity means the user’s booking request cannot be processed or confirmed.

In order to manage the booking requested by the user, BGH must process the personal data provided by the user through the data collection forms.

For the same purpose, BGH will transfer the user's data to the company that owns the hotel, depending on the hotel chosen by the user during the booking process. This data transfer may involve an international transfer to a country that does not provide the same personal data protection offered within the European Union. Under the provisions established in data protection regulations, the international transfer will be carried out to fulfil the contract requested by the user. The only data transferred to said entities will be information essential for processing the hotel booking selected by the user and will only be used for this purpose.

Likewise, BGH will only process the information required to manage booking amendments or cancellation requests made by the user.

If the user provides information on their health in open form fields, or when expressly requested by the tour operator or call centre representative for the management of specific services, BGH understands that said data are expressly provided voluntarily by the user, given that this information has not been requested previously and will only be used to process the user’s request (for example, rooms adapted to individual needs).

Legitimacy: This processing is necessary for the performance of the contract. 

3. Sending reminders of unfinished bookings (abandoned shopping baskets). BGH may, at the specific request of the user, send the user reminders about the non-completion of a booking that the user has initiated. These reminders will take into account the information that the user may have included on the website in the payment form and only if the user has expressly accepted to receive reminders at the time of the non-completed booking.

Legitimacy: This processing will only be carried out if BGH has the consent of the user by means of ticking the consent request that will be displayed during the booking process. However, if the user has identified themselves as a my Barceló user, BGH will process this data on the basis of a legitimate interest, given that the user is already a member of my Barceló and the only purpose is to remind the user of an unfinished booking.  

4. Fulfilment of accounting, legal, fiscal and administrative obligations.

Legitimacy: This processing is necessary for the performance of the contract. 

5. Electronic communications with information regarding offers and promotions on products and services offered by BGH.1. To offer the user products and services that may be of interest to them, the user will be sent offers on products and services related to those contracted with BGH.

Where applicable, users who have registered with myBarceló in accordance with paragraph 10 may receive special commercial communications for users of the programme with discounts or exclusive offers aimed solely at such users.  

Legitimacy: This processing is necessary in order to comply with the legal obligations established by the Law on Information Society Services and Electronic Commerce, as well as to satisfy the legitimate interests of Barceló in guaranteeing the security of the network and of the information. 

6. In order to send commercial communications with offers related to products and/or services that the user has already contracted or has contracted in the past with BGH, which may be of interest to the user, personal data may be processed for the creation of profiles based on internal sources (e.g. browser cookie data, historical and statistical data on the contracting of BGH products). The results allow for the creation and analysis of personalised products, through segmentation into different groups based on common patterns. These profiles will only be used to send personalised communications about the products and services offered by BGH.

BGH informs that, for marketing purposes and for the continuous improvement of its products, it uses a supplier located in the United States, Salesforce Inc., which involves the international transfer of data pertaining to its users. This provider complies with the Privacy Shield agreement, which regulates international transfers between entities located in the European Union and those located in the United States, ensuring that transfers are carried out in line with the agreed terms and that the provider processes the data in compliance with the agreed stipulations. 

Legitimacy: This processing is necessary for the fulfilment of legitimate interests of BGH. 

7. Sending commercial communications about offers not related to the contracted services and/or products. BGH may send promotional offers about certain products that the user may enjoy at the hotel (e.g. furnishings in the booked room, spa, golf, Barceló Experiences). Likewise, BGH may send information on activities related to tourism and leisure, as well as cultural activities, excursions, sporting events, etc. which may or may not be offered in conjunction with the accommodation services available in our hotels. 

Legitimacy: This processing will only be carried out if BGH has the user's consent. 

8. Disclosure of personal data to owner companies of Barceló hotels for the personalisation of services offered to the user at the hotel. BGH may communicate the user's data to the company that owns the Barceló brand hotel at which the user has made a booking in order to improve the user's experience at the hotel. Accordingly, BGH will provide the owner company of the hotel with information obtained from the relationship between BGH and the user, and information obtained from other sources under the provisions of paragraph 8. 

This communication may entail an international transfer of data when the hotel to be sent the data is located outside the European Union. In any event, user data will only be transferred with the express consent of the user, and only to the hotel chosen by the user in order to offer personalised services in the hotel in which the booking has been made. 

Legitimacy: This processing will only be carried out if BGH has the user's consent. 

9. Conducting market analysis. In order to provide its users with more personalised services, BGH will create profiles based on data extracted from the sales made to users, as well as on users' tourism preferences, travel history and financial means. The data used in these profiles may have been obtained from data generated by users at the hotel where they stayed or from external sources (for example, the internet, social media). This information is very useful for BGH in order to offer users personalised products based on their commercial preferences as demonstrated by their use of services offered in the hotels, enabling BGH to enhance the user experience in terms of services provided and future bookings. 

BGH informs that, to fulfil this purpose, they will also use their supplier located in the United States, Salesforce Inc. For information on international transfers, see paragraph 5 and section IV.

Legitimacy: This processing will only be carried out if BGH has the user's consent. 

10. Managing the subscription to receive electronic newsletters containing information regarding BGH offers and promotions on products and services. Users may request to subscribe to the BGH newsletter by ticking the box “I want to subscribe”. From then on, BGH may send users regular newsletters with information on products and services offered by BGH.

Legitimacy: This processing will only be carried out if BGH has the user's consent given by means of ticking the newsletter subscription option. 

11. User registration for the my Barceló loyalty programme. BGH will process identification data required to enable the user to register with the my Barceló loyalty programme, so that the user can enjoy certain discounts on the purchase of BGH products, consult information about the hotels and enjoy services and benefits exclusively for myBarceló users. 

Where applicable, my Barceló users may:

• Receive exclusive commercial communications about the Programme through the contact channels provided by users during the registration process (email, post or phone number). 
• Receive special gifts as a reward for using the benefits and the special promotions offered by my Barceló.
  
  If the user wishes to register by identifying themselves via Facebook, Google+ or Twitter, they should be aware that in such cases said entities will provide us with information related to their identity (name, surname(s) and/or relevant network ID), together with any information the user wishes to share when using this option to register. 
  
  Legitimacy: This processing will only be carried out if BGH has the user's consent provided in one of the following ways: 
  
  
• Through voluntary registration in the programme by users via the online registration form. 
• Ticking the consent box when users register with the myBarceló Programme while booking a BGH product. 

Through proactive user identification via Facebook or Twitter.

Notwithstanding the foregoing, BGH may send or offer special gifts to my Barceló users based on a legitimate interest, based on the relationship between BGH and the user.

If the my Barceló user provides personal data of a third party, said users should guarantee the veracity of the information disclosed to BGH and ensure that the third party has been informed and express consent has been obtained for the aforementioned transfer. 

12. SMS alerts programme for my Barceló users. After registering for the my Barceló loyalty programme, users will receive an SMS offering to subscribe to BGH’s SMS alerts programme, BGH Alerts. The programme sends registered users SMS alerts relating to updates to their stays and alerts regarding promotions and abandoned online shopping baskets. To subscribe to BGH Alerts, users must be registered for the my Barceló loyalty programme and answer YES to the SMS received to confirm their subscription to BGH Alerts. To request assistance from the programme, users should send an SMS with the word HELP. To unsubscribe from the programme, users should send an SMS with the word STOP. Users subscribed to BGH Alerts will receive two messages per month. Data and/or message rates established by their operator may apply. 

Legitimacy: This processing will only be carried out if BGH has the user's consent by means of sending an SMS containing the word YES to confirm their subscription to the programme. 

13. Complaints management. In order to centrally manage any complaints filed by the user in relation to the services contracted by the user, BGH will receive the information relating to the complaint generated in the hotel, with the aim of processing said complaint and being able to offer an appropriate solution to the user. Accordingly, BGH will need to access the information generated by the user in the hotel in order to adequately deal with the complaint.

When applicable, if the complaint warrants compensation for damage suffered by the user, BGH will transfer this information to the insurance company contracted by BGH to manage the claim filed by the user.

Legitimacy: This processing is necessary for the performance of the contract. 

14. Enquiry management and other requests. BGH will process data required to address queries or requests sent by users via the different contact forms available on the website and through the chat contact form. 

Likewise, users can submit queries or requests over the phone. BGH informs users that calls may be recorded to handle users’ requests as effectively as possible and for security purposes. 

Legitimacy: This processing will only be carried out if BGH has the user's consent by means of ticking the boxes provided on the aforementioned contact forms or when understood by voluntarily submitting queries over the phone. 

15. Online reputation monitoring. BGH will be able to check the ratings made by users on websites such as TripAdvisor and similar, in order to monitor its online reputation and be able to make business decisions for the continuous improvement of its services, and may contact users who have had negative experiences in order to propose possible solutions. BGH understands that it has a legitimate interest in improving its services and protecting its brand. 

Legitimacy: This processing is based on the legitimate interest held by BGH to protect its brand’s online reputation and resolve claims and complaints made on websites such as those mentioned above. 

16. Judicial or administrative proceedings. BGH, in the event of possible legal or administrative proceedings that may arise as a result of services offered or provided by BGH, will process the necessary information to submit the relevant allegations, exercise its lawful right to defence, or file any claims deemed appropriate based on the facts. 

Legitimacy: This processing is based on legal obligations established by administrative regulations (mainly the Common Administrative Procedure Act) or is necessary to ensure that BGH can exercise its legitimate right to effective legal protection, both in its right to a defence as well as to lodge any judicial complaints that it deems necessary, based on the Civil Procedures Act or the Criminal Procedures Act. 

17. Submission of quality surveys. In order to evaluate the level of user satisfaction regarding the requested products and/or services, BGH will send quality surveys to obtain users’ opinions on these products and services and continuously improve the quality of the services provided. 

Legitimacy: This processing is based on the legitimate interest of BGH. 

18. Implementation of controls for the detection of fraudulent activities. In order to control and follow up on actions that may be considered fraudulent, either currently or in the future, BGH would like to inform users that it analyses the transactions they make. This allows BGH to identify and analyse those users it detects as acting fraudulently in detail during the booking process and, if necessary, to draw up a list of those temporarily excluded from the booking process. 

Legitimación: This processing is based on the legitimate interest of BGH, given that it involves controlling and monitoring all the operations carried out by its users in order to detect possible fraudulent activities in the transactions that take place during the booking process.

19. Processing of cookie data: Information relating to the cookie policy can be found at the following link.

Any personal data that can be accessed shall be processed and stored while the contractual relationship is ongoing or for the purpose for which they were collected. After this, BGH shall store personal data, in a duly secure manner, after the termination of the contractual relationship or when they are no longer required for the purpose for which they were collected, to make such data available to any competent Public Administration services, Judges and Courts, or the Prosecution Service during the statutory time limit for actions that may have arisen from the relationship held with the user and/or legally established retention periods. Once said time frames have passed, BGH shall proceed with the physical deletion of your data.

If users have given their consent for the processing purposes indicated in this clause, BGH shall retain their information provided the consent initially given by the user has not been withdrawn via the methods established in section V.

BGH may communicate data to:
 

• Online payment service providers with systems connected to the Barceló website, in order to collect the booking payment and possible additional charges.
• Holding companies of Barceló brand hotels. This communication may entail an international transfer of data. They will receive any personal data required to manage the booking or manage the request submitted by users. 
• Insurance brokerage and insurance company of BGH should users suffer damages that entitle them to compensation. 
• Competent Public Bodies, Judges and Courts. 
• Besides the aforementioned data sharing, BGH works with third parties who provide services and have access to the customers' personal data, which they process in representation and on behalf of BGH as a result of providing said services. Specifically, BGH hires third parties to supply, for example, and not limited to, services in the following sectors: legal advice, multidisciplinary professional services, tech services, IT services. Providers include Salesforce Inc., a company located in the United States that complies with the Privacy Shield.

Users may, if they so wish, exercise their right to access, amend and delete their data, as well as request that the processing of their data be limited, oppose said processing, request the portability of their data, and request not to be subject to individual decisions based on automated processing, using the following:
 

• By writing to the postal address provided above. 
• By emailing your request to dpo@barcelo.com. 

Users may withdraw their consent for the data processing carried out based on their consent by following the steps described in the previous paragraph.

Users may oppose the processing of their data based on the legitimate interests of BGH, particularly concerning receiving commercial communications, the creation of commercial profiles and receiving surveys.

The personal data processed by BGH is that which has been gathered through: 

- Our direct channels:
 

• Website (www.barcelo.com). 
• Call centre for telephone enquiries.

- Companies owning the hotels if user consent has been obtained. 

- Internet and social media, if user consent has been obtained.

Users may file a claim with the Agencia Española de Protección de Datos [Spanish Data Protection Agency] regarding any response received from BGH in addressing their rights. In any event, users are hereby informed that any claims relating to the processing of personal data shall be managed and processed by the Data Protection Officer of the Barceló Gestión Hotelera, S.L., located at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca, or by sending an email to: dpo@barcelo.com, attaching to this request, in both cases, a copy of their National Identity Document, Tax ID number, or an official document that identifies them.