Privacy Policy

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Providing the requested services, carrying out the official registration of travellers and sending promotional communications.
• Legitimate Basis: Implementation of a contract. Legitimate interest of the Data Controller. Compliance with a legal obligation.
• Recipients: The following types of data transfers are planned: Tax administration; Financial entities; Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out fiscal, accounting and administrative management of clients, as well as to send promotional communications; management of the registration book and traveller-entry reports at hospitality establishments and their forwarding to National Law-Enforcement Agencies. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data from the traveller registration book will be kept for three years after registration to comply with legal obligations. The fiscal data will be kept until the client requests its deletion, always respecting the terms provided by fiscal legislation regarding the limitation of liability.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Fiscal, accounting and administrative management of clients. (GDPR, Art. 6.1.b).
• Legitimate interest of the Data Controller: Sending promotional communications, including electronically. (GDPR Recital 47, LSSICE Art. 21.2).
• Compliance with a legal obligation: Organic Law 4/2015, of 30 March, on the protection of citizen security; Order INT/1922/2003, of 03 July of the Ministry of the Interior; GDPR, Art. 6.1.c.

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax administration, in order to comply with legal obligations (legal requirement).
• Financial entities, with the purpose of issuing the corresponding receipts (contractual requirement).
• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of facilitating the registration and provision of services to guests previously hosted in one of the group's establishments (contractual requirement).

6. Data transfers to third countries

The following data transfers to third countries are planned:

• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Providing the requested services and sending promotional communications.
• Legitimate Basis: Implementation of a contract. Legitimate interest of the Data Controller.
• Recipients: The following types of data transfers are planned: Tax administration; Financial entities; Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out the administrative, accounting and fiscal management of the requested services, as well as to send promotional communications about our products and services. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion, and, where appropriate, for the years necessary to comply with legal obligations.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Fiscal, accounting and administrative management of clients. (GDPR, Art. 6.1.b).
• Legitimate interest of the Data Controller: Sending promotional communications, including electronically. (GDPR Recital 47, LSSICE Art. 21.2).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax administration, in order to comply with legal obligations (legal requirement).
• Financial entities, with the purpose of issuing the corresponding receipts (contractual requirement).
• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of facilitating the registration and provision of services to guests previously hosted in one of the group's establishments (contractual requirement).

6. Data transfers to third countries

The following data transfers to third countries are planned:

• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Carrying out a preliminary evaluation of your health status.
• Legitimate Basis: Implementation of a contract. Consent of the interested party.
• Recipients: No data will be transferred to third parties, except under legal obligation.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out a preliminary evaluation of their health status to detect possible problems and/or circumstances that require special attention before starting health treatment. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for a maximum of five years to respond to any possible claims.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Carrying out a preliminary evaluation of your health status to detect possible problems and/or circumstances that require special attention before starting health treatment. (GDPR 6.1.b)
• Consent of the interested party: Processing the health data necessary for the provision of services. (GDPR Art. 9.2.a).

5. To which recipients will your data be communicated?

No data will be transferred to third parties, except under legal obligation.

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Managing the labour relationship
• Legitimate Basis: Implementation of a contract. Compliance with a legal obligation.
• Recipients: The following types of data transfers are planned: Tax administration, Social and mutual security; Banks and financial entities; State foundation for employment training (Fundae).
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out personnel management; training; prevent occupational risks and ensure health surveillance; prepare payrolls, social insurance and social-security contributions; and record working hours and work accidents, if applicable. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

As long as the employment relationship with the entity is maintained and throughout the years necessary to comply with legal obligations.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Personnel management, training and training. (GDPR, Art. 6.1.b).
• Compliance with a legal obligation: Prevention of occupational risks and health surveillance; preparation of payrolls, social insurance and social security contributions; working-hour registration; management of work accidents, if applicable. (Law 31/1995, of 08 November, on the prevention of Occupational Risks; Royal Legislative Decree 2/2015, of 23 October, which approves the consolidated text of the Worker’s Statute Act; Royal Legislative Decree 8/2015, of 30 October, which approves the consolidated text of the General Social Security Act; Royal Decree-Law 8/2019, of 08 March, on urgent measures for social protection and the fight against job insecurity during the working day; GDPR, Arts. 6.1.c and 9.2.b). Royal Decree 902/2020, of 13 October, on equal pay between women and men.

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax Administration, Social and Mutual Security, with the purpose of presenting taxes and obligations related to social insurance (legal requirement).
• Banks and financial entities, for the purpose of making payroll payments (contractual requirement).
• State foundation for employment training (Fundae), with the purpose of managing the employee-training bonus (contractual requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: To offer nutritional information on foods that are presented unpackaged
• Legitimate Basis: Compliance with a legal obligation. Mission in the public interest.
• Recipients: No data will be transferred to third parties, except under legal obligation.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.
   

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to offer nutritional information on foods that are presented unpackaged for sale to the final consumer in relation to allergen content, as well as for the management of guest food intolerances. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for the duration of the service offered to the consumer.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Compliance with a legal obligation: Regulation (EU) 1169/2011, of 25 October 2011, on nutritional information provided to consumers; Royal Decree 126/2015, of 27 February, which approves the general rule regarding nutritional information for foods that are presented unpackaged for sale to the final consumer; (GDPR, Art. 6.1.c).
• Mission in the public interest: The processing is necessary for reasons of essential public interest, on the basis of Union or Member-State Law (GDPR, Art. 9.2.g)

5. To which recipients will your data be communicated?

No data will be transferred to third parties, except under legal obligation.

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data controller: CASTILLA TERMAL
• Purpose: Carrying out staff-selection procedures.
• Legitimate basis: Implementation of a contract.
• Recipients: The following types of data transfers are planned: Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.).
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to manage the Curriculum Vitae received and to carry out the staff-selection processes, interviews and other procedures necessary to search for the best possible candidate for a specific job position. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

Two years from the last interaction.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Management of the Curriculum Vitae delivered by the candidate to carry out the staff-selection processes to search for the best possible candidate for a given job position.  (GDPR, Art. 6.1.b).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of managing the employment pool of candidates for a job for the group companies

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Responding to your request and sending you promotional communications
• Legitimate Basis: Implementation of a contract. Consent of the interested party. Legitimate interest of the Data Controller.
• Recipients: The following types of data transfers are planned: Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to manage potential clients who are interested in our products and/or services, as well as other commercial contacts and, where appropriate, to send promotional communications, including electronically. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Management of potential clients who have been interested in our products and/or services. (GDPR, Art. 6.1.b).
• Consent of the interested party: Sending promotional communications, including electronically. (GDPR, Art. 6.1.a, LSSICE Art.21).
• Legitimate interest of the Data Controller: Management of professional contact data (LOPDGDD Art.19, GDPR Art. 6.1.f).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of sending marketing campaigns for the services offered by all the establishments of the group via email (consent of the interested party).

6. Data transfers to third countries

The following data transfers to third countries are planned:

• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Managing the provision of contracted services.
• Legitimate Basis: Implementation of a contract. Legitimate interest of the Data Controller.
• Recipients: The following types of data transfers are planned: Tax administration; Financial entities.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out fiscal, accounting and administrative management of suppliers, as well as to manage professional contact information. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion, and, where appropriate, for the years necessary to comply with legal obligations.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Carrying out the administrative, accounting and fiscal management of the contracted services. (GDPR, Art. 6.1.b).
• Legitimate interest of the Data Controller: Management of professional contact data. (LOPDGDD Art.19, GDPR Art. 6.1.f).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax administration, in order to comply with legal obligations (legal requirement).
• Financial entities, with the purpose of making the corresponding payments (contractual requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Sending you our newsletter and other promotional communications of interest.
• Legitimate Basis: Consent of the interested party.
• Recipients: The following types of data transfers are planned: Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to send our newsletter and other promotional communications of interest to its subscribers. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Consent of the interested party: sending our newsletter and other promotional communications of interest to its subscribers (GDPR, Art. 6.1.a, and LSSICE Art. 21)

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of facilitating the registration and provision of services to guests previously hosted in one of the group's establishments (contractual requirement)

6. Data transfers to third countries

The following data transfers to third countries are planned:

• The Rocket Science Group, LLC (MailChimp), for the purpose of sending marketing campaigns by email. The guarantee for this transfer has been established through: Data-protection clauses. You can consult additional information at: https://mailchimp.com/es/legal/data-processing-addendum/.
• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: To guarantee the security of people, goods and facilities.
• Legitimate Basis: Mission in the public interest.
• Recipients: The following types of data transfers are planned: Where appropriate, to National Law-Enforcement Agencies, as well as to Courts and Tribunals.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to guarantee the security of people, goods and facilities using video-surveillance systems. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data shall be kept for a maximum of 30 days, except if communicated to National Law-Enforcement Agencies and/or Courts and Tribunals.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Mission in the public interest: Processing necessary for the fulfilment of a mission carried out in the public interest or in the exercise of public powers conferred upon the data controller (GDPR, Art. 6.1.e), as stated in the “Guide to using video cameras for security and other purposes”, published by the Spanish Data-Protection Agency.

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Where appropriate, to National Law-Enforcement Agencies, as well as to Courts and Tribunals, with the purpose of providing images if a crime has been committed (legal requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data controller: CASTILLA TERMAL
• Purpose: Capture and dissemination of images and/or videos for promotional purposes.
• Legitimate Basis: Consent of the interested party.
• Recipients: The following types of data transfers are planned: Via the Internet (social networks, video platforms and websites), the entity's website and other means of communication. Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Offer (DPO):

CONSTRUYENDO FUTURO INFORMÁTICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to capture, disseminate and transfer images and/or videos for promotional purposes for publication on the Internet (social networks, video platforms and websites), in the entity's publications and other media. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Consent of the interested party: Capture, dissemination and transfer of images and/or videos for promotional purposes for publication on social networks, video platforms and websites, as well as in the entity's publications and other media. (GDPR, Art. 6.1.a).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Internet (social networks, video platforms and websites), the entity's website and other media, for the purpose of transferring and publishing images and/or videos for promotional purposes.

6. Data transfers to third countries

The following data transfers to third countries are planned:

• Social networks and promotional dissemination systems, with the purpose of carrying out advertising promotion of the entity's services. The guarantee for this transfer has been established through: Explicit consent from the interested party. You can consult additional information at: The entity’s privacy policy.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Management of the Whistleblowing channel
• Legitimate Basis: Mission in the public interest. Compliance with a legal obligation. Consent of the interested party.
• Recipients: The following types of data transfers are planned: National Law Enforcement Agencies; Jurisdictional Bodies; Public Prosecutor's Office.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: From the complaint filed by the interested parties who maintain a labour, commercial and service-provision relationship with the entity.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to manage the whistleblowing channel, protect the people who report regulatory infractions and fight corruption, with the aim of informing the person responsible for the acts or conduct that occur within the entity or caused by third parties contracted thereby, and that may be contrary to the general or sectoral regulations applicable thereto. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for the time necessary to decide whether or not to launch an investigation into the reported events. The maximum period will be three months from its entry into the system, unless the purpose of its retention serves as evidence of the operation of the prevention model; in this case, the data will be kept in an anonymised format. (LOPDGDD Art. 24.4)

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Mission in the public interest: Control of risks of non-compliance within the organisation; (Organic Law 3/2018, of 05 December, on the Protection of Personal Data and Guarantee of Digital Rights [Preamble V]). Processing of special categories of data contained in the information about the infringement (Law 2/2023, of 20 February, regulating the protection of people who report regulatory infringements and the fight against corruption, Art. 30 and GDPR Art. 9.2.g).
• Compliance with a legal obligation: Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 regarding the protection of persons who report infringements of Union Law (Art. 8; obligation to establish whistleblowing channels). Law 2/2023, of 20 February, regulating the protection of people who report regulatory infractions and the fight against corruption.
• Consent of the interested party: For the retention and registration of complaints made via phone calls and voice-messaging systems with recording. As well as for the recording of the personal meeting requested with the entity for the purpose of reporting. (Directive (EU) 2019/1937; Art. 18.2 and 4)

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• National Law Enforcement Agencies; Jurisdictional Bodies; Public Prosecutor's Office, with the purpose of reporting the commission of a possible crime (legal requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: From the complaint filed by the interested parties who maintain a labour, commercial and service-provision relationship with the entity.

The categories of data that are processed are:

• Identifying data.
• Commercial information.
• Economic data.

The following categories of special data are processed: data relating to health.

BASIC INFOTMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Managing the protocol for the prevention of sexual or gender-based harassment
• Legitimate Basis: Compliance with a legal obligation.
• Recipients: The following types of data transfers are planned: National Law Enforcement Agencies; Jurisdictional Bodies; Public Prosecutor's Office.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: From the complaint filed by the person who has suffered harassment, or by other people.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties for the purpose of managing the protocol for the prevention of sexual or gender-based harassment; regulating the procedure; managing the complaint; and collecting personal data and interviews with the affected parties. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be deleted after two years, unless its retention is necessary to determine the possible liabilities that may arise from possible claims made by those affected.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Compliance with a legal obligation: Organic Law 3/2007, of 22 March, for the effective equality of women and men (Art. 48); Royal Decree 901/2020, of 13 October; Law 31/1995, of 08 November, on the prevention of occupational risks (Art. 14).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• National Law Enforcement Agencies; Jurisdictional Bodies; Public Prosecutor's Office, with the purpose of reporting the commission of a possible crime (legal requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: From the complaint filed by the person who has suffered harassment, or by other people.

The categories of data that are processed are:

• Identifying data.

The following categories of special data are processed: data relating to health.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Managing and responding to requests from interested parties in the exercise of the rights established in data-protection regulations.
• Legitimate Basis: Compliance with a legal obligation.
• Recipients: The following types of data transfers are planned: Supervisory authorities, Public administration bodies and the Ombudsman, where applicable.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1.1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to manage and respond to the requests of interested parties in the exercise of the rights established in the data-protection regulations. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

It will be kept for the time necessary to resolve the requests and for at least three years to respond to any possible claims.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Compliance with a legal obligation: managing and responding to requests from interested parties in the exercise of the rights established in the data-protection regulations (GDPR, Art.6.1.b)

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Supervisory authorities, Public administration bodies and the Ombudsman, where applicable, with the purpose of managing and responding to requests and any possible claims (legal requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.