Privacy Policy

Privacy Policy


In accordance with the provisions of Law 29/2021, of 28 October, on the qualified protection of personal data (LQPD), the regulations that implement it, and Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (GDPR), in the processing activities applicable to it, in accordance with Article 3.2 of this regulation, it is hereby informed that the personal data collected are incorporated and processed in files owned by CEDA, SA (hereinafter, “CEDASA”).


Our customers and their data are very important to us, so we are committed to:


  • Not collecting any personal data without your consent.
  • Collecting your data according to the principle of data minimisation, i.e., only what is necessary, essential, and not excessive for our purposes.
  • Collecting and processing your data only for the purposes described in our policy and informing recipients thereof.
  • Collecting and processing only the data necessary for the correct processing of your request or the personalisation of the services you request from us.
  • Maintaining the commitment to take appropriate measures to guarantee the confidentiality of your data and prevent its disclosure to unauthorised third parties.
  • In situations of data transfers to authorised third parties, we take all appropriate measures to ensure the security of such transfer.
  • Informing you about your rights of access, rectification, and objection in accordance with Law 29/2021, of 28 October.


Data Controller


The data controller for customer data is CEDA, SA, which operates commercially as ANYÓSPARK.



You can contact the data protection officer by sending a message to lqpd@cisagroup.com or by post to the address indicated above.



Type of Data


CEDASA may collect and process personal information that you have provided directly and voluntarily, such as your name, address, email address, telephone number, date of birth, billing details, or identification document number (passport, ID card…). We do not request or process sensitive data, such as those related to race, ethnicity, political opinions, religious or philosophical beliefs, or sexual orientation.



Processing Activities: Purposes and Legal Basis


Your data is collected when:


  • You contact our reservations department by phone or email.
  • You make a reservation on our website.
  • You complete your details when checking in.
  • You become a member of the AnyósPark Selection loyalty programme.
  • You send us an email.
  • You share a page or offer by email or through a social network.
  • You respond to a satisfaction questionnaire.
  • We manage the services you request from us.
  • You subscribe to our newsletter.
  • You attend events or activities we organise at our facilities.
  • Competitions or prize draws are held.

The indication of any personal data through the various forms and email addresses on this website implies acceptance and consent to its processing under the terms indicated in this privacy policy.


Thus, consent or other legal bases, such as the performance of the contract, our legitimate interest, and compliance with legal obligations, encompass the following purposes, with their respective legal bases, without the data being able to be applied or used for any other purpose for which they were collected.


The personal data provided by data subjects are used exclusively for the following purposes:


  • The management of reservations and services, registration as a member of the AnyósPark Selection loyalty programme, adequate attention to queries, comments, incidents, or suggestions, in accordance with the performance of the contract, pre-contractual operations, legitimate interest, or your consent.
  • Keeping you informed by electronic means, mobile devices, or any other analogous means about incidents, modifications, queries, or similar in relation to your reservations, contracted services, or queries made, based on legitimate interest or your consent.
  • Improving and personalising our attention and service, based on legitimate interest or your consent.
  • Managing and accompanying the relationship with our customer, according to the performance of the contract, pre-contractual operations, your legitimate interest, or your consent.
  • Keeping you informed, by electronic means or mobile devices, or by any other means so provided and facilitated, about personalised offers, discounts, services, activities, or products from CEDASA that may be of interest to you, in accordance with your consent or CEDASA’s legitimate interest.
  • Managing access to events or activities that CEDASA organises at its facilities, according to the performance of the contract or your consent.
  • Managing and organising competitions or prize draws aimed at promoting CEDASA, its establishments, and its brands. Communicating winners and prize delivery, if applicable, in accordance with your consent, including the publication of such data on CEDASA’s external media, such as social networks (Facebook, Instagram) or the website www.anyospark.com.
  • Statistical analysis of website visits for commercial purposes, based on CEDASA’s legitimate interest or your consent.
  • The management of requests for access, rectification, objection, limitation, and portability, based on compliance with legal obligations.
  • The management of debts and disputes, for compliance with legal obligations and legitimate interest.

CEDASA informs you that it does not process your personal data for any purpose other than those included in this section, except in cases where there is a legal obligation, a judicial requirement, or your consent.


Your personal data cannot be subject to decisions based on automated processing that entail legal effects for the data subject.



Legitimacy for the Processing of Your Data:


The legal basis for the processing of your personal data corresponds to the free and legitimate acceptance of the legal relationship by the user at the time of accepting this personal data protection and privacy policy.


Likewise, the legitimacy for the processing of your data for each of the personal data processing purposes identified above is detailed below:


  • Reservation, registration, and contracting of products, services, or activities, as well as managing registration as a member of the loyalty programme: The legal basis for the processing of your personal data is the contractual, and, where applicable, pre-contractual, relationship established between the parties for the execution of the provision of services and products contracted or requested by the data subjects and, specifically, for the execution of the reservation of the services, activities, and products of our establishment that you have made, according to the terms and conditions set out in the Terms and Conditions section, as well as compliance with the corresponding commercial, tax, and accounting obligations. All this based on the provisions of Article 6.1, paragraphs a) and b), of the LQPD. The refusal to provide the personal data requested for the reservation therefore makes it impossible to conclude the contract or the requested reservation. For more information on contracting our products and services, please refer to the Terms and Conditions of Contract section. Once the reservation is made, the data subject will receive a confirmation email with the reservation details.
  • Providing you with information by electronic means, mobile devices, or any other analogous means about incidents, modifications, queries, or similar in relation to reservations, contracted services or activities, or queries made. This is based on the provisions of Article 6.1, paragraphs a) and f), of the LQPD.
  • Guest registration book for hospitality establishments: The legal basis for the processing of your personal data is the legal obligation established regarding the collection, management, and submission to the competent security forces required by the Regulation on the Registration of Tourist Accommodation Occupancy (ROAT). This is based on the provisions of Article 6.1, paragraph c), of the LQPD. The refusal to provide the requested personal data therefore makes it impossible to stay at the establishment.
  • Queries: The legal basis for the processing of your personal data is the possibility of responding to queries freely raised by data subjects. This processing is carried out based on the provisions of Article 6.1, paragraphs a) and b), of the LQPD.
  • Access to the private area “My Reservation”: In the event that the data subject has registered as a user to access, consult, modify, or cancel the status of “My Reservation” from the website, the legal basis for the processing of your data is the existing contractual or pre-contractual relationship between the parties and to allow access to the information on the website relating to the status of the reservation, as well as to modify the data or cancel it, in the event that you have registered as a user, as well as your free and express acceptance and consent to process the data. This processing is lawful based on the provisions of Article 6.1, paragraphs a) and b), of the LQPD. The refusal to provide the requested personal data makes it impossible to access this information from the website.
  • Advertising of own products, offers, discounts, activities, and services: The legal basis for sending advertising about products, offers, discounts, activities, and services is the free and express consent of the data subject by ticking the corresponding box to accept subscribing to the newsletter or the legitimate interest of the data controller to offer products or services similar to those already contracted. This processing of personal data is based on the provisions of Article 6.1, paragraphs a) and f), of the LQPD. We inform you that you have the right to withdraw consent for this processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal. If you wish to withdraw consent, please refer to the section on Exercise of Rights of Data Subjects.
  • Completion of unfinished reservations: The legitimacy for processing data in this case is the express acceptance and consent by the data subject for this processing so that the company can contact them in the event that a technical incident may have occurred at the time of making the reservation or contracting. This processing of personal data is based on the provisions of Article 6.1, paragraph a), of the LQPD. The refusal to provide the personal data requested for the reservation therefore makes it impossible to carry out and conclude the requested contract or reservation.
  • Communicating changes to the privacy policy: The legitimacy for processing personal data in this case is based on the convenience of communicating to data subjects any changes that may occur in the company’s privacy policy, as well as their free acceptance and consent for this processing, in accordance with the provisions of Article 6.1, paragraphs a) and b), of the LQPD.
  • Competitions or prize draws: The legitimacy for processing personal data in the case of your participation and in the publication of results is based on consent, as established in Article 6.1, paragraph a), of the LQPD.
  • Keeping you informed by electronic means, mobile devices, or any other analogous means about incidents, modifications, queries, or similar in relation to reservations, activities, contracted services, or queries made, based on the provisions of Article 6.1.f) of the LQPD.
  • Statistics: The free acceptance and consent of the data subject for this processing, based on the provisions of Article 6.1, paragraph a), of the LQPD, is the legitimacy for processing data to carry out market studies and statistics of our products and services, without automated decisions with legal effects for the data subject being taken in any case. We inform you that you have the right to withdraw consent for this processing at any time, without affecting the lawfulness of processing based on consent prior to withdrawal. If you wish to withdraw consent, please refer to the section on Rights of Data Subjects.


Data Retention


The personal data provided are retained by CEDASA as long as a contractual or commercial relationship exists and as long as you do not withdraw your consent, exercise your right to erasure, objection, and limitation of the processing of personal data or, in our case, for the maximum legal period allowed by data protection legislation, including the limitation periods for legal actions for the attention of possible liability that may arise from the contractual relationship.


In the latter case, CEDASA must keep the data duly blocked, without giving them any use, as long as they may be necessary for the exercise or defence of claims or some type of judicial, legal, or contractual liability may arise from their processing that must be addressed and for which their recovery is necessary.



Minors


The CEDASA website is not aimed at minors. In any case, we do not collect any personal data from minors under sixteen years of age without the consent of their legal representative. The data collected from minors under sixteen years of age are those obtained at the time of registration at our hotels, by legal obligation, and only the data necessary for this obligation.



Communication of Data to Third Parties


CEDASA generally does not communicate your personal data to third parties. However, they may be transferred to companies that are part of CEDASA when providing their services and when necessary to comply with the obligations arising from the contract or in compliance with legal obligations, which may include communications to authorities that require it, such as security forces and bodies.


The providers of services contracted by CEDASA who act on its behalf as data processors may also access this data.



Exercise of Rights of Data Subjects


Data subjects have the following rights:


  • Right of access: You can request information about the personal data we process.
  • Right to rectification: You can modify personal data when they are inaccurate or incomplete.
  • Right to erasure or limitation: You can request the limitation or deletion of personal data.
  • Right to object: Where applicable, you can request that your personal data not be processed taking into account your particular situation.
  • Right to data portability: Where applicable, you can request the portability of the data you have provided to us.
  • Right not to be subject to automated decisions without human intervention.

If you have given your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent prior to withdrawal.


You can exercise your rights in writing by sending a message to the email address lqpd@cisagroup.com or by post to the address ctra. d’Anyós, 59 – AD 400 La Massana. The user must specify which right they wish to exercise and provide a copy of their identification data (e.g., ID card/passport). In the event that we need additional data to verify your identity, we will let you know.


You also have the right to lodge a complaint with the Andorran Data Protection Agency (www.apda.ad) if you consider that we have not processed your personal data in accordance with the regulations.



Accuracy of Data


You declare that all data provided are lawful, adequate, relevant, accurate, and, if necessary, updated. The provision of data that does not meet the aforementioned requirements exempts CEDASA from liability.



Security Measures and Levels


CEDASA has adopted the necessary measures to maintain the required level of security, according to the nature of the personal data processed and the circumstances of the processing, in order to prevent, as far as possible and always according to the state of the art, their alteration, loss, processing, or unauthorised access.


Likewise, CEDASA guarantees that it has implemented mechanisms to:


  • Guarantee the permanent confidentiality, integrity, and resilience of processing systems and services.
  • Restore the availability and access to personal data quickly, in the event of a physical or technical incident.
  • Regularly verify, evaluate, and assess the effectiveness of the technical and organisational measures implemented to ensure the security of processing.
  • Pseudonymise and encrypt personal data, if applicable.


International Transfers


CEDASA does not make international data transfers to provide its services. In any case, if a data processor acting on our behalf processes personal data in a third country, CEDASA will transfer the data based on an adequacy decision or, failing that, will assess whether the third country guarantees an adequate level of data protection and will apply all measures and controls within its reach to protect your personal data, including the signing of standard contractual clauses approved by the European Commission, the adoption of binding corporate rules, and the request for approved and recognised certifications or codes of conduct.



Cookies


Access to our website may involve the use of cookies. Cookies are small amounts of information that are stored in the browser used by each user so that the server remembers certain information that it can later use. This information allows us to identify you as specific users and allows us to save your personal preferences, as well as technical information, for example, visits or specific pages you browse.


Users who do not wish to receive cookies or wish to be informed before they are stored on their computer can configure their browser for this purpose.


For more information, please visit our cookie policy.



Social Networks


As users, you are informed that CEDASA has created profiles on Facebook and Instagram social networks with the purpose of informing about its own products, services, and activities.


User data is normally processed by social networks for research purposes. In order to protect your privacy, when integrating the connection buttons of the indicated social networks on our website, cookies are not installed when our web pages are loaded on your device.


Each social network has its own privacy policy on how it processes personal data when the user accesses its website. Thus, when the user accesses or consults our profile on Facebook and Instagram, the social network requests express consent to accept cookies, so it is recommended that the user carefully read the data protection information provided by the social network provider.



Commercial Communications


The data collected in this form will be processed by CEDA, S.A. for the purpose of sending you the newsletter about our products and services, based on your consent, which you voluntarily express by clicking the submit button.


Your data will not be transferred to third parties without your consent, except for legal obligation. You can exercise your rights of access, rectification, erasure, withdrawal of consent, request for limitation of processing, as well as other rights, by contacting lqpd@cisagroup.com.


You can also lodge a complaint with the supervisory authority at www.apda.ad.


For more information, please consult the Privacy Policy.



Customer Consent


As a user and customer, you declare that you have read and expressly accepted this privacy policy when registering with CEDASA, granting unequivocal and express consent to CEDASA for the processing of data in accordance with the purposes and services reflected herein.



Confidentiality and Professional Secrecy


The data we collect in all private communications between CEDASA and customers are treated with absolute confidentiality, so we commit to the obligation of secrecy of personal data, the duty to store them, and to adopt all necessary measures to prevent their alteration, loss, and unauthorised processing or access, in accordance with the applicable data protection regulations.


In addition, any information exchanged between the parties, that which these parties agree has such nature, or that which simply deals with the content of this information, is also confidential.



Modifications


CEDASA reserves the right to modify its security and data protection policy in order to adapt it to legislative or jurisprudential developments, as well as those that may derive from codes of conduct in force on the matter, or for strategic corporate decisions, with effects from the date of publication of such modification on our website.


LAST MODIFICATION: AUGUST 2024