All the information you need
Data Protection
Information pursuant to Articles 13 and 14 GDPR – Client Reservation File
Data Controller
Address: C/ Enric Alzamora, 6
Phone: 971-213093
Email: dpo@roc-hotels.com
Tax ID: A07793466
Purpose of processing: At Promotions Developments Illetas, S.A., we process the information provided to deliver services, issue invoices, and manage the sending of commercial information. Data will be retained for 5 years from the last contract or purchase.
Legal basis for processing: Performance of the contract and consent of the data subject for commercial offers in accordance with Law 34/2002.
Recipients: Data will not be shared with third parties except as required by law. No international transfers are planned.
Data subject rights: Access, rectification, deletion, restriction of processing, and complaint to the Spanish Data Protection Agency (www.agpd.es).
Source of data: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Invoices / Accounting
Data Controller: Promotions Developments Illetas, S.A. - C/ Enric Alzamora, 6 - dpo@roc-hotels.com - Tax ID: A07793466
Purpose: Issuing invoices and fulfilling accounting and tax obligations. Data retained for 5 years.
Legal basis: Legal obligation derived from the Commercial Code and tax legislation.
Recipients: Data will not be shared except as required by law. No international transfers.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Newsletter
Purpose: Sending personalized offers and managing commercial information. Data retained during the business relationship and until deletion is requested.
Legal basis: Consent of the data subject and Law 34/2002. Withdrawal of consent does not affect service provision.
Recipients: Data will not be shared except as required by law. No international transfers.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Web Users
Purpose: Providing services contracted through the website and managing commercial information. Data retained for 5 years from the last purchase or until deletion is requested.
Legal basis: Performance of the contract and consent for commercial offers under Law 34/2002.
Recipients: Data will not be shared except as required by law.
Rights: Complaint to the Spanish Data Protection Agency (www.agpd.es).
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Employees
Purpose: Personnel management, preparation of contracts, payroll, and social security. Data retained for 5 years after termination of employment.
Legal basis: Compliance with legal obligations (Workers’ Statute, Social Security, Occupational Health and Safety).
Recipients: Social Security Treasury, Tax Agency, SEPE, mutual insurance, banks, accounting firms, and contractors.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Curriculum Vitae / HR
Purpose: Recruitment and participation in selection processes. Data retained for 2 years or until deletion is requested.
Legal basis: Consent of the data subject for participation in selection processes.
Recipients: Data will not be shared except as required by law. No international transfers.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Suppliers
Purpose: Processing orders and invoicing services. Data retained for 5 years from the last contract.
Legal basis: Compliance with legal obligations under tax and commercial law.
Recipients: Data will not be shared except as required by law.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Customer Satisfaction Survey
Purpose: Measure customer satisfaction and create commercial profiles. Data retained for 5 years from the last reservation.
Legal basis: Consent of the data subject. Law 34/2002 for commercial communications.
Recipients: Data will not be shared except as required by law. No international transfers.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Collections
Purpose: Management of collection and recovery of outstanding invoices. Data retained for 5 years from the last contract.
Legal basis: Compliance with commercial and tax obligations. Recovery management in accordance with the Civil and Commercial Codes.
Recipients: Data will not be shared except as required by law.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.
Information pursuant to Articles 13 and 14 GDPR – Video Surveillance
Purpose: Control and monitoring of access through cameras. Images retained for 30 days.
Legal basis: Compliance with legal obligations on security and protection of facilities.
Recipients: Promotions Developments Illetas, S.A. acts as data processor. Data will not be shared except as required by law.
Rights: Access, rectification, deletion, restriction, and complaint to the Spanish DPA.
Source: The data subject.