PERSONAL DATA PROTECTION POLICY
Holiday Club Canarias Resort Management SLU, Holiday Club Canarias Sales & Marketing SLU, Holiday Club Canarias Vacation Club SL, (hereafter referred to as HOLIDAY CLUB CANARIAS) collect personal data through the different means available to it, which entails significant responsibility in the design and organisation of procedures so that they are aligned with legal compliance in data protection. Therefore, HOLIDAY CLUB CANARIAS shall adopt all necessary security measures to ensure the protection of the data collected.
In the exercise of these responsibilities, and in order to establish the general principles governing the processing of personal data within the Organisation, HOLIDAY CLUB CANARIAS approves this Personal Data Protection Policy, which is notified and made available to all its stakeholders, likewise complying with the following regulations:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
- Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights (LOPD-GDD).
- Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
I. SCOPE OF APPLICATION
This Personal Data Protection Policy shall apply to HOLIDAY CLUB CANARIAS, to its administrative, management and staff bodies, as well as to all persons who have dealings with the Organisation, expressly including service providers with access to data (“Data Processors”).
The data controller of the personal data collected within the Organisation is: HOLIDAY CLUB CANARIAS (Holiday Club Canarias Resort Management SLU with Tax ID B76081629; Holiday Club Canarias Sales & Marketing SLU with Tax ID nr. B76081611; Holiday Club Canarias Vacation Club SL with Tax ID nr. B76282904), whose legal representative is CLAUDIA MARÍA ESPLA MARÍN (hereinafter, the Data Controller).
Contact details are as follows:
Address: Avda. Ministra Anna Lindh 1, 35130 Mogán, Gran Canaria, Spain
Contact telephone number: +34 928 561 480
Contact email: [email protected]
II. INFORMATION ABOUT THE CONTROLLER AND PERSONAL DATA PROCESSING IN HOLIDAY CLUB CANARIAS
Additional information on data processing consists of more specific and expanded details that entities must provide to data subjects regarding how their personal data are managed. This concept derives from the transparency principle of the General Data Protection Regulation (GDPR) and complements the basic information initially provided, offering a higher level of detail regarding the processing activities.
Below, HOLIDAY CLUB CANARIAS provides additional information about the data processing activities carried out:
|
Additional information on Data Protection |
||
| DATA CONTROLLER DETAILS | ||
| Organisation: | HOLIDAY CLUB CANARIAS | |
| Address: | Avda. Ministra Anna Lindh 1, 35130 Mogán, Gran Canaria, Spain | |
| Telephone number: | +34 928 561 480 | |
| Email: | [email protected] | |
| PURPOSES OF THE PROCESSING OF PERSONAL DATA | ||
| Data processing | Purpose of processing | Retention period |
| Customers | Customer Management, Accounting, Tax and Administrative Management |
Customer management: five (5) years. Accounting and tax: four (4) years. Administrative: five (5) years. |
| Video Surveillance | Video Surveillance | One (1) month. |
| Human Resources | Human Resources | Four (4) years. |
| Newsletter | Advertising and Commercial Prospecting | Two (2) years. |
| Curriculums | Human Resources | Four (4) years. |
| Suppliers | Professional Contact, Customer Management, Tax and Administrative Management |
Professional Contact: five (5) years Customer Management: five (5) years Accounting, Tax and Administrative: six (6) years. |
| LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA | ||
| Data processing | Legal basis | |
| Customers | Performance of a commercial/sales/service provision contract | |
| Video Surveillance | Public interest in video surveillance | |
| Human Resources | Performance of an employment contract | |
| Newsletter | Legitimate interest and consent of the data subject | |
| Curriculums | Legitimate interest and consent of the data subject | |
| Suppliers | Performance of a commercial/sales/service provision contract | |
| RECIPIENTS OF YOUR PERSONAL DATA | ||
| Data processing | Disclosure foreseen | International transfers |
| Customers | No disclosures foreseen | No |
| Video Surveillance | No disclosures foreseen | No |
| Human Resources | No disclosures foreseen | No |
| Newsletter | No disclosures foreseen | No |
| Curriculums | No disclosures foreseen | No |
| Suppliers | No disclosures foreseen | No |
| RIGHTS AVAILABLE TO YOU AND MEANS PROVIDED | ||
|
Any person has the right to obtain confirmation as to whether HOLIDAY CLUB CANARIAS is processing personal data concerning them. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request their erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected. Under certain circumstances, data subjects may request the restriction of the processing of their data, in which case we shall only retain them for the exercise or defence of claims, as well as to comply with legally established retention periods. Likewise, data subjects may object to the processing of their personal data. Therefore, HOLIDAY CLUB CANARIAS shall cease processing their data, except for compelling legitimate grounds or for the exercise of possible claims. In the same regard, where certain circumstances apply and it is technically possible, data subjects shall have the right to have their personal data transmitted directly to another controller or processor, upon request. To exercise the rights, you must contact the Organisation by submitting a written request to: HOLIDAY CLUB CANARIAS Avda. Ministra Anna Lindh 1, 35130 Mogán, Gran Canaria, Spain, or by email to [email protected]. We recommend attaching a copy of your ID document. |
||
III. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA
The Personal Data Protection Policy is a proactive accountability measure aimed at ensuring compliance with applicable legislation in this matter and, in relation thereto, respect for the right to honour and privacy in the processing of personal data of all persons who interact with HOLIDAY CLUB CANARIAS.
In implementation of this Policy, the principles governing data processing within the Organisation are established and, consequently, the procedures and organisational and security measures that persons affected by this Policy undertake to implement within their area of responsibility.
In this regard, HOLIDAY CLUB CANARIAS shall ensure compliance with the following principles:
- Lawfulness, fairness, transparency, and purpose limitation.
Data subjects must always be informed of the processing through established clauses and procedures; and shall only be considered lawful if there is consent to the processing of personal data (with special attention to consent given by minors), or another valid legal basis exists, and the purpose is in accordance with the applicable regulations. - Data minimisation. The data processed must be adequate, relevant, and limited to what is necessary in relation to the purposes of processing.
- The data must be accurate and, where necessary, kept up to date. Measures shall be adopted to ensure that inaccurate personal data is erased or rectified without delay.
- Storage limitation. Data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing.
- Integrity and Confidentiality. Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by implementing appropriate technical or organisational measures.
- Data disclosures. The purchase or acquisition of personal data from illegitimate sources is prohibited, or in cases where such data has been collected or disclosed in breach of the law or where the legitimate origin is not sufficiently guaranteed.
- Engagement of providers with access to data. Only providers offering sufficient guarantees to implement appropriate technical and security measures in data processing shall be selected. The corresponding contract shall be duly formalised with them.
- International data transfers. Any processing of personal data subject to European Union regulations that involves a transfer of data outside the European Economic Area shall be carried out in strict compliance with the requirements established in the applicable legislation.
- Rights of data subjects. The Organisation shall facilitate data subjects in exercising their rights of access, rectification, erasure, restriction of processing, objection and portability, establishing for this purpose the necessary internal procedures and models, which must at least meet the legal requirements applicable in each case.
HOLIDAY CLUB CANARIAS ensures that the principles contained in this Personal Data Protection Policy are considered:
- In the design and implementation of all work procedures.
- In the products and services offered.
- In all contracts and obligations formalised or assumed.
- In the implementation of all systems and platforms that allow access by its staff or third parties and/or the collection or processing of personal data.
IV. PERSONAL DATA OF MINORS
In compliance with Articles 8 of the GDPR and 7 of Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights, only persons over 14 years of age may lawfully grant consent for the processing of their personal data by HOLIDAY CLUB CANARIAS. If the data subject is under 14 years of age, parental or guardian consent shall be required for processing, and it shall only be considered lawful to the extent that such consent has been granted.
V. CONFIDENTIALITY AND SECURITY OF PERSONAL DATA
HOLIDAY CLUB CANARIAS undertakes to inform the user, without undue delay, when a personal data security breach occurs that is likely to result in a high risk to their rights and freedoms. Pursuant to Article 4 of the GDPR, a personal data breach shall mean any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
Personal data shall be treated as confidential by the Data Controller, who undertakes to inform and to ensure, by means of a legal or contractual obligation, that such confidentiality is respected by its employees, associates and any person to whom the information is made accessible.
VI. COMMITMENT OF THE STAFF OF HOLIDAY CLUB CANARIAS
Accordingly, we state that the employees of HOLIDAY CLUB CANARIAS informed of this Policy and declare themselves aware that personal data is an asset of HOLIDAY CLUB CANARIAS, and in this regard adhere to it, committing to the following:
- Undertake data protection awareness training made available by HOLIDAY CLUB CANARIAS.
- Apply user-level security measures applicable to their position, without prejudice to responsibilities in their design and implementation that may be attributed to them depending on their role within HOLIDAY CLUB CANARIAS.
- Use the established forms for the exercise of rights by affected users and inform HOLIDAY CLUB CANARIAS immediately so that a response may be effectively provided.
- Inform HOLIDAY CLUB CANARIAS, as soon as they become aware, of deviations from this Policy, in particular “Personal Data Security Breaches”, using the format established for this purpose.
VII. CONTROL AND EVALUATION
HOLIDAY CLUB CANARIAS shall carry out an annual verification, evaluation and assessment, as well as whenever there are significant changes in data processing activities, of the effectiveness of the technical and organisational measures implemented to ensure the security of processing.