Privacy policy
Our goal is to be as transparent as possible with our users and customers about the personal data we collect. Your privacy is important to us.
By reading this Privacy Policy, the user is informed about how MUGA HOLIDAYS collects, processes and protects the personal data provided through the website – https://www.xonshotels.com (hereinafter, the website) and any other data that may be provided in the future to MUGA HOLIDAYS by other means.
The User must read this Privacy Policy carefully, which has been drafted in a clear and simple manner to facilitate understanding, and freely and voluntarily decide whether to provide their personal data to MUGA HOLIDAYS.
By filling in any form on the corporate website and clicking the “I have read the privacy policy” or similar box, the user expressly states that they have read this privacy policy, which indicates the data processing carried out and the purposes, among other information, thus complying with the duty to inform imposed by Data Protection regulations.
In those cases where the corporate website requests consent for a specific purpose, by clicking the “I accept” or similar box, or ticking the selection box (check box), the user gives their unequivocal and explicit consent for the data processing in question.
Who is the controller of your data?
- Identity: MUGA HOLIDAYS, S.A. –Tax ID (CIF): A17069378
- Address: Pg. Pompeu Fabra S/N -17487 Empuriabrava (GIRONA)
- Telephone: 972450136
- Email: xhugas@empuriagrup.com
Processing of DATA collected via the WEBSITE
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the information provided by interested parties in order to respond to their request and, where applicable, to send them information about our products or services, as well as our newsletters. No automated decisions will be made based on the data provided.
How long will we keep your data?
Data will be kept until the data subject requests its deletion or for the duration of the commercial relationship, always respecting the limitation periods for liabilities.
What is the legal basis for the processing of your data?
Consent of the data subject (by ticking the selection box or check box): To respond to your request and, where applicable, to send you commercial communications, as well as our newsletters.
To which recipients will your data be disclosed?
Data will not be transferred to third parties, except by legal obligation.
Data transfers to third countries?
No data transfers to third countries are planned.
How have we obtained your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves.
Processing of DATA for STAFF SELECTION
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the information provided by interested parties in order to carry out recruitment processes. No automated decisions will be made based on the data provided.
How long will we keep your data?
Data will be kept for two years, unless the data subject withdraws their consent before the maximum retention period.
What is the legal basis for the processing of your data?
Consent of the data subject: To participate in recruitment processes.
To which recipients will your data be disclosed?
Data will not be transferred to third parties, except by legal obligation.
Data transfers to third countries?
No data transfers to third countries are planned.
How have we obtained your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves or their legal representative.
The categories of data processed are:
- Identification data
- Postal and email addresses
- Professional and academic data
No special categories of personal data are processed (these are data that reveal ethnic or racial origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation).
Processing of IMAGE USE
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the data obtained (image and, where applicable, voice) for the purpose of publishing said images on websites or social networks, as well as in other media such as magazines, publications, etc., to carry out advertising or promotion of our activities. No automated decisions will be made based on the data provided.
How long will we keep your data?
Data will be kept from the moment the user gives their consent until they withdraw that consent.
What is the legal basis for the processing of your data?
Express consent of the data subject: Use of photographs and, where applicable, videos where the image of interested parties appears. It is also informed that by giving consent, the images may be published on the company’s website, social networks and any other medium the company deems appropriate to publicise its activities, events and services.
To which recipients will your data be disclosed?
They will be published on the company’s website and/or social networks or other media.
Data transfers to third countries?
The use of images on social networks may involve international data transfers.
Processing of CUSTOMER DATA
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the information provided by interested parties with the main purpose of providing the requested services, as well as carrying out the administrative, accounting and tax management derived from said services or product sales, and, where applicable, sending commercial communications about our products and services. No automated decisions will be made based on the data provided.
How long will we keep your data?
Data will be kept until the data subject requests its deletion, and if applicable, for the years necessary to comply with legal obligations.
What is the legal basis for the processing of your data?
- Performance of a contract: Provide the requested services
- Legal obligation: Carry out the administrative, accounting and tax management of the requested services
- Legitimate interest of the controller: Send commercial communications about our products and services
To which recipients will your data be disclosed?
Data will be disclosed to the following recipients:
- Tax Agency, for the purpose of complying with legal obligations. (Legal requirement).
- Financial institutions, for the purpose of issuing the corresponding receipts, where applicable. (Contractual requirement)
Data transfers to third countries
No data transfers to third countries are planned.
How have we obtained your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves or their legal representative.
The categories of data processed are:
- Identification data
- Postal and email addresses
- Commercial information
- Banking information, where applicable
Processing of data for ADVERTISING
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the information provided by interested parties in order to manage the sending of commercial communications about our products and/or services by electronic means (e-mail, WhatsApp, SMS…). No automated decisions will be made based on the data provided.
How long will we keep your data?
Data will be kept from the moment the user gives their consent until they withdraw that consent.
What is the legal basis for the processing of your data?
Consent of the data subject (by signing the consent document, ticking or checking the selection box or check box or any other valid means of obtaining it): For sending commercial communications.
To which recipients will your data be disclosed?
Electronic advertising sending platforms, for the purpose of carrying out the sending with guarantees and obtaining statistical data.
Data transfers to third countries?
No data transfers to third countries are planned.
How have we obtained your data?
The personal data we process at MUGA HOLIDAYS comes from the data subject themselves.
The categories of data processed are:
- Identification data and postal and email addresses
- Commercial information.
No special categories of personal data are processed (these are data that reveal ethnic or racial origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation).
Processing of VIDEO SURVEILLANCE data
Basic information on Data Protection
- Controller: MUGA HOLIDAYS
- Purpose: To guarantee the security of people, property and facilities
- Legal basis: Mission in the Public Interest
- Recipients: Data transfers are planned to: Where applicable, the State Security Forces and Bodies, as well as Courts and Tribunals
- Rights: You have the right to access, rectify and delete the data, as well as other rights, indicated in the additional information, which you can exercise by writing to the address of the data controller
Complete information on Data Protection
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the images captured by our cameras in order to guarantee the security of people, property and facilities. No automated decisions will be made based on the data provided.
How long will we keep your data?
Data will be kept for a maximum of 30 days, except in the event of communication to State Security Forces and Bodies, and/or Courts and Tribunals.
What is the legal basis for the processing of your data?
Mission in the Public Interest: To guarantee the security of people, property and facilities.
To which recipients will your data be disclosed?
Where applicable, to the State Security Forces and Bodies, as well as Courts and Tribunals, for the purpose of providing the images if a crime or offence has been committed.
Data transfers to third countries
No data transfers to third countries are planned.
What category of personal data do we process?
Image.
Processing of VISITOR DATA to the FACILITIES
For what purpose do we process your personal data?
At MUGA HOLIDAYS we process the information provided by interested parties for the purpose of registering and managing visits to the controller’s facilities. If you do not provide your personal data, we will not be able to fulfil the purposes described. No automated decisions will be made based on the data provided.
How long will we keep your data?
For four years or until the data subject requests its deletion.
What is the legal basis for the processing of your data? We indicate the legal basis for the processing of your data: Legitimate interest of the controller: Control of entries and exits to the controller’s facilities for security reasons and visit traceability. (GDPR art. 6.1.f).
To which recipients will your data be disclosed?
Data will not be transferred to third parties, except by legal obligation.
Data transfers to third countries
No data transfers to third countries are planned.
How have we obtained your data?
The personal data we process at MUGA HOLIDAYS comes from: The data subject themselves.
The categories of data processed are:
- Identification data.
RIGHTS OF THE DATA SUBJECT
What are your rights when you provide us with your data? Any person has the right to obtain confirmation as to whether or not MUGA HOLIDAYS is processing personal data concerning them.
Data subjects have the right to access (art. 15 GDPR) their personal data, as well as to request the rectification (art. 16 GDPR) of inaccurate data or, where applicable, request its erasure (art. 17 GDPR) when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, data subjects may request the restriction (Art. 18 GDPR) of the processing of their data, in which case we will only keep them for the exercise or defence of claims.
In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing (art. 21 GDPR) of their data. In this case, MUGA HOLIDAYS will stop processing the data, except for compelling legitimate reasons or the exercise or defence of possible claims.
You will also have the right to request the portability (art. 20 GDPR) of your personal data. This means you will have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, in order to transmit it to another entity directly, whenever technically possible.
If you have given your consent for a specific purpose, you have the right to withdraw your consent (art. 7 GDPR) at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
You may exercise your rights by contacting the controller in person, by post or by email to the controller’s email address, sending the application/request. The forms for the exercise/request of rights can be found on the website of the Spanish Data Protection Agency: https://www.aepd.es/reglamento/derechos/index.html#section1
If you feel that your rights concerning the protection of your personal data have been violated, especially when you have not obtained satisfaction in the exercise of your rights, you may file a claim with the competent Data Protection Supervisory Authority, accessing the electronic office of the Spanish Data Protection Agency: https://sedeagpd.gob.es/sede-electronica-web/vistas/infoSede/queSede.jsf
MANDATORY NATURE OF PROVIDING DATA
The data requested in the forms accessible from the MUGA HOLIDAYS Website and, in general, those requested by the company for the provision of the service/product sale, are, as a general rule, mandatory (unless otherwise specified in the required field) in order to fulfil the established purposes. Therefore, if they are not provided or are not provided accurately, it may not be possible to process the requests correctly.
In the event that the data subject provides third-party data, they declare that they have the consent of said parties and undertake to forward to the data subject, the owner of such data, the information contained in this Privacy Policy, exempting MUGA HOLIDAYS from any liability in this regard.
SECURITY MEASURES
Personal data will be processed lawfully, fairly and transparently in relation to the data subject (lawfulness, fairness and transparency); collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of the personal data processing (respecting the limitation periods for liabilities); processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).
We follow strict selection criteria for service providers with access to personal data, in order to comply with their data protection obligations, as well as to formalise with them the corresponding data processor contract (art. 28 GDPR), through which they will be imposed, among others, the following obligations: apply appropriate technical and organisational measures; process the data following our instructions; and delete or return the data to us once the provision of services has ended.