1Identification of the data controller

In compliance with Regulation (EU) 2016/679 of 27 April, the General Data Protection Regulation — hereinafter, GDPR —, and with Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights — hereinafter, LOPDGDD —, users are informed that the controller responsible for processing their personal data is:

2Principles applicable to the processing of personal data

CORAL LAND, S.L. will process users’ personal data in accordance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, purpose limitation, storage limitation, integrity, and confidentiality.

Only the data necessary to handle inquiries, manage booking requests, provide the contracted services, and comply with applicable legal obligations will be requested.

3Personal data we may collect

Depending on the relationship the user has with CORAL LAND, S.L., the following categories of data may be processed:

• Identifying data: name, surname, ID document, date of birth, nationality, and signature.
• Contact details: postal address, email, and telephone number.
• Booking details: accommodation chosen, check-in and check-out dates, number of guests, and requests related to the stay.
• Data of companions and minors included in the booking.
• Financial, banking, billing, or payment-method data when necessary to manage the contract.
• Data voluntarily included in inquiries, emails, or forms.
• Technical browsing data: IP address, device type, browser, access logs, and data obtained through cookies.
• Any other information necessary to properly manage the stay or comply with the legal obligations of hospitality establishments.

The user must refrain from providing specially protected data that is not necessary for the provision of the service.

4Purposes, legal bases, and retention periods

4.1. Inquiries and requests for information

Purpose: To handle inquiries, requests, or submissions sent through the website’s forms, email, phone, or other contact channels.

Legal basis: Consent of the data subject and, where the inquiry relates to a possible booking, application of pre-contractual measures requested by the user.

Retention: For the time necessary to handle and close the request. Afterwards, data may be kept blocked for the periods necessary to address potential liabilities.

4.2. Availability requests and bookings

Purpose: To check the availability of accommodations, prepare quotes, manage bookings, confirm stays, and maintain the necessary communications with guests.

Legal basis: Application of pre-contractual measures and performance of the accommodation contract.

Retention: During the management of the booking and the provision of the service. Afterwards, data will be kept for the legal periods applicable to tax, commercial, contractual obligations, or possible claims.

4.3. Management of the stay and guest services

Purpose: To manage check-in and check-out, handle incidents, provide requested services, communicate with guests, and ensure the proper course of the stay.

Legal basis: Performance of the accommodation contract and the legitimate interest of CORAL LAND, S.L. in ensuring the proper provision and safety of the service.

Retention: During the stay and, afterwards, for the periods necessary to address liabilities arising from the service.

4.4. Guest registration and reporting

Purpose: To collect, register, retain, and report to the competent authorities the data required by the regulations governing hospitality activities and public safety protection.

Legal basis: Compliance with a legal obligation applicable to CORAL LAND, S.L., in particular the obligations arising from Royal Decree 933/2021, of 26 October, and other regulations applicable to hospitality establishments.

Retention: Data included in the electronic traveler registry will be kept for the legally established period, currently three years from the end of the hospitality service.

4.5. Billing, accounting, and tax obligations

Purpose: To issue invoices, manage payments, keep accounts, and comply with tax, commercial, and administrative obligations.

Legal basis: Performance of the contract and compliance with legal obligations.

Retention: For the periods established under applicable tax, commercial, and accounting regulations.

4.6. Commercial communications

Purpose: To send information about accommodations, promotions, news, or services of CORAL LAND, S.L. by email or other electronic means.

Legal basis: Express consent of the data subject.

Retention: Until the user withdraws their consent or requests unsubscription.

The user may withdraw their consent at any time via the unsubscribe link included in the communications or by writing to administracion@coralland.com.

Withdrawing consent will not affect the lawfulness of the processing carried out prior to withdrawal.

4.7. Security and operation of the website

Purpose: To ensure the operation, security, and integrity of the website, prevent unauthorized access, detect technical incidents, and prevent fraudulent use.

Legal basis: The legitimate interest of CORAL LAND, S.L. in protecting its website, its systems, and its users.

Retention: For the time strictly necessary to analyze and resolve the incident and, where applicable, for the periods necessary to bring or defend against claims.

4.8. CVs received voluntarily

Purpose: To assess the candidacy of the data subject in current or future selection processes.

Legal basis: Consent of the candidate when voluntarily submitting their CV.

Retention: For a maximum period of one year, unless the candidate requests earlier deletion or expressly authorizes a different period.

5Mandatory nature of the data

Fields marked as mandatory on the forms are necessary to handle the request or manage the booking.

Refusal to provide this data may prevent CORAL LAND, S.L. from handling the inquiry, processing the request, or properly providing the contracted service.

The user guarantees that the data provided is true, accurate, complete, and up to date.

6Third-party data

When the user provides data of companions, family members, or other people, they guarantee that:

• They are authorized to provide it.
• The data is accurate and up to date.
• They have informed those people about the content of this Privacy Policy.
• They have obtained the necessary consent where required.

In the case of minors included in a booking, their data must be provided by their parents, legal guardians, or the adult responsible for the group.

7Data recipients

Personal data will not be sold or disclosed to third parties for commercial purposes.

It may be disclosed or made available to:

• Public authorities, law enforcement, judicial bodies, and competent authorities where there is a legal obligation.
• Tax authorities and other public bodies.
• Banking entities, payment platforms, or providers necessary to manage payments.
• Tax, labor, accounting, or legal advisory firms.
• Web hosting, email, IT maintenance, booking system providers, and other technology service providers.
• Companies handling cleaning, maintenance, guest services, or other services related to the accommodation, when necessary.
• Insurance companies when necessary to handle an incident or claim.
• Booking platforms or intermediaries when the booking was made through them.

Providers that access personal data on behalf of CORAL LAND, S.L. will act as data processors and will be subject to the corresponding confidentiality and data protection obligations.

8International data transfers

CORAL LAND, S.L. will endeavor to work with providers located within the European Economic Area.

Where it is necessary to use providers located outside the European Economic Area, it will be verified that the transfer is covered by an adequacy decision of the European Commission, standard contractual clauses, or another mechanism valid under the GDPR.

9Automated decisions and profiling

CORAL LAND, S.L. does not make decisions that produce legal effects on the user based solely on automated processing.

Nor does it create individualized commercial profiles, unless the user has been previously informed and has given consent where required.

10User rights

The data subject may exercise the following rights:

• Access: to find out what personal data is being processed.
• Rectification: to request the correction of inaccurate or incomplete data.
• Erasure: to request the deletion of their data when it is no longer necessary.
• Objection: to object to certain processing based on legitimate interest.
• Restriction: to request that processing be temporarily restricted.
• Portability: to receive their data in a structured format and transmit it to another controller where applicable.
• Withdrawal of consent: to withdraw previously given consent at any time.
• Not to be subject to automated decisions: when the legally established requirements are met.

To exercise these rights CORAL LAND, S.L.

Calle Testeina, 3, 35510, Tías, Puerto del Carmen, Las Palmas

Email: administracion@coralland.com