1. IDENTIFICATION

o Identity: HIPERION HOTEL GROUP, S.L. (hereinafter, "HIPERION")
o TAX ID NO: B-86213378
o Address: C/ MANUEL SILVELA, 1 4º D, 28010 MADRID
o Data Protection Officer (DPO). You can contact our DPO via mail: dpo@vibrahotels.com

You should indicate “Data Protection Officer” in the subject line and specify the right to exercise and provide a copy of your ID document.

2. INFORMATION AND CONSENT

1. By accepting this Privacy Policy, the user is hereby informed and lends their informed, specific and unequivocal consent for the personal data it provides through the website located at the URL https://www.vibrahotels.com (hereinafter the “Website”) as well as the data derived from their browsing activity and any other data that they may provide to the HIPERION HOTEL GROUP, S.L. in the future, to be processed by HIPERION HOTEL GROUP in a clear and simple way, in order to facilitate its understanding and determine freely and voluntarily if they wish to provide HIPERION HOTEL GROUP, S.L. with personal data.

3. OBLIGATION TO PROVIDE DATA.

The data requested in the website forms is general and obligatory (unless otherwise specified in the fields) to comply with the established purposes. Therefore, if it is not provided or not provided properly it can not be looked after, however the user will still be able to view the content of the Website.

4. WHY DOES HIPERION HOTEL GROUP, S.L. PROCESS THE USER’S PERSONAL DATA?

The personal data provided through the Website will be processed by HIPERION HOTEL GROUP, S.L. for the following purposes:

1. Data provided to make bookings on the Website and through the e-contact centre (call centre, email or online chat) for individual and group bookings as well as room hire:
• To handle booking requests from users. • To send booking confirmation or documentation.
• To send you commercial communications on behalf of HIPERION HOTEL GROUP, S.L. (should you agree).
• To carry out an analysis of the Website use and check user preferences and behaviour.

2. Data provided for booking amendment and cancellation:
• To manage booking amendment or cancellation requests sent to HIPERION HOTEL GROUP, S.L. by the user.
• To send answers to queries submitted to HIPERION HOTEL GROUP, S.L.
• To carry out an analysis of the Website use and check user preferences and behaviour.

3. Data provided in the recover abandoned cart form:
• To send an incomplete booking reminder or, where appropriate, a reminder of the searches carried out by the user.
• To carry out an analysis of the Website use and check user preferences and behaviour.

4. Data provided via the Newsletter form:
• To handle contact and information requests from the user via the channels established for such purposes on HIPERION HOTEL GROUP, S.L. websites.
• To handle a request.
• To carry out an analysis of the Website use and check user preferences and behaviour.

5. Data provided to send the Newsletter:
• To manage subscription and/or unsubscription to the Newsletter, carried out through the Website of HIPERION HOTEL GROUP, S.L.

6. Data provided in order to sign up as a registered user on HIPERION HOTEL GROUP, S.L.:
• To handle a subscription or unsubscription request as chosen by the user.
• To verify that the user complies with the subscription requirements, as long as HIPERION HOTEL GROUP, S.L. deems it appropriate.
• To process and respond to the possible information requests made by users.
• To search for promotions that fit the users needs.
• To send personalised commercial communications on behalf of HIPERION HOTEL GROUP, S.L.
• To carry out an analysis of the Website use and check user preferences and behaviour.

7. Data provided for the Club Vibra Programme:
• To manage the Loyalty Programme and process applications for membership, assign membership, access codes to the private online area and allow the user to collect and redeem points.
• To adapt the loyalty programme services to the Holder’s preferences and tastes and measure their level of satisfaction with the service provided in our hotels. This purpose may include sending quality surveys and adapting and customising HIPERION’s services to suit the customer.
•To send account-related communications including points balance, card category information, notifications and any other type of communication that keeps the user informed of their account status.
• To send personalised commercial communications via email or using an equivalent means, on offers and services related to the Programme unless the user opposes this kind of processing.

8. Data provided in the contact and website forms:
• To handle contact and information requests from the user via the channels established for such purposes on the HIPERION HOTEL GROUP, S.L. websites.
• To handle a request.
• To carry out an analysis of the Website use and check user preferences and behaviour.

9. Data provided for publications on the Blogs of HIPERION HOTEL GROUP, S.L.:
• To manage the publication of comments on the Website.
• To manage the Blog Newsletter subscription and/or unsubscription at the request of the user.
• To carry out an analysis of the Website use and check user preferences and behaviour.
• In the event that it is necessary, check the content of user comments and, where appropriate, remove the comments with content that does not meet the conditions applicable to the present Website at the discretion of HIPERION HOTEL GROUP, S.L.

5. WHAT USER DATA WILL HIPERION HOTEL GROUP, S.L. PROCESS?

HIPERION HOTEL GROUP, S.L. will process the following categories of user data:

1. Data provided to make bookings on the Website and through the e-contact centre (call centre, email or online chat) for individual and group bookings as well as room hire:
• Identification data: name, surname and nationality.
• Contact info: email address and telephone no.
• Data related to goods and services transactions on HIPERION HOTEL GROUP, S.L.: Purchased goods and services and ones the user shows an interest in.
• Room preferences.
• Economic, financial and insurance data.
• Other data: Data provided by the individuals in the blank fields or on a telephone call.
• Browsing data.

2. Data provided for booking amendment and cancellation:
• Identification data: name, surname, address and nationality.
• Contact info: email address and telephone no.
• Data related to goods and services transactions.
• Economic, financial and insurance data.
• Other data: Data provided by the individuals concerned in the blank fields on the Website forms or accompanying documents.
• Browsing data.

3. Data provided in the recover abandoned cart form:
• Contact info: address and e-mail.

4. Data provided to send the Newsletter:
• Identification data: name, surname, address and nationality.
• Contact info: country of residence and email address.
• Personal language preferences.

5. Data provided in order to sign up as a registered user on HIPERION HOTEL GROUP, S.L.:
• Identification data: name, surname, address and nationality.
• Contact info: email address and telephone no.
• The user and/or holder’s ID codes and/or passwords.
• Employment data: profession and sector.

6. Data provided for the Club Vibra Programme:
• Identification data: name, surname, Tax ID no, signature, address and nationality.
• Personal data: date of birth and gender.
• Contact info: email address and telephone no.
• The user and/or holder’s ID codes and/or passwords.
• Goods and services transactions on HIPERION HOTEL GROUP, S.L.: Purchased goods and services and ones the user shows an interest in.
• Accommodation preferences.
• Browsing data.

7. Data provided in the contact and website forms:
• Identification data: name, surname, address and nationality.
• Contact info: email address and telephone no.
• Data related to goods and services transactions.
• Other data: Data provided by the individuals concerned in the blank fields on the Website forms or accompanying documents.
• Browsing data. 8. Data provided for publications on HIPERION HOTEL GROUP, S.L. blogs:
• Identification data: name, surname, address and nationality.
• Contact info: country of residence and email address.
• Browsing data. In the event that the user provides the data belonging to a third party, it states to have received their consent to do so and undertakes to make them aware of the Privacy Policy, thereby making HIPERION HOTEL GROUP, S.L. exempt from any liability in this regard. However, HIPERION HOTEL GROUP, S.L. may carry out regular checks to confirm this fact and adopt the corresponding measures of due diligence, in accordance with data protection regulations.

6. WHAT ARE THE LEGAL GROUNDS FOR PROCESSING THE USER’S DATA?

The legal grounds for processing personal data are as follows:
1. To make bookings via the Website and the e-contact centre (call centre, email or online chat) for individuals and groups as well as room hire: the execution of the agreement between the parties. To perform an analysis of the use of the website: the legitimate interest of HIPERION HOTEL GROUP, S.L.
2. For a booking amendment and/or cancellation: the execution of the agreement between the parties. To perform an analysis of the use of the website: the legitimate interest of HIPERION HOTEL GROUP, S.L.
3. To send a recover abandoned cart request reminder: reminder: in the consent given by the user. To perform an analysis of the use of the website: the legitimate interest of HIPERION HOTEL GROUP, S.L.
4. For sending the Newsletter: in the consent given by the user.
5. To manage registration as a registered user: In the requested consent and, in cases where the user needs to confirm that they comply with the terms and conditions and to perform an analysis regarding website use, in the legitimate interest of HIPERION HOTEL GROUP, S.L. However, the withdrawal of consent will not affect the lawfulness of prior data processing.
6. For the Club Vibra form: In the consent requested, a basis for sending commercial communications, and which may be withdrawn at any time. However, the withdrawal of consent will not affect the lawfulness of prior data processing. To perform an analysis of the use of the website: the legitimate interest of HIPERION HOTEL GROUP, S.L.
7. For sending the contact form and Corporate website: the consent given by the user. To perform an analysis of the use of the website: the legitimate interest of HIPERION HOTEL GROUP, S.L.
8. For the management and publication of comments or publications sent by users on the BLOGS belonging to HIPERION HOTEL GROUP, S.L.: in the consent given by the user and, in the event of an analysis of the Website, providing the users’ preferences and behaviour as well as checking the content of comments, the legitimate interest of HIPERION HOTEL GROUP, S.L. If the user withdraws consent to the processing of the publication of comments, HIPERION HOTEL GROUP, S.L. will remove them from the Website. The consents given for the purposes mentioned are independent, which is why the user may revoke one of them and it will not affect the others. To revoke consent, the User may contact HIPERION HOTEL GROUP, S.L. via one of the following channels: dpo@vibrahotels.com

• WHY DOES HIPERION HOTEL GROUP, S.L. PROCESS THE HOLDER’S PERSONAL DATA AND FOR HOW LONG?
We hereby inform you that HIPERION HOTEL GROUP, S.L. processes the data provided by the account holder for the following purposes:
o To manage the Loyalty Programme and process applications for membership, assign membership, access codes to the private online area and allow the user to collect and redeem points.
o To adapt the loyalty programme services to the Holder’s preferences and tastes and measure their level of satisfaction with the service provided in our hotels. This purpose may include sending quality surveys and adapting and customising HIPERION’s services to suit the customer.
o To send account-related communications including points balance, card category information, notifications and any other type of communication that keeps the user informed of their account status.
o To send personalised commercial communications via email or using an equivalent means, on offers and services related to the Programme unless the user opposes this kind of processing.

• WHAT USER DATA WILL HIPERION HOTEL GROUP, S.L. PROCESS?
For proper provision of services, HIPERION HOTEL GROUP, S.L. will process the following categories of data:
o Identification data: name, surname, ID number, signature, address and nationality.
o Personal data: date of birth and gender.
o Contact info: email address and telephone no.
o The user and/or holder’s ID codes and/or passwords.
o Goods and services transactions on HIPERION HOTEL GROUP, S.L.: Purchased goods and services and ones the user shows an interest in.
o Room preferences.
o Browsing data. The Members of HIPERION HOTEL GROUP, S.L’s newsletter programme guarantee and respond, in any case, for the precision, validity and authenticity of the Personal Data provided, and undertake to keep it up to date as required. HIPERION HOTEL GROUP, S.L. will not process any data belonging to under 18s in relation to the loyalty programme.

• WHAT ARE THE LEGAL GROUNDS FOR PROCESSING THE USER’S DATA?
The legal grounds for processing user data will be, on one hand, the execution of the contract signed by both parties, for the adaption of services and programme management, while the holder’s consent will be the basis for sending commercial communications. The data requested from the Holder in the registration form is obligatory and used so that the Programme services can be provided properly, and, therefore, refusal to supply this personal data will mean that it is impossible to provide these services. In cases where non-obligatory data is requested, this will be indicated on the form itself.

• WITH WHOM WILL THE USER’S DATA BE SHARED?
HIPERIÓN HOTEL GROUP, S.L. will not share personal data with third parties.

• INTERNATIONAL DATA TRANSFER
We hereby inform you that your data will not be transferred to third party countries outside the European Economic Area.

DATA STORAGE
Personal data provided will be stored for the duration of the contractual relationship with HIPERION HOTEL GROUP, S.L, and once this relationship ends, it will remain stored until expiry of the statute of limitations.

• COMMERCIAL COMMUNICATIONS
So you can enjoy all the benefits of the HIPERION HOTEL GROUP, S.L. newsletter, you agree to us sending you news, promotion and offers that best suit your profile by different channels including electronic means as well as informing you of your Programme balance, points and categories, promotions and offers from our Partners. As part of our commitment to privacy, we remind you that you may access the Programme’s Terms and Conditions at any time using the following address: https://www.vibrahotels.com/privacy-policy You can also oppose the sending of any commercial communication by clicking on the link provided for such purposes on each communication or by sending an email to dpo@vibrahotels.com

• THIRD PARTY DATA PROCESSING
Should the Holder provide third party data at any time, they guarantee that they have their consent and undertake to forward the information held in this clause to them and inform HIPERION HOTEL GROUP, S.L. of any change or update to this data.

• DATA SECURITY
HIPERION has adopted all the technical and organisational measures required to guarantee that personal data is secure and to prevent its unauthorised alteration, loss, processing or access, given current technology, the nature of the stored data and risks to which it is exposed, either from human action or the physical or natural environment. The Holder is responsible for keeping their user password strictly confidential, and is responsible for access to our website, the private area of HIPERION HOTEL GROUP, S.L. and your own use of it as well as use by any one else who may use the password you previously provided, regardless of whether access or use was authorised by you or not, or in your name, even if this person is your employee, relation or agent. You hereby agree (i) to inform us immediately of any unauthorised use of your password, account or any other breach of security and (ii) make sure you log out after each session. The Holder is the only person responsible for sharing and using their password, accessing and using their account, and for informing us of their wish to cancel their account.

• HOLDER RIGHTS IN RELATION TO THEIR DATA
The holder may exercise the rights below at any time and free-of-charge by sending an email to dpo@vibrahotels.com with the subject line “Data Protection” and by attaching a photocopy of their ID document:
o To revoke the consent given to personal data processing and communication.
o To obtain information about the processing of personal data or lack thereof.
o To access their personal data. o To rectify inaccurate or incomplete data.
o To request cancellation of their data when the data is no longer required for the purposes it was collected.
o Restrict data processing once any of the conditions established in the data protection regulations are fulfilled.
o In certain circumstances and for reasons pertaining to their personal situation, interested parties may object to their data being processed.
o Request the portability of your data.
o File a complaint before the Spanish Data Protection Agency at the following address: Calle de Jorge Juan, 6, 28001 Madrid, if you believe that the Data Controller has infringed upon the rights granted by data protection regulations.

The interested party may contact the Data Protection Officer:
o E-mail: dpo@vibrahotels.com