PRIVACY POLICY

This privacy policy has been developed by Sotavento S.A.U. (hereinafter “PLAYITAS”) in compliance with the principle of transparency and the right to information, as defined in Regulation EU 2016/679, General Data Protection Regulation (hereinafter “GDPR”).

In order to ensure active compliance with the GDPR and protect your right to data protection, PLAYITAS informs you of the following:

1. Data Controller The data controller for personal data collected from the contact forms contained in this website is Sotavento S.A.U., with NIF A35017706, located at Urb. Las Playitas, S/n, 35629 – Tuineje, Fuerteventura. 
For inquiries regarding our privacy police, contact us by phone (+34 928 860 400) or email (lopd@playitas.net).

2. Data Protection Officer Dataseg Consultores y Auditores, S.L., located at C/ Rafael Hardisson Spou, 16, mezzanine, office 7, 38005, Santa Cruz de Tenerife. Contact details: Phone +34 922 215 406, E-mail dpoplayitas@dataseg.es.

3. Purpose, Legal Basis, Retention Period, and Potential Transfers of Data Collected on Our Website Personal data provided to PLAYITAS via this website or any available contact forms may be processed for purposes you have previously accepted.

 PLAYITAS processes data in a lawful, fair, and transparent manner, restricts data processing to the necessary purposes for which they were collected, and stores them exclusively for the necessary period to achieve such purposes, its associated legitimate interest, and at least for the statutorily required periods under Spanish and European regulations.

Toward meeting the principle of transparency requirements –to provide any information in a concise, transparent, intelligible and easily accessible form– as defined in Article 12 of the GDPR, - we have grouped the information according to who the data subject is for a better understanding of the purposes and legal bases for processing, retention periods and data recipients:

o    Data provided by website users and visitors:

 

• Purpose: Manage information requests and respond to queries.
• Legal Basis: Consent of the data subject, as per Article 6.1 of the GDPR, on the basis of the express action by the data subject of checking the boxes to submit information and/or others.
• Retention Period: Personal data related to general inquiries will be stored as long as necessary to manage the inquiry and customer service statistics at playitas.net.
• Recipients: Data will not be disclosed to third parties unless legally required.

 

o    Data provided by newsletter subscribers:

• Purpose: Send information about offers and promotions, events, activities, and other advertising information from PLAYITAS via email.
• Legal Basis: Consent of the data subject, as per Article 6.1 of the GDPR, on the basis of the express action by the data subject of checking the boxes to submit information and/or others.
• Retention Period: Until the user requests to unsubscribe from the newsletter or information service.
• Recipients: Data will not be disclosed to third parties unless legally required.
• International Data Transfer to the USA: Resulting from the use of MailChimp to distribute commercial communications, additional information is available in section 7 of this privacy policy.

 

o    Data provided by clients, guests, and users:

1. Management of Bookings, Contracting of Services and Related Activities:

• Purpose: Manage bookings or service requests and related activities (identity verification of cardholders, card validity or payment method check, request bank pre-authorization, manage service charges according to PLAYITAS booking terms and conditions, incident management, etc.).
• Legal Basis:
  • Performance of a contract or pre-contractual measures, as per Article 6.1.b of the GDPR, derived from the client or user’s booking or service request.
  • Compliance with legal obligations of PLAYITAS, as per Article 6.1.c of the GDPR, related to banking, commercial, fiscal, financial, and accounting regulations.
• Retention Period: Indefinite for legal entities. Data for individuals or agents of legal entities will be retained as long as required for civil liability purposes and the public administration, as well as for the retention periods established by applicable commercial, banking, financial, and tax regulations.
• Recipients: Data may be disclosed to third parties as necessary in relation to the contractual relationship (banks, insurers, service intermediaries, and others in connection with the requested services) and legally required entities.

 

2. Processing Sensitive Data for Assistance or Adoption of Special Measures in the Provision of Services:

• Purpose: During the process of booking, check-in, stay, or even post-stay, clients may provide PLAYITAS with information that may be considered as special data (e.g., food allergies, disabilities, or illnesses requiring assistance or special measures). This information shall be used solely for this purpose.
• Legal Basis: Consent by the data subject, as per Article 6.1.a of the GDPR, provided through informative checkboxes and forms.
• Retention Period: Data will be retained as long as necessary for data collection purposes. Any information retained by PLAYITAS shall be deleted once the need ceases. Data for legal entities shall be retained indefinitely.
• Recipients: Data will not be disclosed to third parties.

 

o    Data provided by survey respondents:

• Purpose: Manage quality control, customer service, and statistics related to customer satisfaction surveys.
• Legal Basis:
  • Consent by the data subject, as per Article 6.1 of the GDPR, on the basis of the express action of the data subject when completing the survey.
  • Performance of a contract, as per Article 6.1.b of the GDPR, related to obligations towards clients and guests.
• Retention Period: Data will be stored for the necessary period in the event of any resulting civil and commercial liabilities on PLAYITAS.
• Recipients: Data will not be disclosed to third parties unless legally required.

 

o    Data provided by job applicants:

• Purpose: Include you in PLAYITAS’s recruitment processes, and for the purposes of assessing your skills, we may request you to send videos or audiovisual content.
• Legal Basis: Consent of the data subject, as per Article 6.1 of the GDPR, on the basis of the express action by the data subject when submitting their resume or applying for a recruitment/selection process.
  • Retention Period: Data will be retained for a maximum of 2 years.
  • Recipients: Data will not be disclosed to third parties unless legally required.

 

o    Data provided by contest and sweepstake participants:

 

• Purpose: Manage participation in events, activities, and contests organized by PLAYITAS. If the activity has its own terms and conditions to be eligible to participate, the data processing of participants will be subject to the specific terms and conditions of such activity.
• Legal Basis:
  • Consent of the data subject, as per Article 6.1 of the GDPR, on the basis of the express action by the data subject when signing up.
  • Performance of a contract or pre-contractual measures, as per Article 6.1.b of the GDPR, related to the execution of the activity and prize delivery.
  • Compliance with legal obligations of PLAYITAS, as per Article 6.1.c of the GDPR, related to civil, commercial, financial, and tax regulations concerning prize delivery.
• Retention Period: For winners, data will be published on the website and social media indefinitely, subject to removal upon the express request by the data subject. All participants’ data will be retained for the minimum period required in connection to PLAYITAS's civil or commercial liabilities.
• Recipients: Data will not be disclosed to third parties. If the activity has its own terms and conditions to be eligible to participate, the data processing of participants will be subject to the specific terms and conditions of such activity

 

• Data provided by those exercising data protection rights:

 

• Purpose: Manage requests to exercise data protection rights by data subjects.
• Legal Basis:
  • Performance of a contract or pre-contractual measures, as per Article 6.1.b of the GDPR.
  • Legitimate interest of the data controller as per Article 6.1.f of the GDPR, arising from the need for PLAYITAS to accredit compliance with requests from data subjects before any competent authorities.
• Retention Period: Data will be retained for the legally established periods in the GDPR and any civil and commercial liabilities on PLAYITAS.
• Recipients: Data will not be disclosed to third parties unless legally required.

 

4.    Data Protection Information for Recipients of Forms and/or Documents Redirecting to This Website 
Personal data collected in various documents redirecting to the detailed information available on this website may be processed for the following purposes (depending on the document):

• Invoices:
  • Purpose: Manage the contractual or pre-contractual relationship between you and PLAYITAS, as well as for administrative, fiscal, and accounting purposes.
  • Legal Basis: Performance of a contract or pre-contractual measures, as per Article 6.1.b of the GDPR.
  • Retention Period: As required by current civil, financial, and tax regulations.
  • Recipients: Data may be disclosed to competent public administrations, banks, and savings banks as appropriate.
• Estimates:
  • Purpose: Prepare and deliver/send estimates, follow up and conduct market research via phone, email, or in person.
  • Legal Basis: Consent by the data subject and the application of pre-contractual measures, as per Article 6.1.b of the GDPR.
  • Retention Period: As required by current civil, commercial, financial, and tax regulations. The period starts upon completion of the estimate management.
  • Recipients: Data will not be disclosed to third parties unless legally required.
• Authorization for Image Capture and Publishing
  • Purpose: Capture images of the signatory or their agent, and publish them on social media, websites, and other communication channels to promote PLAYITAS activities, products, or services.
  • Legal Basis: Consent by the data subject, Article 6.1.a GDPR.
  • Retention: Until deletion of the published content is requested.
  • Recipients: The captured images will be published on PLAYITAS's website and various social media profiles.
  • International Data Transfer to the USA: Resulting from the use of social media, more information is available in section 7 of this privacy policy.
• Resumés
  • Purpose: Manage job application and consider candidates in the staff recruitment/selection processes.
  • Legal Basis: Consent by the data subject, Article 6.1.a GDPR.
  • Retention: The data will be retained for a maximum of 2 years.
  • Recipients: The data will not be transferred to third parties unless legally required.
• Email
  • Purposes:

1. General Email: Address specific information requests via email or phone, manage the contact agenda, perform contracts or pre-contractual measures.
2. Booking Email: Complete and manage bookings, verify card validity or manage bank pre-authorizations, charge according to booking and cancellation conditions, and pay for expenses incurred during stay (unless another payment method is provided).
3. Billing Email: 

• a.    Senders and Designated Contact Persons: The data shall be processed to properly manage the existing contractual or pre-contractual relationship, based on Sotavento's legitimate interest, according to Article 19 LOPD 3/2018.
• b.    Freelancers and Professionals: The data shall be processed to properly manage the existing contractual or pre-contractual relationship, based on contract performance, according to Article 6.1.b GDPR.

 

• Legal Basis:
  • (1) and (2) consent of the data subject in the case of information requests or inquiries (Article 6.1.a GDPR), adoption of pre-contractual measures or contract performance (Article 6.1.b GDPR), and legitimate interest in processing data of contact persons (Article 6.1.f GDPR).
  • (3) contract performance or adoption of pre-contractual measures, Article 6.1.b GDPR.
• Retention: The data will be retained as necessary to fulfill the legal obligations arising from the existing relationship. Once these obligations are met, the data will be deleted.
• Recipients: The data will not be transferred to third parties unless legally required.

 

o    Satisfaction Surveys

• Purpose: Manage responses, complaints, and suggestions, and maintain related statistics.
• Legal Basis: Depending on the context:
  • Consent of the data subject, Article 6.1.a GDPR, for conducting satisfaction surveys of services provided by PLAYITAS.
  • Compliance with legal obligations of PLAYITAS, Article 6.1.c GDPR, regarding civil, commercial, financial, and tax management of complaints and claims.
• Retention: Until deletion or cancellation of subscription to the advertising information service is requested.
• Recipients: The data will not be transferred to third parties unless legally required.

 

o    Video Surveillance

• Purpose: Ensure the safety of individuals, property, and facilities.

• Legal Basis: Public interest, Article 22 LOPD 3/18.

• Retention: One month max.

• Recipients: In certain cases, images may be disclosed to law enforcement agencies, experts, and providers of insurance          services.

 

5.    Third-Party Data 
In cases where one person makes a reservation for a group of guests (family, friends, or work colleagues), the following should be considered:

•    You may only provide third-party data if you have their express consent.
•    By providing third-party data, you expressly declare that you have the mentioned consent or the legal capacity to give such consent on their behalf.
•    All individuals whose data you provide must have been informed of the content of this section. You hereby declare that you have informed them and made them aware of its content.
•    PLAYITAS does not hold any responsibility for the user’s failure to comply with the above paragraphs.

6.    Voluntary Nature of Form Filling and Accuracy of Data

•   Any forms available shall specify which data are mandatory and required for managing your query, request, or registration. Failure to provide such data may result on your request no being processed correctly.

• Please avoid entering confidential or sensitive information not necessary for our services in the forms. If additional information is required, we will contact you.
• The accuracy of the data provided by the user is not contested. Users must notify PLAYITAS of any changes to the data.

7.    International Data Transfers PLAYITAS uses services whose servers are located outside the EU or whose headquarters are outside the EU, resulting in international data transfers to countries outside the European Union. This is a common practice for companies or individuals using social media, cloud applications, and email services from major tech companies. PLAYITAS conducts the following international data transfers:

•    Using MailChimp for newsletter distribution. More information is available in their privacy policy at MailChimp Privacy Policy.
•    International data transfers may also occur in connection to PLAYITAS's corporate social media profiles. By consenting to publish your personal data on PLAYITAS's social media profiles, you expressly authorize international data transfers to the USA, as described in the authorization documents. Please refer to the privacy sections of the respective social media platforms:

o    Facebook Privacy Policy
o    Instagram Privacy Policy

You can revoke your consent at any time, without affecting the data processed before the withdrawal of consent.

8.    Data Security 

PLAYITAS has established a privacy and data security policy that ensures the implementation of all necessary technical and organizational security measures to protect the personal data processed through this website and, in general terms, within the organization. This active compliance policy allows us to maintain security measures and controls up-to-date, enhancing information security, process transparency, and staff awareness of these processes.
We have executed the appropriate third-party data processing contracts with all our service providers, thus ensuring compliance with the GDPR.

Exercise of Data Protection Rights

a.    Consent and Revocation: Users can revoke their consent at any time, without affecting the lawfulness of data processing during the prior authorization period.

b.    Rights of Access, Rectification, Erasure, Limitation, Objection, and Portability: Users or visitors can request to exercise their rights to access, rectify, erase,  limit the processing, object to the processing, or data portability according to the data protection regulations mentioned above. You can exercise these rights by  submitting a written request, along with a copy of a valid legal identification document, to PLAYITAS at lopd@playitas.net or the contact address provided at the  beginnig of this document. You can also contact our Data Protection Officer using the contact details provided at the beginning of this document. You can request  forms for exercising rights or use the forms available on the Spanish Data Protection Agency's website, or request a copy via email.

c.   Complaint to the Supervisory Authority: If you consider your rights have not been adequately addressed by our Data Protection Officer or our company, you              may lodge a complaint with the Spanish Data Protection Agency or your state's supervisory authority.

Changes and Updates 

PLAYITAS is committed to respecting the right to the protection of personal data protection of its users, visitors, and guests. Therefore, you will be given prior notice in the event of any modifications affecting your rights.