In accordance with current legislation, www.tahitiplaya.com (hereinafter also referred to as the “Website”) undertakes to adopt the technical and organisational measures necessary, according to the appropriate level of security for the risk of the data collected.

Laws included in this privacy policy

This privacy policy is adapted to the current Spanish and European regulations on the protection of personal data on the internet. Specifically, it complies with the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

• Law 34/2002 of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the data controller

The data controller responsible for the processing of personal data collected on www.tahitiplaya.com is:
EDIFICACIONES DEL LITORAL SA, holding Tax ID (NIF): A08139339, registered in the Mercantile Register of Barcelona under the following details: Volume 1220, Folio 156, Sheet Number 8090 (hereinafter, the Data Controller).

Contact details:
Address: Calle Àngel Guimerà, nº 20-22, ground floor, 08017 – Barcelona
Telephone: 937667900
Email: rgpd@tahitiplaya.com

Principles applicable to the processing of personal data

The processing of the User’s personal data shall be subject to the following principles, as set out in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: User consent shall be required at all times, following transparent information on the purposes for which the personal data are collected.

• Purpose limitation: Personal data shall be collected for specified, explicit and legitimate purposes.

• Data minimisation: Only the data strictly necessary in relation to the purposes for which they are processed shall be collected.

• Accuracy: Personal data must be accurate and kept up to date.

• Storage limitation: Personal data shall be kept in a form which permits identification of the User only for as long as is necessary for the purposes of the processing.

• Integrity and confidentiality: Personal data shall be processed in a manner that ensures appropriate security and confidentiality.

• Accountability: The Data Controller shall be responsible for compliance with the above principles.

Categories of personal data

The only types of personal data processed on www.tahitiplaya.com are identification data.
Under no circumstances are special categories of personal data, as defined in Article 9 of the GDPR, processed.

Legal basis for the processing of personal data

The legal basis for the processing of personal data is consent.
www.tahitiplaya.com undertakes to obtain the User’s consent for the processing of their personal data for one or more specific purposes. The User has the right to withdraw their consent at any time. Withdrawing consent shall be as easy as giving it. As a general rule, the withdrawal of consent shall not affect the use of the Website.

In cases where the User must or may provide their data via forms to make enquiries, request information or for matters related to the content of the Website, they will be informed if the completion of any of these fields is mandatory, as such data are essential for the proper conduct of the operation.

Purposes of the processing of personal data

The personal data collected by www.tahitiplaya.com are processed with the aim of facilitating, streamlining, and fulfilling the commitments established between the Website and the User, or to maintain the relationship established through the forms the User fills out, or to respond to a request or enquiry.

Likewise, the data may be used for commercial purposes related to personalisation, operations and statistics, as well as for activities related to the corporate purpose of www.tahitiplaya.com. This includes data extraction, storage, and marketing studies to tailor the content offered to the User and improve the quality, functionality, and browsing experience on the Website.

At the time the personal data are collected, the User will be informed of the specific purpose or purposes for which the data will be used—that is, how the collected information will be used.

Personal data retention periods

Personal data will only be retained for the minimum time necessary for the purposes of processing and, in any case, only for the following period: 1 year from the end of the contractual relationship, or until the User requests its erasure.

At the time the personal data are collected, the User will be informed about the period for which the personal data will be retained or, when this is not possible, the criteria used to determine that period.

Recipients of personal data

The User’s personal data will not be shared with third parties.
In any case, at the time the personal data are collected, the User will be informed about the recipients or categories of recipients of such data.

Personal data of minors

In accordance with Articles 8 of the GDPR and 13 of the Spanish Organic Law on Data Protection (RDLOPD), only individuals over the age of 14 may give valid consent to the lawful processing of their personal data by www.tahitiplaya.com.

In the case of minors under 14 years of age, consent must be given by their parents or legal guardians. Processing will only be considered lawful if such authorisation has been provided.

Confidentiality and security of personal data

www.tahitiplaya.com undertakes to adopt the necessary technical and organisational measures, appropriate to the level of security required by the risk associated with the collected data, in order to guarantee the security of personal data and prevent their accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, www.tahitiplaya.com cannot guarantee the absolute invulnerability of the Internet, nor the total absence of hackers or others who may fraudulently access personal data. Therefore, the Data Controller undertakes to notify the User without undue delay when a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

In accordance with Article 4 of the GDPR, a personal data breach means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The personal data will be treated as confidential by the Data Controller, who undertakes to ensure this confidentiality is respected by all staff, partners, and any person to whom the information is made available under a legal or contractual obligation.

Rights deriving from the processing of personal data

The User holds the following rights with respect to www.tahitiplaya.com, in accordance with the GDPR, and may therefore exercise them before the Data Controller:

• Right of access: The User has the right to obtain confirmation as to whether www.tahitiplaya.com is processing their personal data, and, if so, to obtain information about such data and how it is being processed, including the origin of the data and the recipients of any communications made or planned.

• Right to rectification: The User has the right to have their personal data corrected if inaccurate or, considering the purposes of the processing, completed.

• Right to erasure (“right to be forgotten”): The User has the right to request the erasure of their personal data when, among other reasons, the data are no longer necessary for the purposes for which they were collected; the User withdraws consent; the data have been processed unlawfully; the data must be erased due to a legal obligation; or the data were collected in relation to the offer of information society services to a minor under the age of 14. In such cases, the Data Controller must, where technically possible and reasonable, inform other controllers processing the personal data of the User’s request for erasure of any links to those data.

• Right to restriction of processing: The User has the right to restrict the processing of their personal data when the accuracy of the data is contested; the processing is unlawful; the Data Controller no longer needs the data, but the User requires it for legal claims; or the User has objected to processing.

• Right to data portability: If processing is carried out by automated means, the User has the right to receive their personal data in a structured, commonly used and machine-readable format, and to transmit those data to another controller. Where technically feasible, the data shall be transmitted directly from one controller to the other.

• Right to object: The User has the right to object to the processing of their personal data or to request its cessation by www.tahitiplaya.com.

• Right not to be subject to automated decision-making, including profiling: The User has the right not to be subject to a decision based solely on automated processing, including profiling, unless otherwise required by applicable law.

To exercise these rights, the User must send a written request to the Data Controller with the subject “BAJA RGPD-www.tahitiplaya.com” and include:

• Full name and a copy of the User’s ID document. In cases of legal representation, identification of the representative and proof of representation will also be required. The copy of the ID may be replaced by any other legally valid means of verifying identity.

• Specific request outlining the right(s) being exercised and the reason for the request.

• Address for notifications.

• Date and signature of the applicant.

• Any documents supporting the request.

This request and any accompanying documentation may be sent to the following postal and/or email address:
Postal address: Calle Àngel Guimerà, nº 20-22, ground floor, 08017 – Barcelona
Email: rgpd@tahitiplaya.com

Complaints to the supervisory authority

If the User considers that there is a problem or violation of current regulations regarding the processing of their personal data, they are entitled to effective judicial protection and may file a complaint with a supervisory authority, particularly in the Member State where they have their habitual residence, place of work, or the place of the alleged infringement.

In the case of Spain, the supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos): http://www.agpd.es

II. COOKIE POLICY

Access to this Website may involve the use of cookies. Cookies are small amounts of information stored in the User’s browser—across the various devices used for browsing—so that the server can remember certain information which it will later read only from the server that installed it.

Cookies make browsing easier and more user-friendly and do not harm the User’s device. They are automated procedures for collecting information regarding the preferences determined by the User during their visit to the Website, with the aim of recognising them as a User and personalising their experience and use of the Website. They can also, for example, help identify and resolve errors.

The information collected through cookies may include the date and time of visits to the Website, the pages viewed, the time spent on the Website, and the sites visited immediately before and after.

However, no cookie allows the cookie itself to access the User’s phone number or any other means of personal contact. Nor can cookies extract information from the User’s hard drive or steal personal information. The only way private User information can be part of the cookie file is if the User personally provides that information to the server.

Cookies that identify a person are considered personal data. Therefore, the Privacy Policy described above shall apply to them. In this sense, the User’s consent will be required for their use.

This consent shall be obtained through a genuine choice, communicated by means of a positive and affirmative action, given before the initial processing, and must be withdrawable and recorded.

First-party cookies

These are cookies sent to the User’s computer or device and managed exclusively by www.tahitiplaya.com for the proper functioning of the Website.
The information collected is used to improve the quality of the Website and its content, as well as to enhance the User’s experience.

These cookies enable the Website to recognise the User as a returning visitor and to tailor the content to better suit their preferences.

The entity or entities responsible for providing these cookies may share this information with third parties, provided it is required by law or a third party processes the information on their behalf.

Third-party cookies

These are cookies used and managed by external entities that provide services to www.tahitiplaya.com in order to improve the Website and enhance the User’s browsing experience.

The main purposes for which third-party cookies are used are to obtain access statistics and analyse browsing behaviour—that is, how Users interact with the Website.

The information collected may include, for example:

• Number of pages visited

• Language preferences

• Location associated with the IP address from which the User accesses the Website

• Number of Users

• Frequency and recurrence of visits

• Visit duration

• Browser used

• Operator or type of device used to access the Website

This information is used to improve the Website and to identify new needs, with the aim of offering Users high-quality content and/or services. In all cases, the information is collected anonymously, and Website trend reports are compiled without identifying individual Users.

You may obtain more information about cookies, privacy information, or consult a description of the type of cookies used, their main characteristics, expiry periods, etc., at the following links:

• Google Analytics: https://developers.google.com/analytics/

• Optimizely: https://help.optimizely.com/

The entity or entities responsible for providing cookies may share this information with third parties, provided it is required by law or a third party processes the information on their behalf.

Social media cookies

www.tahitiplaya.com includes social media plugins that allow Users to access these platforms directly from the Website. As a result, social media cookies may be stored in the User’s browser.

The providers of these social networks have their own data protection and cookie policies. They are responsible for their own files and privacy practices in each case.

Users are advised to consult these policies to find out more about how their personal data is handled and how cookies are used. For informational purposes, you can consult the following links:

• Facebook: https://www.facebook.com/policies/cookies

• Twitter: https://www.twitter.com/en/privacy

Disabling, rejecting and deleting cookies

The User can disable, reject, and delete cookies—either fully or partially—installed on their device by configuring their browser settings (including, for example, Chrome, Firefox, Safari, or Internet Explorer).

The procedures for rejecting and deleting cookies may differ from one browser to another. Therefore, the User must refer to the instructions provided by the browser they are using.

If the User rejects the use of cookies—either in whole or in part—they may still use the Website, although some of its functionalities may be limited.

III. ACCEPTANCE AND CHANGES TO THIS PRIVACY POLICY

It is necessary that the User has read and agrees with the terms regarding the protection of personal data contained in this Privacy and Cookie Policy, and that they accept the processing of their personal data so that the Data Controller may proceed accordingly, for the purposes, periods, and uses stated.

Use of the Website implies acceptance of its Privacy and Cookie Policy.

www.tahitiplaya.com reserves the right to modify its Privacy and Cookie Policy, at its sole discretion or due to a change in legislation, jurisprudence, or interpretation by the Spanish Data Protection Agency.

Any changes or updates to this Privacy and Cookie Policy will be explicitly communicated to the User.

This Privacy and Cookie Policy was last updated on 25 May 2018, in order to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).