Privacy Policy

PRIVACY POLICIES

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (‘GDPR’) and its implementing regulations, ABBA HOTELES, S.A. (‘ABBA’) informs all users of the website www.abbahoteles.com (the ‘Website’) about the processing of their personal data, both data provided when accessing and using the Website and data processed in the course of their ongoing relationship with the establishments within the Chain, as set out below under ‘Privacy Policy/Hotel accommodation’.

For what general purposes will we process your personal data?

To handle requests for information submitted through the contact section of the Website.
To send information, including by electronic means, about ABBA and the various establishments within the Chain, including our activities, offers, promotions, newsletters and other information we believe may be of interest to you.
To enable the management of your online reservation for services offered at any of the establishments within the Chain.
To enable registration and membership of our loyalty programme, abbantage, as well as the implementation of all actions related to membership, as described in its legal terms. In any case, one of the inherent benefits of membership of the programme is the receipt of electronic communications containing offers or promotions exclusive to members.
To manage business relationships with clients and/or suppliers. For this purpose, we process the data of contact persons within client and supplier companies.
To manage job applications submitted through the ‘Careers’ section.

What is the legal basis for processing your data?

For handling requests for information submitted through the ‘Customer Service’ section of the Website: the consent provided through the submission of the request.
For sending information about ABBA and the various establishments within the Chain: your consent and, in the case of electronic communications, Article 21.1 of the LSSI.
For managing online reservations: performance of the contract.
For managing and maintaining membership of our loyalty programme: performance of the contract. Article 21.2 of the LSSI applies to the sending of communications.
For managing business relationships with clients and/or suppliers: performance of the contract or ABBA’s legitimate interest in the case of processing for administrative, accounting, internal audit or similar purposes.
For managing job applications submitted through the ‘Careers’ section and participation in recruitment processes: the consent provided through submission of the application and, at the data subject’s request, the application of pre-contractual measures.

How long will we retain your data?

With regard to requests for information submitted through the contact section of the Website: until the request has been resolved.
With regard to the sending of information, including by electronic means, about ABBA and the various establishments within the Chain, including our activities, offers, promotions, newsletters and other information we believe may be of interest to you: until you indicate otherwise using the mechanisms provided in each communication.
With regard to the management of your online reservation for services offered at any of the establishments within the Chain: for the duration of the provision of the contracted services and, once completed, for the legally established periods for accounting purposes or until any potential liabilities arising from the provision of the services have expired.
With regard to registration and membership of our loyalty programme, abbantage: while the loyalty programme remains active or until you cancel your membership.
With regard to the management of business relationships with clients and/or suppliers: while the relationship remains in force and, once terminated, for the legally established periods under tax and accounting regulations.
With regard to the management of job applications submitted through the ‘Careers’ section: until you indicate otherwise, and in any event for a maximum of two years.

To whom will your data be disclosed?

As a general rule, your data will not be disclosed to third parties.
The only disclosures that may take place, aside from those required by law, would be between ABBA and the various establishments within the Chain (listed at the end), where necessary, such as in the case of a reservation (the hotel where you will be staying), the management of certain aspects of the loyalty programme or participation in recruitment processes at establishments within the Chain.
In addition to the above, third-party data processors may have access to your data.

What are your rights when you provide us with your data?

While ABBA processes your personal data, you have the right to request:

Access.- You have the right to obtain confirmation from the data controller as to whether or not personal data concerning you are being processed, as well as detailed information about certain aspects of the processing being carried out.

Rectification.- You have the right to obtain the rectification of inaccurate personal data concerning you or to have incomplete data completed.

Erasure.- You have the right to request the erasure of your personal data; in any case, such erasure will be subject to the limits established by the applicable regulations.

Restriction of processing.- You have the right to request the restriction of the processing of your personal data.

Objection to processing.- In certain circumstances and on grounds relating to your particular situation, you may object to the processing of your data. ABBA will cease processing the data unless there are compelling legitimate grounds, or for the establishment, exercise or defence of legal claims.

Right to data portability.- This means you have the right to receive the personal data concerning you, which you have provided to a data controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller.

These rights may be exercised by means of a written and signed request addressed to ABBA Hoteles, S.A., Emilio Arrieta, 25 - 31002 Pamplona, or via email at: abbahoteles @ abbahoteles.com

What happens if I do not provide the requested data?

The identification data relating to the client/user, as well as other contact details and any other data required under applicable regulations, must be provided, and failure to do so may make it impossible to access the service. All other data requested are voluntary, and failure to provide them will not prevent the establishment of a contractual relationship.

Supervision by the supervisory authorities.

If you consider it appropriate, you may seek the protection of the Spanish Data Protection Agency by lodging a formal complaint. www.agpd.es. C/ Jorge Juan nº 6 28001 Madrid.

Security measures.

ABBA has adopted the legally required levels of security for the protection of personal data and has implemented all technical means and measures within its reach to prevent the loss, misuse, alteration, unauthorised access or theft of the personal data provided to ABBA. However, users should be aware that security measures on the internet are not infallible.

Revised version, January 2023.

PRIVACY POLICY/HOTEL ACCOMMODATION.

Below we inform you of the data processing carried out at the Hotel where you have stayed, or where you have contracted a service, whose company name was provided to you in the basic information supplied at the time of check-in (‘Hotel’) or at the time of contracting.

You will find a full list of the company names of the different establishments within the Chain at the end of this document.

For what general purposes will we process your personal data?

To enable the provision of the contracted services.
Administrative management of the contracted services.
Management of information relating to your reservation prior to your arrival.
Where applicable, to enable the sending of information, offers and promotions by abba Hoteles, S.A., including by electronic means, regarding the abba Chain and its various establishments.
To enable the management of your benefits as a member of the abbantage programme.
To ensure the security of property and/or persons through the hotel’s video surveillance system.
To manage business relationships with clients and/or suppliers.
To respond to queries or suggestions for quality control purposes.
To create customer profiles based on the services contracted in order to offer services, offers or promotions that may be of interest to you, based on your characteristics.
To comply with legal obligations relating to guest registration forms and the maintenance of the travellers’ register.

What is the legal basis for processing your data?

To enable the provision of the contracted services: performance of the contract.
Administrative management of the contracted services, including the sharing of certain data with establishments within the Chain to simplify the check-in process: legitimate interest in the internal management of the hotel and the improvement of the services provided.
Management of information relating to your reservation prior to your arrival: performance of the contract.
Where applicable, to enable the sending of information, offers and promotions by abba Hoteles, S.A., including by electronic means, regarding the abba Chain and its various establishments: consent/Article 21.1 of the LSSI.
To enable the management of your benefits as a member of the abbantage programme: performance of the contract.
To ensure the security of property and/or persons through the hotel’s video surveillance system: task carried out in the public interest.
To manage business relationships with clients and/or suppliers: legitimate interest in the administrative management of the hotel.
To respond to queries or suggestions for quality control purposes: legitimate interest of the hotel in improving customer satisfaction.
To create customer profiles based on the services contracted in order to offer services, offers or promotions that may be of interest to you, based on your characteristics: this processing is considered to be carried out on the basis of the Hotel’s legitimate interest in direct marketing aimed at increasing sales of its services.

This processing is considered to be carried out on the basis of that legitimate interest, having balanced such interest against the client’s fundamental rights and freedoms. This is justified both by the type of data processed and the level of detail of the profile (name and surname of the client, number of nights, board basis, price paid, type of room reserved, arrival and departure dates), as well as its scope and the consequences of the profile created, namely the offering of services by the Hotel, which we consider to fall within the reasonable expectations of the client. In no case does the processing described produce legal effects or discrimination.

To comply with legal obligations relating to guest registration forms and the maintenance of the travellers’ register: Article 25 of Organic Law 4/2015 of 30 March on the protection of public security.

How long will we retain your data?

For the provision of the contracted services: for the duration of the provision of the contracted services and, once completed, for the legally established periods for accounting purposes or until any potential liabilities arising from the provision of the services have expired.
Administrative management of the contracted services: for the duration of the provision of the contracted services and, once completed, for the legally established periods for accounting purposes or until any potential liabilities arising from the provision of the services have expired.
Sharing certain data with establishments within the Chain to simplify the check-in process: until you indicate otherwise.
Management of information relating to your reservation prior to your arrival: for the duration of the provision of the contracted services and, once completed, for the legally established periods for accounting purposes or until any potential liabilities arising from the provision of the services have expired.
Sending of information, offers and promotions by abba Hoteles, S.A., including by electronic means, regarding the abba Chain and its various establishments: until you indicate otherwise using the mechanisms provided in each communication.
To enable the management of your benefits as a member of the abbantage programme: while the loyalty programme remains active or until you cancel your membership.
To ensure the security of property and/or persons through the hotel’s video surveillance system: task carried out in the public interest. A maximum of 30 days.
To manage business relationships with clients and/or suppliers: for the duration of the provision of the contracted services and, once completed, for the legally established periods for accounting purposes or until any potential liabilities arising from the provision of the services have expired.
To respond to queries or suggestions for quality control purposes: until the reported issue has been resolved.
To create customer profiles based on the services contracted in order to offer services, offers or promotions that may be of interest to you, based on your characteristics: this processing is considered to be carried out on the basis of the Hotel’s legitimate interest in direct marketing aimed at increasing sales of its services. For as long as considered necessary or, in any event, until you indicate otherwise.
To comply with legal obligations relating to guest registration forms and the maintenance of the travellers’ register: three years from the end of the service or contracted provision.

To whom will your data be disclosed?

As a general rule, the only disclosures envisaged are those required by law (such as the communication of guest data to police authorities in accordance with Organic Law 4/2015 of 30 March on the protection of public security), as well as any others that may be legally required, for example to the Spanish Tax Agency (AEAT).

In addition, data may be shared between the establishment and abba Hoteles, S.A. or other establishments within the Chain, in order to enable the management of the abbantage programme or to simplify the check-in process once you have stayed at one of our establishments.

Where you have authorised it, your contact details may be shared with abba Hoteles, S.A. in order to enable the sending of communications about abba Hoteles, S.A. and the other hotels within the Chain.

In addition to the above, third-party data processors may have access to your data.

What are your rights when you provide us with your data?

While the Hotel processes your personal data, you have the right to request:

Access.- You have the right to obtain confirmation from the data controller as to whether or not personal data concerning you are being processed, as well as detailed information about certain aspects of the processing being carried out.
Rectification.- You have the right to obtain the rectification of inaccurate personal data concerning you or to have incomplete data completed.
Erasure.- You have the right to request the erasure of your personal data; in any case, such erasure will be subject to the limits established by the applicable regulations.
Restriction of processing.- You have the right to request the restriction of the processing of your personal data.
Objection to processing.- In certain circumstances and on grounds relating to your particular situation, you may object to the processing of your data. The Hotel will cease processing the data unless there are compelling legitimate grounds, or for the establishment, exercise or defence of legal claims.
Right to data portability.- This means you have the right to receive the personal data concerning you, which you have provided to a data controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller.

These rights may be exercised by means of a written and signed request addressed to the hotel where you have stayed, to ABBA Hoteles, S.A., Emilio Arrieta, 25 - 31002 Pamplona, or via email at: abbahoteles @ abbahoteles.com.

What happens if I do not provide the requested data?

Supervision by the supervisory authorities.

If you consider it appropriate, you may seek the protection of the Spanish Data Protection Agency by lodging a formal complaint. www.agpd.es. C/ Jorge Juan nº 6 28001 Madrid.

Security measures.

The Hotel has adopted the legally required levels of security for the protection of personal data and has implemented all technical means and measures within its reach to prevent the loss, misuse, alteration, unauthorised access or theft of the personal data provided to ABBA. However, users should be aware that security measures on the internet are not infallible.

List of establishments within the Chain:

HOTEL BALMORAL - ESVO, SA

ABBA BURGOS - HOTISUELA, SL

ABBA COMILLAS - CARRICAO, SL

ABBA APARTAMENTOS COMILLAS GOLF - ROVACIAS, SL

ABBA EUSKALDUNA HOTEL - HOTEL LAGOMAR SL

ABBA FONSECA - SALAMO HOTEL, S.L

ABBA GARDEN - HOTEL ZIRI SL

ABBA HUESCA - BISQUE 2016 SL

ABBA JAZZ - MIVIRAL, SL

ABBA MADRID - CULMINA PROJECT, SL

ABBA SUITES PLAYA DEL CARMEN - TEN SMILES MANAGEMENT SA DE CV

ABBA PALACIO SOÑANES - PALACIO DE SOÑANES, SL

ABBA PLAYA GIJÓN - Mauna 2016 SL

ABBA PRESIDENTE SUITES PUERTO MONTT - D.PORTALES SpA

ABBA PRESIDENTE SUITES SANTIAGO - L.THAYER SpA

ABBA RAMBLA - ARANEKO 2011, SL

ABBA SAN SEBASTIAN - SPARTA HOTEL SL

ABBA APARTMENTS - PLAYA DE GROS - SANSE RENTAL SL

ABBA SANTANDER - HOTEL EL ARENAL DE SANTANDER, SL

ABBA SANTS - HOTELAMA, SL

ABBA SEVILLA - SKYNET HOTEL SL

ABBA SUITES BILBAO CITY CENTER - BELONA RECURSOS SL

ABBA ORDINO BABOT - PERE BABI PICOLO

ABBA XALET SUITES - HRT,S.L.

Revised version, December 2024.