Privacy Policy

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Providing the requested services, carrying out the official registration of travellers and sending promotional communications.
• Legitimate Basis: Implementation of a contract. Legitimate interest of the Data Controller. Compliance with a legal obligation.
• Recipients: The following types of data transfers are planned: Tax administration; Financial entities; Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out fiscal, accounting and administrative management of clients, as well as to send promotional communications; management of the registration book and traveller-entry reports at hospitality establishments and their forwarding to National Law-Enforcement Agencies. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data from the traveller registration book will be kept for three years after registration to comply with legal obligations. The fiscal data will be kept until the client requests its deletion, always respecting the terms provided by fiscal legislation regarding the limitation of liability.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Fiscal, accounting and administrative management of clients. (GDPR, Art. 6.1.b).
• Legitimate interest of the Data Controller: Sending promotional communications, including electronically. (GDPR Recital 47, LSSICE Art. 21.2).
• Compliance with a legal obligation: Organic Law 4/2015, of 30 March, on the protection of citizen security; Order INT/1922/2003, of 03 July of the Ministry of the Interior; GDPR, Art. 6.1.c.

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax administration, in order to comply with legal obligations (legal requirement).
• Financial entities, with the purpose of issuing the corresponding receipts (contractual requirement).
• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of facilitating the registration and provision of services to guests previously hosted in one of the group's establishments (contractual requirement).

6. Data transfers to third countries

The following data transfers to third countries are planned:

• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Providing the requested services and sending promotional communications.
• Legitimate Basis: Implementation of a contract. Legitimate interest of the Data Controller.
• Recipients: The following types of data transfers are planned: Tax administration; Financial entities; Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out the administrative, accounting and fiscal management of the requested services, as well as to send promotional communications about our products and services. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion, and, where appropriate, for the years necessary to comply with legal obligations.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Fiscal, accounting and administrative management of clients. (GDPR, Art. 6.1.b).
• Legitimate interest of the Data Controller: Sending promotional communications, including electronically. (GDPR Recital 47, LSSICE Art. 21.2).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax administration, in order to comply with legal obligations (legal requirement).
• Financial entities, with the purpose of issuing the corresponding receipts (contractual requirement).
• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of facilitating the registration and provision of services to guests previously hosted in one of the group's establishments (contractual requirement).

6. Data transfers to third countries

The following data transfers to third countries are planned:

• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Carrying out a preliminary evaluation of your health status.
• Legitimate Basis: Implementation of a contract. Consent of the interested party.
• Recipients: No data will be transferred to third parties, except under legal obligation.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out a preliminary evaluation of their health status to detect possible problems and/or circumstances that require special attention before starting health treatment. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for a maximum of five years to respond to any possible claims.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Carrying out a preliminary evaluation of your health status to detect possible problems and/or circumstances that require special attention before starting health treatment. (GDPR 6.1.b)
• Consent of the interested party: Processing the health data necessary for the provision of services. (GDPR Art. 9.2.a).

5. To which recipients will your data be communicated?

No data will be transferred to third parties, except under legal obligation.

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Managing the labour relationship
• Legitimate Basis: Implementation of a contract. Compliance with a legal obligation.
• Recipients: The following types of data transfers are planned: Tax administration, Social and mutual security; Banks and financial entities; State foundation for employment training (Fundae).
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out personnel management; training; prevent occupational risks and ensure health surveillance; prepare payrolls, social insurance and social-security contributions; and record working hours and work accidents, if applicable. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

As long as the employment relationship with the entity is maintained and throughout the years necessary to comply with legal obligations.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Personnel management, training and training. (GDPR, Art. 6.1.b).
• Compliance with a legal obligation: Prevention of occupational risks and health surveillance; preparation of payrolls, social insurance and social security contributions; working-hour registration; management of work accidents, if applicable. (Law 31/1995, of 08 November, on the prevention of Occupational Risks; Royal Legislative Decree 2/2015, of 23 October, which approves the consolidated text of the Worker’s Statute Act; Royal Legislative Decree 8/2015, of 30 October, which approves the consolidated text of the General Social Security Act; Royal Decree-Law 8/2019, of 08 March, on urgent measures for social protection and the fight against job insecurity during the working day; GDPR, Arts. 6.1.c and 9.2.b). Royal Decree 902/2020, of 13 October, on equal pay between women and men.

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax Administration, Social and Mutual Security, with the purpose of presenting taxes and obligations related to social insurance (legal requirement).
• Banks and financial entities, for the purpose of making payroll payments (contractual requirement).
• State foundation for employment training (Fundae), with the purpose of managing the employee-training bonus (contractual requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: To offer nutritional information on foods that are presented unpackaged
• Legitimate Basis: Compliance with a legal obligation. Mission in the public interest.
• Recipients: No data will be transferred to third parties, except under legal obligation.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.
   

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to offer nutritional information on foods that are presented unpackaged for sale to the final consumer in relation to allergen content, as well as for the management of guest food intolerances. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for the duration of the service offered to the consumer.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Compliance with a legal obligation: Regulation (EU) 1169/2011, of 25 October 2011, on nutritional information provided to consumers; Royal Decree 126/2015, of 27 February, which approves the general rule regarding nutritional information for foods that are presented unpackaged for sale to the final consumer; (GDPR, Art. 6.1.c).
• Mission in the public interest: The processing is necessary for reasons of essential public interest, on the basis of Union or Member-State Law (GDPR, Art. 9.2.g)

5. To which recipients will your data be communicated?

No data will be transferred to third parties, except under legal obligation.

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data controller: CASTILLA TERMAL
• Purpose: Carrying out staff-selection procedures.
• Legitimate basis: Implementation of a contract.
• Recipients: The following types of data transfers are planned: Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.).
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to manage the Curriculum Vitae received and to carry out the staff-selection processes, interviews and other procedures necessary to search for the best possible candidate for a specific job position. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

Two years from the last interaction.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Management of the Curriculum Vitae delivered by the candidate to carry out the staff-selection processes to search for the best possible candidate for a given job position.  (GDPR, Art. 6.1.b).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of managing the employment pool of candidates for a job for the group companies

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Responding to your request and sending you promotional communications
• Legitimate Basis: Implementation of a contract. Consent of the interested party. Legitimate interest of the Data Controller.
• Recipients: The following types of data transfers are planned: Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to manage potential clients who are interested in our products and/or services, as well as other commercial contacts and, where appropriate, to send promotional communications, including electronically. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Management of potential clients who have been interested in our products and/or services. (GDPR, Art. 6.1.b).
• Consent of the interested party: Sending promotional communications, including electronically. (GDPR, Art. 6.1.a, LSSICE Art.21).
• Legitimate interest of the Data Controller: Management of professional contact data (LOPDGDD Art.19, GDPR Art. 6.1.f).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of sending marketing campaigns for the services offered by all the establishments of the group via email (consent of the interested party).

6. Data transfers to third countries

The following data transfers to third countries are planned:

• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Managing the provision of contracted services.
• Legitimate Basis: Implementation of a contract. Legitimate interest of the Data Controller.
• Recipients: The following types of data transfers are planned: Tax administration; Financial entities.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to carry out fiscal, accounting and administrative management of suppliers, as well as to manage professional contact information. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion, and, where appropriate, for the years necessary to comply with legal obligations.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Implementation of a contract: Carrying out the administrative, accounting and fiscal management of the contracted services. (GDPR, Art. 6.1.b).
• Legitimate interest of the Data Controller: Management of professional contact data. (LOPDGDD Art.19, GDPR Art. 6.1.f).

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Tax administration, in order to comply with legal obligations (legal requirement).
• Financial entities, with the purpose of making the corresponding payments (contractual requirement).

6. Data transfers to third countries

Data transfers to third countries are not foreseen.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: Sending you our newsletter and other promotional communications of interest.
• Legitimate Basis: Consent of the interested party.
• Recipients: The following types of data transfers are planned: Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.). Transfers to third countries are planned.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to send our newsletter and other promotional communications of interest to its subscribers. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data will be kept for as long as the interested party does not request its deletion.

4. What is the legal basis for the processing of your data?

We express the legal basis for the processing of your data:

• Consent of the interested party: sending our newsletter and other promotional communications of interest to its subscribers (GDPR, Art. 6.1.a, and LSSICE Art. 21)

5. To which recipients will your data be communicated?

The data will be sent to the following recipients:

• Group hotels (CASTILLA TERMAL; HOTEL AGUA DE VALBUENA, S.L.; HOTEL BURGO DE OSMA, S.A.; BALNEARIO DE SOLARES, S.L.; ALCARRIA TERMAL, S.L.; GRUPO OLMEDO HOTELES, S.L.), with the purpose of facilitating the registration and provision of services to guests previously hosted in one of the group's establishments (contractual requirement)

6. Data transfers to third countries

The following data transfers to third countries are planned:

• The Rocket Science Group, LLC (MailChimp), for the purpose of sending marketing campaigns by email. The guarantee for this transfer has been established through: Data-protection clauses. You can consult additional information at: https://mailchimp.com/es/legal/data-processing-addendum/.
• TravelClick, Inc., for the purpose of hosting hospitality-management applications and data. The guarantee for this transfer has been established through: Data-protection clauses. Additional information can be found at: https://www.amadeus-hospitality.com/privacy-policy/.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation on whether we at CASTILLA TERMAL are or are not processing personal data that concerns them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to the portability of your data.

In certain circumstances, the interested parties may request the limitation of processing of their data, in which case we will only keep them for the exercise of or defence against claims.

In certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, CASTILLA TERMAL will stop processing the data, except in the case of compelling legitimate reasons, or the exercise of or defence against possible claims.

You can materially exercise your rights by contacting: protecciondedatos@castillatermal.com.

When the sending of commercial communications is carried out using the legitimate interest of the data controller as a legal basis, the interested party may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw the consent granted at any time, without it affecting the legality of the processing based on the consent prior to its withdrawal.

In the event that you feel your rights have been violated regarding the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the competent Data-Protection Supervisory Authority via its website: www.aepd.es.

8. How have we obtained your data?

The personal data that we process at CASTILLA TERMAL comes from: The interested party.

BASIC INFORMATION REGARDING DATA PROTECTION

• Data Controller: CASTILLA TERMAL
• Purpose: To guarantee the security of people, goods and facilities.
• Legitimate Basis: Mission in the public interest.
• Recipients: The following types of data transfers are planned: Where appropriate, to National Law-Enforcement Agencies, as well as to Courts and Tribunals.
• Rights: You have the right to access, rectify and delete the data, as well as other rights indicated in the additional information, which you can exercise by contacting: protecciondedatos@castillatermal.com.
• Origin: The interested party.

COMPLETE INFORMATION REGARDING DATA PROTECTION

1. Who is the data controller for your data?

CASTILLA TERMAL

protecciondedatos@castillatermal.com

1.1. Contact details for the Data-Protection Officer (DPO):

CONSTRUYENDO FUTURO INFORMATICO, S.L.

protecciondedatos@castillatermal.com

2. For what purpose do we process your personal data?

At CASTILLA TERMAL, we process the information provided to us by interested parties in order to guarantee the security of people, goods and facilities using video-surveillance systems. If you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

3. For how long will we keep your data?

The data shall be kept for a maximum of 30 d