1. IDENTIFICATION

At VIBRA HOTELS, a commercial brand owned by HIPERION HOTEL GROUP, S.L., we apply the utmost attention and rigour in complying with applicable regulations regarding the processing of personal data and the data protection rights of our guests and clients.

The purpose of this Privacy Policy is to identify who is responsible for the processing of personal data, to inform you about how we obtain, process and protect the personal data that you provide or we collect through our website https://www.vibrahotels.com/es (the "Website") by means of forms and/or cookies so that you can decide freely, consciously and voluntarily whether you wish us to process it.

In the event you wish to stay in the following hotel establishments and/or complete the booking process through this Website, the person responsible for the Processing of your data is:

IBIZA TOWN	PLAYA D'EN BOSSA	SAN ANTONIO	BAHIA DE SAN ANTONIO	CALA TARIDA	MALLORCA
*Vibra Jabeque Dreams Apartments *Vibra Jabeque Soul Aparthotel *Vibra Lei Ibiza Hotel *Vibra Lux Mar Aparthotel *Vibra Maritimo Hotel *Vibra Panoramic Apartments *Vibra Tivoli Apartments *Vibra Tropical Garden Apartments *Vibra Vila Hotel	*Vibra Algarb Hotel *Vibra Bossa Flow Hotel *Vibra Isola Hotel *Vibra Mare Nostrum Hotel *Vibra Mogambo Aparthotel	*Vibra Calima Apartments *Vibra Central City Aparthotel *Vibra Del Mar Aparthotel *Vibra District Hotel *Vibra Marco Polo I Hotel *Vibra Marco Polo II Hotel *Vibra Sanan Aparthotel	*Vibra Bay Aparthotel *Vibra Club Maritim Aparthotel *Vibra Monterrey Aparthotel *Vibra Riviera Apartments *Vibra Riviera Hotel *Vibra San Marino Aparthotel *Vibra San Remo Hotel *Vibra S’Estanyol Hotel	*Vibra Cala Tarida Hotel	*Vibra Beverly Playa Hotel *Vibra Palma Cactus Hotel

• Identity of the data controller: HIPERION HOTEL GROUP, S.L. (hereinafter, “HIPERION ”)
• TAX ID: B-86213378
• Address: C/ ZURBARÁN, 30, 1º, 28010 MADRID

In the event you wish to stay in the following hotel establishments and/or complete the booking process through this Website, the person responsible for the Processing of your data is:

CIUDADELA - MENORCA

*Vibra Caleta Playa Apartments *Vibra Blanc Cottage Apartments *Vibra Blanc Palace Aparthotel

• Identity of the data controller: VACANCES MENORCA RESORT S.L. (hereinafter, “VACANCES MENORCA”)
• TAX ID: B-07694342
• Address: C/ DES SIGNE LLEO, 07760 SA CALETA - MENORCA

If you have any queries about data protection, or about how we process your data through this Website, you can contact our Data Protection Officer (DPO): you can contact our DPO via email: dpo@vibrahotels.com.Indicating in the subject "Data Protection Delegate" and, accrediting your identity by providing a photocopy of your valid ID document for these purposes.

2. INFORMATION AND CONSENT

By accepting this Privacy Policy, the user is hereby informed and lends their informed, specific and unequivocal consent for the personal data it provides through this “Website” are processed by the controller, as well as the data derived from their browsing activity and any other data that they may provide in the future, to be processed in a clear and simple way, in order to facilitate its understanding and determine freely and voluntarily if they wish to provide personal data by accepting our Privacy Policy, through the different forms available on this "Website".

3. OBLIGATION TO PROVIDE DATA DE

The data requested in the website forms is general and obligatory (unless otherwise specified in the fields) to comply with the established purposes. Therefore, if it is not provided or not provided properly it can not be looked after, however the user will still be able to view the content of the Website.

4. WHY DOES HIPERION HOTEL GROUP, S.L. PROCESS THE USER’S PERSONAL DATA?

The personal data provided through the Website will be processed by HIPERION HOTEL GROUP, S.L. or by VACANCES MENORCA, depending on the hotel establishment in which you wish to stay, in accordance with the following purposes:

1. Data provided to make bookings on the Website and through the e-contact centre (call center, email or online chat) for individual and group bookings as well as room hire of the hotel establishment of your choice;

• To handle booking requests from users in the hotel establishment of your choice;
• To send booking confirmation or documentation in the hotel establishment of your choice;
• To send you commercial communications only on behalf of HIPERION HOTEL GROUP S.L (should you agree)
• To carry out an analysis of the Website use and check user preferences and behaviours with regard to our hotel services.

2. Data provided for booking amendment and cancellation:

• Manage booking amendment or cancellation requests sent by the user.
• Send answers to queries submitted to the cancellation or modification of a reservation.
• Carry out an analysis of the Website use and check user preferences and behaviour.

3. Data provided in the recover abandoned cart form:

• Send an incomplete booking reminder or, where appropriate, a reminder of the searches about the hotel services of our "Website carried out by the user.
• Carry out an analysis of the Website use and check user preferences and behaviour.

4. Data provided via Newsletter form:

• Handle contact and information requests from the user via the channels established for such purposes on "Website" linked to the controller's establishments;
• Handle a request;
• Carry out an analysis of the Website use and check user preferences and behaviour;
• Manage subscription and/or unsubscription to the Newsletter, carried out through the "Website" linked to the HIPERION Newletter programme;

5. Data provided in order to sign up as a registered user "Website" linked to the establishments of HIPERION and VACACIONES MENORCA:

• Handle a subscription or unsubscription request as chosen by the user.;
• Verify that the user complies with the subscription requirements, as long as HIPERION HOTEL GROUP, S.L. deems it appropriate.
• Process and respond to the possible information requests and/or complaints made by users.
• Search for promotions that fit the users needs.
• To send personalised commercial communications on behalf of HIPERION HOTEL GROUP, S.L.;
• Carry out an analysis of the Website use and check user preferences and behaviour;

6. Data provided for the Club Vibra Programme:

• Manage the Loyalty Programme and process applications for membership, assign membership, access codes to the private online area and allow the user to collect and redeem points.
• Adapt the loyalty programme services to the Holder’s preferences and tastes and measure their level of satisfaction with the service provided in our hotels. This purpose may include sending quality surveys and adapting and customising HIPERION’s services to suit the customer.
• Send account-related communications including points balance, card category information, notifications and any other type of communication that keeps the user informed of their account status.
• Send personalised commercial communications via email or using an equivalent means, on offers and services related to the Programme unless the user opposes this kind of processing.

7. Data provided in the contact and website form:

• Handle contact and information requests from the user via the channels established for such purposes on the “Websites”.
• Handle a request. • Carry out an analysis of the Website use and check user preferences and behaviour.

8. Data provided for publications on the Blogs of HIPERION HOTEL GROUP, S.L.;

• To manage the publication of comments on the Website.
• To manage the Blog Newsletter subscription and/or unsubscription at the request of the user.
• To carry out an analysis of the Website use and check user preferences and behaviour.
• In the event that it is necessary, check the content of user comments and, where appropriate, remove the comments with content that does not meet the conditions applicable to the present Website at the discretion of HIPERION HOTEL GROUP, S.L.

5. WHAT USER DATA WILL HIPERION HOTEL GROUP, S.L. PROCESS?

1. Data provided to make bookings on the Website and through the e-contact centre (call centre, email or online chat) for individual and group bookings as well as room hire:

• Identification data: name, surname and nationality.
• Contact info: email address and telephone no.
• Data related to goods and services transactions. Purchased goods and services and ones the user shows an interest in during your stay in the hotel establishment.
• Room preferences.
• Economic, financial and insurance data.
• Other data: Data provided by the individuals in the blank fields or on a telephone call.
• Browsing data

2. Data provided for booking amendment and cancellation:

• Identification data: name, surname, address and nationality.
• Contact info: email address and telephone no.
• Data related to goods and services transactions.
• Economic, financial and insurance data.
• Other data: Data provided by the individuals concerned in the blank fields on the Website forms or accompanying documents.
• Browsing data.

3. Data provided in the recover abandoned cart form:

• Contact info: address and e-mail

4. Data provided to send the Newsletter:

• Identification data: name, surname, address and nationality.
• Contact info: country of residence and email address.
• Personal language preferences.

5. Data provided in order to sign up as a registered user on “Website”;

• Identification data: name, surname, address and nationality.
• Contact info: email address and telephone no.
• The user and/or holder’s ID codes and/or passwords.
• Employment data: profession and sector.

6. Data provided for the Club Vibra Programme:

• Identification data: name, surname, Tax ID no, signature, address and nationality.
• Personal data: date of birth and gender.
• Contact info: email address and telephone no.
• The user and/or holder’s ID codes and/or passwords.
• Goods and services transactions on HIPERION HOTEL GROUP, S.L.: Purchased goods and services and ones the user shows an interest in.
• Accommodation preferences.
• Browsing data.

7. Data provided in the contact and website forms:

• Identification data: name, surname, address and nationality.
• Contact info: email address and telephone no.
• Data related to goods and services transactions.
• Other data: Data provided by the individuals concerned in the blank fields on the Website forms or accompanying documents.
• Browsing data.

8. Data provided for publications on HIPERION HOTEL GROUP, S.L. blogs:

• Identification data: name, surname, address and nationality.
• Contact info: country of residence and email address.
• Browsing data. In the event that the user provides the data belonging to a third party, it states to have received their consent to do so and undertakes to make them aware of the Privacy Policy, thereby making HIPERION. exempt from any liability in this regard. However, HIPERION may carry out regular checks to confirm this fact and adopt the corresponding measures of due diligence, in accordance with data protection regulations.

6. WHAT ARE THE LEGAL GROUNDS FOR PROCESSING THE USER’S DATA?

The legal grounds for processing personal data are as follows:
1. To make bookings via the Website and the e-contact centre (call centre, email or online chat) for individuals and groups as well as room hire: the execution of the agreement between the parties. To perform an analysis of the use of the website: the legitimate interest of data controller.
2. For a booking amendment and/or cancellation: the execution of the agreement between the parties. To perform an analysis of the use of the website: the legitimate interest of data controller.
3. To send a recover abandoned cart request reminder: reminder: in the consent given by the user. To perform an analysis of the use of the website: the legitimate interest of data controller.
4. For sending the Newsletter: in the consent given by the user.
5. To manage registration as a registered user: In the requested consent and, in cases where the user needs to confirm that they comply with the terms and conditions and to perform an analysis regarding website use, in the legitimate interest of data controller. However, the withdrawal of consent will not affect the lawfulness of prior data processing.
6. For the Club Vibra form: In the consent requested, a basis for sending commercial communications, and which may be withdrawn at any time. However, the withdrawal of consent will not affect the lawfulness of prior data processing. To perform an analysis of the use of the website: the legitimate interest of data controller.
7. For sending the contact form and Corporate website: the consent given by the user. To perform an analysis of the use of the website: the legitimate interest of data controller.
8. For the management and publication of comments or publications sent by users on the BLOGS belonging to HIPERION HOTEL GROUP, S.L.: in the consent given by the user and, in the event of an analysis of the Website, providing the users’ preferences and behaviour as well as checking the content of comments, the legitimate interest of data controller. If the user withdraws consent to the processing of the publication of comments, HIPERION HOTEL GROUP, S.L. will remove them from the Website. The consents given for the purposes mentioned are independent, which is why the user may revoke one of them and it will not affect the others. To revoke consent, the User may contact at any time via one of the following channels: dpo@vibrahotels.com

7. FOR HOW LONG DO WE PROCESS THE HOLDER’S PERSONAL DATA?

Personal data to which access is granted will be processed and kept for as long as the contractual relationship or the purpose for which they were collected is maintained. After this, the data will be kept once the contractual relationship has ended or when they are no longer relevant for the purposes for which they were collected, duly blocked, to be made available to the competent Public Administrations, Judges and Courts or the Public Prosecutor's Office during the period of limitation of the actions that may derive from the relationship maintained with the user and/or the legally stipulated retention periods. Subsequently, your data will be physically deleted after the expiry of these deadlines. In the event that the user has given his/her consent for the purposes of the processing subject to section IV (4) of the present Privacy Policy, his/her information will be kept as long as the user does not withdraw the consent first given, through the means indicated in section IV (4).

8. WITH WHOM WILL THE USER’S DATA BE SHARED?

It will not share personal data with third parties.

9. INTERNATIONAL DATA TRANSFER

We hereby inform you that your data will not be transferred to third party countries outside the European Economic Area.

10. INFORMATION ABOUT THIRD PARTY DATA PROCESSING

Should the Holder provide data controller, data at any time, they guarantee that they have their consent and undertake to forward the information held in this clause to them and inform HIPERION HOTEL GROUP, S.L. or VACANCES MENORCA of any change or update to this data.

11. DATA SECURITY

The data controller, has adopted all the technical and organisational measures required to guarantee that personal data is secure and to prevent its unauthorised alteration, loss, processing or access, given current technology, the nature of the stored data and risks to which it is exposed, either from human action or the physical or natural environment. The Holder is responsible for keeping their user password strictly confidential, and is responsible for access to our “website”, the private area and your own use of it as well as use by any one else who may use the password you previously provided, regardless of whether access or use was authorised by you or not, or in your name, even if this person is your employee, relation or agent. You hereby agree (i) to inform us immediately of any unauthorised use of your password, account or any other breach of security and (ii) make sure you log out after each session. The Holder is the only person responsible for sharing and using their password, accessing and using their account, and for informing us of their wish to cancel their account.

12 - HOLDER RIGHTS IN RELATION TO THEIR DATA.

The holder may exercise the rights below at any time and free-of-charge by sending an email to dpo@vibrahotels.com with the subject line “Data Protection” and by attaching a photocopy of their ID document:

a) To revoke the consent given to personal data processing and communication.
b) To obtain information about the processing of personal data or lack thereof.
c) To access their personal data.
d) To rectify inaccurate or incomplete data.
e) To request cancellation of their data when the data is no longer required for the purposes it was collected.
f) Restrict data processing once any of the conditions established in the data protection regulations are fulfilled.
g) In certain circumstances and for reasons pertaining to their personal situation, interested parties may object to their data being processed.
h) Request the portability of your data.
i) File a complaint before the Spanish Data Protection Agency at the following address: Calle de Jorge Juan, 6, 28001 Madrid, if you believe that the Data Controller has infringed upon the rights granted by data protection regulations.

The interested party may contact the Data Protection Officer: o E-mail: dpo@vibrahotels.com