The purpose of this privacy policy (the "Policy") is to explain the rules governing the various processing operations that may be carried out when you use our website, accessible at the URL https://www.cn340suites.com (the "Site").
The processing of personal data carried out through the Site is the responsibility of the data controller.
Data controller: SUITE DREAMS S.L., with tax ID (NIF) B10660058 and registered address at Edificio Don Juan, Ctra. Nacional N-340, km 141, 29691 Manilva (Málaga). Email: reservas@cn340suites.com. The Institution is hereinafter referred to as the "Data Controller". The terms "we", "us" and "our" in this Privacy Policy refer to the Data Controller.
As the controller of your Personal Data, we do everything we can to protect your privacy when you visit the Site. This Policy explains the origin and use of your Personal Data and of your browsing information processed when you visit our Site.
For the purposes of this Policy, the term "Personal Data" refers to any data relating exclusively to you that allows you to be identified directly or indirectly, regardless of the Terminal you use. The term "Terminal" refers to the physical equipment (computer, tablet, smartphone, telephone, etc.) that you use to view and browse the Site.
The term "Regulations" refers to the legislation on personal data, and in particular to Regulation (EU) 2016/679, known as the General Data Protection Regulation (GDPR), and to Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD, the Spanish Data Protection Act).
By using our Site, you declare that you fully accept the terms of this Policy. If you do not agree with any of these terms, you are free to stop using our Site.
This Privacy Policy is updated periodically. We will notify you in advance of any significant changes through notifications on the relevant services or by email, as appropriate. The Site will always display the most up-to-date version of this Privacy Policy.
In accordance with the Regulations, we record all processing operations in a record of processing activities, which we make available to the competent authorities. All the information you provide during your visits to the Site is confidential. This information is necessary for the purposes for which it is processed.
The information that may be collected and processed includes:
When we ask you to enter personal data to access a feature, some fields are mandatory because they are needed to give you access to that feature (for example, to register your booking we need your first name and surname). It is important that the personal information shared about you is accurate and up to date.
We do not process any personal data that could be classed as "sensitive" (information relating to racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sex life) within the meaning of the Data Protection Regulations.
We undertake not to transfer your personal data to third parties unless otherwise specified below in Article 3.4.
Booking Management Processing your data is necessary to keep you informed of the status of your booking, provide booking summaries, accept payments, etc.
Access to Customer Service We process your Personal Data as part of our customer service in order to respond to your requests, particularly those made through contact forms.
AI conversational assistant When you use the chat on this website we process the messages in the conversation and any contact details you voluntarily provide (name, email, phone), in order to handle your query, follow up on it and, where applicable, prepare a commercial proposal. The legal basis is your consent when starting the conversation and the taking of steps at your request prior to entering into a contract (GDPR art. 6.1.a and 6.1.b). The service is provided by AizuaLabs as data processor, which may engage language-model providers as sub-processors, some located outside the European Economic Area, with the appropriate safeguards set out in Chapter V of the GDPR. Conversations are retained for 12 months from the last message, unless a contractual relationship begins, in which case the applicable statutory periods apply. No automated decisions producing legal effects concerning you are taken. You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to reservas@cn340suites.com, and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Fraud Detection and Prevention We process your personal data to detect, prevent and investigate fraudulent activity in order to protect both you and our business against financial crime, unauthorised transactions and security threats.
Improving Our Services We process your browsing and booking data for analysis and statistical purposes, only with your consent. This data allows us to analyse how you use our Site and to improve its usability and quality.
Marketing As part of your subscription to our newsletter, we process your data to manage your subscription and to send you targeted information by email or SMS according to your preferences. We may also contact you via push notifications if you subscribe to this service.
Processing for marketing purposes requires your consent. You can unsubscribe from our communications at any time.
If you have given us your consent to receive our communications, we may use the information to:
Contract: For booking management and access to customer service. When you purchase products from our Site, we collect and process your personal data to perform the contract between us. For example, we need your postal details for delivery or your bank details to process payment.
Legitimate Interest: We process your personal data to ensure the security of networks and information systems, which constitutes our legitimate interest in protecting ourselves against cyber threats and ensuring the availability of the service. We detect and prevent fraud, as it may affect you. Credit card data for payment purposes (user consumption and incidentals).
Consent: For improving our services and for marketing. When we process Personal Data for service improvement and direct marketing purposes, the legal basis is your consent.
Legal Obligation: To comply with applicable legal obligations. When we must comply with legal obligations such as providing guests' personal data to the Spanish Ministry of the Interior (in accordance with Royal Decree 933/2021) or for tax purposes.
The following providers process data on behalf of the Data Controller, as data processors:
In the course of using our Site, you may receive information from third parties with whom we work to offer certain services:
Personal Data collected through the Site is processed mainly by the Data Controller's internal departments. We may share your information with the third parties mentioned above for reasons including:
We require third parties who receive your personal data to comply with the data protection Regulations. These third parties may only use your personal information in accordance with our instructions and not for their own purposes.
The Site uses Google Analytics 4, a web analytics tool from Google Ireland Limited, only if you accept it in the cookie notice; you can change your choice at any time from “Cookie settings”, at the bottom of every page. The Site does not use advertising tools. More information in the Cookie policy.
We may also disclose your Personal Data in response to requests from judicial authorities.
We will keep your data for a period determined by the applicable local legislation after your last booking, in order to answer questions or complaints, or to retain the data needed to meet legal, accounting or analytical requirements.
Specific retention periods under Spanish law:
We may also keep your data for research or statistical analysis purposes after anonymisation. For newsletter subscriptions, we will not contact you again if you have not opened our newsletters for more than twelve (12) months, or if you withdraw your consent before then, as you have the right to object to commercial communications.
Any changes to this Policy will be made on this page and, in the case of substantial changes, notified by email.
The Data Controller may also keep your data for research or statistical analysis purposes. As this is anonymised data, the Regulations do not impose any retention period, since it is not possible to "re-identify" you afterwards.
The Personal Data processed through the Site is hosted by the providers listed in section 3.4: Cloudflare, Inc. (web hosting), Supabase Inc. (guest area and requests) and Amenitiz (bookings and payments).
The Data Controller has implemented appropriate technical measures to maintain the security of your Personal Data.
Your consent must be given clearly and unambiguously. When you agree to fill in the contact form on the Site:
In accordance with the Regulations, you have the following rights over your Personal Data:
Title X of the LOPDGDD (Articles 79-97) guarantees a number of digital rights, including, among others:
These rights are provided for information purposes. For their full scope and conditions, please consult the LOPDGDD directly.
Regardless of the purpose or legal basis on which we process your data, you can email us to exercise your rights at: reservas@cn340suites.com
Or send us a letter at: SUITE DREAMS S.L., Edificio Don Juan, Ctra. Nacional N-340, km 141, 29691 Manilva (Málaga), Spain
Please note that we may not always be able to grant your request, for legal reasons that we will explain to you after receiving it.
You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — the supervisory authority for data protection in Spain — at www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid, Spain.
The Site has appropriate security measures in place to prevent the loss, unauthorised use or access, modification or disclosure of your Personal Data. All personal data collected is stored on secure servers. The Data Controller has implemented procedures to deal with any personal data breach.
We recommend connecting only to secure networks, preferably private ones. Please be aware of the risks associated with public Wi-Fi networks.
Regardless of the Data Controller to which you have voluntarily transmitted your Personal Data, and given the nature of the Internet, other operators with no connection whatsoever to the Data Controller may collect it without your consent, especially while you browse the Internet.
We recommend installing antivirus and anti-spyware software on your computer and updating it regularly.
The Data Controller will never ask you by email to provide personal information. If you receive an email on behalf of the Data Controller asking you for sensitive personal information (bank details, details of your private life, etc.), please do not reply, and forward that email to us so that we can take the necessary action.
You should only provide your account information after logging in to the Site directly through your browser.