Privacy Policy
Our goal is to be as transparent as possible with our users and clients regarding the personal data we collect. Your privacy is important to us.
By reading this Privacy Policy, the user is informed about how MUGA HOLIDAYS collects, processes and protects the personal data provided through the website – https://www.xonshotels.com (hereinafter, the website), as well as any other data that may be provided to MUGA HOLIDAYS in the future by other means.
The user must read this Privacy Policy carefully, which has been drafted in a clear and simple manner to facilitate its understanding, and freely and voluntarily determine whether they wish to provide their personal data to MUGA HOLIDAYS.
By completing any form on the corporate website and clicking the checkbox “I have read the Privacy Policy” or similar, the user expressly declares that they have read this Privacy Policy, which sets out the data processing activities carried out and their purposes, among other information, thereby fulfilling the duty to inform required by data protection regulations.
Where the corporate website requests consent for a specific purpose, by clicking the checkbox “I Accept” or similar, or selecting the corresponding checkbox, the user gives their unequivocal and explicit consent to the processing of the relevant data.
Who is responsible for processing your data?
- Identity: MUGA HOLIDAYS, S.A. – NIF: A17069378
- Address: Pg. Pompeu Fabra S/N -17487 Empuriabrava (Girona)
- Telephone: 972450136
- Email: xhugas@empuriagrup.com
Processing of DATA collected through the WEBSITE
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to handle their request and, where applicable, send them information about our products or services.
The website also has a user support chat service that incorporates artificial intelligence functionalities to generate responses to the enquiries submitted. The personal data that the user voluntarily provides through the chat will be processed for the purpose of managing and responding to their enquiry. The use of this system does not involve automated decision-making that produces legal effects for the user or similarly significantly affects them.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept until the data subject requests its deletion or for as long as the commercial relationship lasts, always respecting the applicable limitation periods for liabilities.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Consent of the data subject (by checking the corresponding checkbox): Sending promotional communications, including by electronic means. (GDPR, Art. 6.1.a, LSSICE Art. 21).
Who will your data be disclosed to?
Data will not be disclosed to third parties, except where legally required.
Are your data transferred to third countries?
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves or their legal representative.
Processing of DATA for STAFF SELECTION
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to manage the CVs received and carry out staff selection processes, interviews and other procedures necessary to find the best possible candidate for a specific position. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept for two years from the last interaction, unless the data subject withdraws their consent before the maximum retention period expires.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Performance of a contract or pre-contractual measures: Management of CVs submitted by candidates in order to carry out staff selection processes and find the best possible candidate for a specific position. (GDPR Art. 6.1.b).
Who will your data be disclosed to?
Data will not be disclosed to third parties, except where legally required.
Are your data transferred to third countries?
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves or their legal representative.
Processing of IMAGES FOR PROMOTIONAL PURPOSES
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to capture, disseminate and assign rights to images and/or videos for promotional purposes, for publication on the Internet (social networks, video platforms and websites), in the entity’s publications and through other communication media. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept until the data subject requests its deletion.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Consent of the data subject: Capture, dissemination and assignment of rights to images and/or videos for promotional purposes, for publication on social networks, video platforms and websites, as well as in the entity’s publications and through other communication media. (GDPR Art. 6.1.a).
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- Internet (social networks, video platforms and websites), the entity’s website and other communication media, for the purpose of assigning rights to and publishing images and/or videos for promotional purposes.
Are your data transferred to third countries?
The following transfers to third countries are envisaged:
- Social networks and promotional distribution systems, for the purpose of promoting the entity’s services. The safeguard established for this transfer is: explicit consent from the data subject. Additional information can be found in the entity’s Privacy Policy.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the data subject themselves.
Processing of DATA of LOYALTY CLUB MEMBERS
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to manage their registration, membership status and participation in the loyalty club, apply and manage the advantages, benefits and promotions associated with membership, and handle matters related to cancellation. Likewise, where the data subject has given their consent, we may send them commercial and/or informative communications about our products, services, promotions and benefits. If you do not provide the data necessary to manage membership, we will not be able to process your registration or provide the services associated with the club.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data necessary to manage membership will be kept for as long as the data subject remains a member of the club and, once cancellation has been requested, for the periods necessary to address any potential liabilities arising from the processing. Data processed for sending commercial communications based on consent will be kept until the data subject withdraws such consent.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Performance of a contract or pre-contractual measures: Managing registration and membership of the loyalty club, as well as the advantages, benefits, promotions and other services linked to membership. (GDPR Art. 6.1.b).
- Consent of the data subject: Sending commercial and/or informative communications, including by electronic means, where such consent is required. (GDPR Art. 6.1.a; LSSICE Art. 21).
Who will your data be disclosed to?
Data will not be disclosed to third parties, except where legally required.
Are your data transferred to third countries?
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves through the loyalty club registration form.
Processing of CUSTOMER DATA
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties primarily in order to provide the requested services, as well as to carry out the administrative, accounting and tax management arising from such services or the sale of products and, where applicable, to send commercial communications about our products and services. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept until the data subject requests its deletion and, where applicable, for the years necessary to comply with legal obligations.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Performance of a contract or pre-contractual measures: Provision of the requested services, and tax, accounting and administrative management of customers. (GDPR Art. 6.1.b).
- Legitimate interest of the Controller: Sending promotional communications, including by electronic means. (GDPR Recital 47, LSSICE Art. 21.2).
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- Tax Administration, in order to comply with legal obligations (legal requirement).
- Financial institutions, in order to process the corresponding direct debits (contractual requirement).
Transfers of data to third countries
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves or their legal representative.
Processing of DATA of POTENTIAL CUSTOMERS and CONTACTS
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to manage potential customers who have shown an interest in our products and/or services, as well as other business contacts and, where applicable, send promotional communications, including by electronic means. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept until the data subject requests its deletion.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Performance of a contract or pre-contractual measures: Management of potential customers who have shown an interest in our products and/or services. (GDPR, Art. 6.1.b).
- Consent of the data subject: Sending promotional communications, including by electronic means. (GDPR, Art. 6.1.a, LSSICE Art. 21).
- Legitimate interest of the Controller: Management of professional contact details (LOPDGDD Art. 19, GDPR Art. 6.1.f).
Who will your data be disclosed to?
Data will not be disclosed to third parties, except where legally required.
Are your data transferred to third countries?
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the data subject themselves.
Processing of VIDEO SURVEILLANCE DATA (security)
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information obtained through the video surveillance system in order to guarantee the security of people, property and facilities, using the controller’s video surveillance systems for this purpose.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept for a maximum of 30 days, except where it is disclosed to law enforcement authorities and/or courts.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Public interest mission: Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Art. 6.1.e), as set out in the “Guide on the use of video cameras for security and other purposes”, published by the Spanish Data Protection Agency.
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- Where applicable, State law enforcement authorities, as well as courts and tribunals, in order to provide images if a criminal offence has been committed (legal requirement).
Transfers of data to third countries
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the data subject themselves.
Processing of DATA of the parties involved in the PROTOCOL FOR THE PREVENTION OF SEXUAL HARASSMENT OR HARASSMENT BASED ON SEX
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to manage the protocol for the prevention of sexual harassment or harassment based on sex; regulate the procedure, manage complaints, collect personal data and conduct interviews with the parties concerned. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be deleted after two years, unless it is necessary to retain it to determine any potential liabilities that may arise from claims made by those affected.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Compliance with a legal obligation: Organic Law 3/2007 of 22 March on effective equality between women and men (Art. 48); Royal Decree 901/2020 of 13 October; Law 31/1995 of 8 November on the Prevention of Occupational Risks (Art. 14).
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- State law enforcement authorities; judicial bodies; Public Prosecutor’s Office, for the purpose of reporting the commission of a possible offence (legal requirement).
Transfers of data to third countries
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the complaint submitted by the person who has suffered the harassment or by other persons.
The categories of data processed are:
- Identification data.
The following categories of special data are processed: health data.
Processing of SUPPLIER DATA
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to carry out the tax, accounting and administrative management of suppliers, as well as professional contact details. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept until the data subject requests its deletion and, where applicable, for the years necessary to comply with legal obligations.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Performance of a contract or pre-contractual measures: Carrying out the administrative, accounting and tax management of contracted services. (GDPR Art. 6.1.b).
- Legitimate interest of the Controller: Management of professional contact details. (LOPDGDD Art. 19, GDPR Art. 6.1.f).
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- Tax Administration, in order to comply with legal obligations (legal requirement).
- Financial institutions, in order to make the corresponding payments (contractual requirement).
Transfers of data to third countries
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the data subject themselves.
Processing of TRAVELLER REGISTRATION DATA
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to manage the registration book and traveller registration forms at accommodation establishments and communicate them to State law enforcement authorities. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept for three years in order to comply with legal obligations.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Compliance with a legal obligation: Organic Law 4/2015 of 30 March on the protection of public security; Order INT/321/2021 of 31 March amending Order INT/1922/2003 of 3 July on registration books and traveller registration forms at accommodation establishments and other similar establishments, regarding documentary registration obligations; GDPR Art. 6.1.c.
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- State law enforcement authorities, in order to comply with legal obligations (legal requirement).
Transfers of data to third countries
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the data subject themselves.
Processing of DATA for the EXERCISE OF DATA SUBJECT RIGHTS
For what purposes do we process your personal data?
At MUGA HOLIDAYS, we process the information provided by interested parties in order to manage and respond to requests from data subjects exercising the rights established under data protection regulations. If you do not provide your personal data, we will not be able to fulfil the purposes described.
No automated decisions will be made based on the data provided.
How long will we keep your data?
The data will be kept for the time necessary to resolve the requests and for at least three years in order to address potential claims.
What is the legal basis for processing your data?
We indicate below the legal basis for processing your data:
- Compliance with a legal obligation: managing and responding to requests from data subjects exercising the rights established under data protection regulations (GDPR, Art. 6.1.b).
Who will your data be disclosed to?
The data will be disclosed to the following recipients:
- Supervisory authorities, public administration bodies and the Ombudsman, where applicable, for the purpose of managing and responding to requests and potential complaints (legal requirement).
Transfers of data to third countries
No transfers to third countries are envisaged.
How did we obtain your data?
The personal data we process at MUGA HOLIDAYS comes from: the data subject themselves.
DATA SUBJECT RIGHTS
What are your rights when you provide us with your data?
Everyone has the right to obtain confirmation as to whether or not MUGA HOLIDAYS is processing personal data concerning them.
Data subjects have the right to access (Art. 15 GDPR) their personal data, as well as to request the rectification (Art. 16 GDPR) of inaccurate data or, where applicable, their deletion (Art. 17 GDPR), among other reasons when the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, data subjects may request restriction (Art. 18 GDPR) of the processing of their data, in which case we will only retain it for the exercise or defence of claims.
In certain circumstances and for reasons relating to their particular situation, data subjects may object to the processing (Art. 21 GDPR) of their data. In such cases, MUGA HOLIDAYS will stop processing the data, except where there are compelling legitimate grounds or for the exercise or defence of potential claims.
You also have the right to request data portability (Art. 20 GDPR). This means that you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, so that you can transmit it directly to another entity, where technically feasible.
If you have given your consent for a specific purpose, you have the right to withdraw that consent (Art. 7 GDPR) at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
You may exercise your rights by contacting the controller in person, by post or by email at the email address indicated in the controller’s contact details, by submitting your request. Forms for exercising/requesting rights can be found on the website of the Spanish Data Protection Agency: https://www.aepd.es/reglamento/derechos/index.html#section1
If you believe that your rights regarding the protection of your personal data have been infringed, particularly where you have not received satisfaction when exercising your rights, you may lodge a complaint with the competent data protection supervisory authority by accessing the electronic headquarters of the Spanish Data Protection Agency: https://sedeagpd.gob.es/sede-electronica-web/vistas/infoSede/queSede.jsf
OBLIGATION TO PROVIDE DATA
The data requested in the forms accessible from the MUGA HOLIDAYS Website and, in general, any data requested by the company for the provision of services/sale of products is, as a general rule, mandatory (unless otherwise specified in the required field) in order to fulfil the established purposes. Therefore, if the data is not provided or is not provided accurately, requests may not be processed correctly.
If the data subject provides data relating to third parties, they declare that they have obtained their consent and undertake to provide the data subject, as the holder of such data, with the information contained in this Privacy Policy, releasing MUGA HOLIDAYS from any liability in this regard.
SECURITY MEASURES
Personal data will be processed lawfully, fairly and transparently in relation to the data subject (“lawfulness, fairness and transparency”); collected for specified, explicit and legitimate purposes, and will not be further processed in a manner incompatible with those purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of processing the personal data (while respecting the applicable limitation periods); processed in such a way as to ensure appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organisational measures (“integrity and confidentiality”).
We follow strict criteria when selecting service providers with access to personal data, in order to ensure compliance with their data protection obligations, and we enter into the corresponding data processing agreement with them (Art. 28 GDPR), under which they are required, among other things, to apply appropriate technical and organisational measures; process data in accordance with our instructions; and delete or return the data to us once the provision of services has ended.
Xon’s Club Terms and Conditions
What is Xon’s Club?
Xon’s Club is the name of the Xon’s Hotels loyalty club. Membership of this club is completely voluntary and free of charge and allows members to enjoy exclusive benefits when staying at our hotel.
What benefits do I have as a member of this club?
The benefits included in the Xon’s Club loyalty programme apply exclusively to bookings made through the official Xon’s Hotels websites. You can find details of these benefits on the page https://www.xonshotels.com/signup/
Promotions and benefits apply to the hotels’ standard rates and may not be combined with other available promotions unless otherwise specified.
Xon’s Hotels reserves the right to modify or cancel promotions, benefits and programme terms without prior notice.
How can I become a member of the club?
On the page https://www.xonshotels.com/signup/ you will find an online registration form to become a member of Xon’s Club.
You must be over 18 years of age and have full legal capacity.
The information required to register for the club will be as follows: First and Last Name, Email, Date of Birth and Country of Residence.
Once you have completed the online form, you will receive an email confirming your membership of Xon’s Club.
Registration in the Xon’s Club programme implies the user’s acceptance of these programme terms and conditions.
How can I cancel my membership and what is the privacy policy?
As a member of Xon’s Club, you may cancel your membership at any time through the Xon’s Club user area, which can be accessed from the hotel’s official website or from the corporate website.
Personal data provided when registering will be processed to manage registration, membership status and the user’s participation in Xon’s Club, as well as the benefits, advantages and promotions associated with membership and matters relating to cancellation.
The sending of commercial and/or informative communications by electronic means will not be considered accepted merely by registering for the programme. Where the user’s consent is required for this type of communication, such consent will be requested specifically and separately and may be withdrawn at any time.
For further information about the processing of your personal data, the applicable legal bases, retention periods, recipients, possible international transfers and how to exercise your rights, you can consult the Privacy Policy indicated at the beginning of this page or at this link: https://www.xonshotels.com/politica-de-privacidad/
