Privacy Policy

This privacy policy explains how Grupo Zaragoza Urbana, S.A. processes and protects the personal data of users, clients, potential clients, participants in promotions, loyalty program members, event attendees, and other individuals associated with Palafox Hoteles through the website, forms, reservations, electronic communications, or hospitality services.

The processing of personal data is carried out in accordance with the Regulation (EU) 2016/679, General Data Protection Regulation, and the Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights.

Data Controller

Controller: Grupo Zaragoza Urbana, S.A.
CIF: A-50000918
Address: Edificio Capitán Portolés, Calle Antonio Val-Carreres, 1-3-5, 50004 Zaragoza
Contact email for privacy issues: gpdr@zaragozaurbana.com

Purposes of Processing

Grupo Zaragoza Urbana, S.A. may process personal data for the following purposes:

1.- Address inquiries, questions, and communications received through the website, email, phone, or other contact channels.

2.- Manage requests related to events at our facilities, including weddings, baptisms, communions, celebrations, meetings, conferences, banquets, and other related services.

3.- Offer conditions, rates, or special prices to companies, self-employed individuals, and clients traveling for professional reasons or requesting hospitality services, restaurants, meeting rooms, business centers, equipped offices, or other business services.

4.- Manage reservations, stays, check-in, check-out, billing, customer service, contracted services, issues, preferences communicated by the client, and other activities typical of hotel management.

5.- Manage participation in promotions, campaigns, contests, or draws organized by Grupo Zaragoza Urbana, S.A. or entities associated with Palafox Hoteles, when the user decides to participate.

6.- Send commercial communications about news, services, offers, and special promotions, provided there is a valid legal basis for it, including the consent of the interested party when necessary.

7.- Manage programs, clubs, or exclusive benefits for clients or members of Palafox Hoteles.

8.- Carry out video surveillance activities at the facilities, aiming to preserve the security of people, property, furniture, infrastructure, and premises.

9.- Fulfill legal obligations applicable to the hospitality, tax, accounting, administrative, citizen security, consumer, fraud prevention, and response to requests from competent authorities.

10.- Manage complaints, legal inquiries, exercise or defense of rights, and compliance with contractual or legal responsibilities.

Categories of Data Processed

Depending on the purpose and the relationship with the interested party, the following categories of data might be processed:

1.- Identifying data: first name, last name, DNI/NIE/passport, or other identifying documents when necessary.

2.- Contact data: postal address, phone number, email, and professional contact data.

3.- Reservation and stay data: check-in and check-out dates, room, contracted services, preferences communicated by the client, incidents, special requests, and data necessary for service provision.

4.- Economic and billing data: payment data, card data when applicable according to payment systems used, billing data, and transactions.

5.- Professional or business data: company, position, corporate billing information, meeting or professional event needs.

6.- Event-related data: information necessary to organize celebrations, banquets, meetings, ancillary services, number of attendees, operational needs, and contact data for involved persons.

7.- Promotion and loyalty data: data necessary to manage registrations, participation in campaigns, clubs, benefits, or promotions.

8.- Images captured by video surveillance systems: when the interested party accesses duly signposted video-monitored areas.

9.- Data derived from electronic communications: data generated when contacting us or interacting with commercial communications, when applicable.

Specially protected data will not be requested unless strictly necessary, with sufficient legal basis, and specific information is provided to the interested party.

Legal Basis for Processing

The legal basis will depend on each processing operation:

1.- Execution of a contract or pre-contractual measures: for managing reservations, service requests, quotes, events, stays, billing, and provision of hotel or ancillary services.

2.- Consent of the interested party: for sending commercial communications when required, participation in promotions or draws, subscription to loyalty programs when applicable, and use of non-technical cookies in accordance with the cookies policy.

3.- Fulfillment of legal obligations: to comply with obligations in hotel, tax, accounting, administrative, citizen security, and consumer matters, addressing requests from authorities and retaining legally required documentation.

4.- Legitimate interest: for addressing inquiries, preventing fraud, improving services, conducting commercial communications to clients in cases permitted by applicable regulations, protecting facilities through video surveillance, and exercising or defending claims, always balancing the rights and freedoms of the interested parties.

Data Retention

Personal data will be retained for as long as necessary to fulfill the purpose for which they were collected and subsequently for the periods necessary to address possible legal, contractual, administrative, or tax liabilities.

In particular:

1.- Data related to inquiries and requests will be retained for the time necessary to address them and carry out follow-up, and subsequently for the applicable prescription periods.

2.- Data related to reservations, stays, contracted services, and billing will be retained during the contractual relationship and for the applicable legal periods.

3.- Data processed for commercial communications will be retained until the interested party withdraws their consent or exercises their right to no longer receive them, without prejudice to the minimum retention necessary to document such withdrawal or objection.

4.- Data related to promotions, draws, or campaigns will be retained for the duration of the promotion and the period necessary to address liabilities arising from it.

5.- Data associated with loyalty programs will be retained while the interested party maintains their status as a member or user of the program, and subsequently for the applicable liability periods.

6.- Images captured by video surveillance systems will be retained, generally, for a maximum period of one month, unless they need to be retained longer to document acts against the integrity of persons, property, or facilities, or when required by competent authorities.

Data Recipients

Personal data may be communicated to the following recipients when necessary for the indicated purposes or when there is a legal requirement:

1.- Companies in the group or linked to Palafox Hoteles that participate in the provision of hospitality services, restaurants, banquets, catering, events, promotions, customer service, or administrative management.

2.- Compañía Inmobiliaria y de Inversiones, S.A., for hotel and customer management, when applicable.

3.- Zarpar 98, S.L., for the management of customers and services related to catering, banquets, and catering, when applicable.

4.- Hotel Playa Victoria, S.A., for hotel management, catering services, and customer management, when applicable.

5.- Franchises or collaborative entities in catering, when involved in providing services requested by the client.

6.- Third parties providing complementary activities or services requested by the client, such as wedding planners, bicycle rentals, or other associated services.

7.- Technology providers, reservation platforms, payment gateways, web hosting providers, IT maintenance, marketing, communication tools, and other data processors that provide services to Grupo Zaragoza Urbana, S.A. under contract and the guarantees required by applicable regulations.

8.- Public administrations, law enforcement, courts, tribunals, supervisory authorities, and other competent bodies where there is a legal obligation or valid requirement.

Unless there is a legal obligation, contractual necessity, or sufficient legal basis, personal data will not be transferred to third parties unrelated to the described purposes.

International Transfers

When using technology providers located outside the European Economic Area or involving international data transfers, Grupo Zaragoza Urbana, S.A. will adopt the appropriate safeguards required by data protection regulations, such as adequacy decisions, standard contractual clauses, or other valid mechanisms.

Security and Confidentiality

Grupo Zaragoza Urbana, S.A. will treat personal data confidentially and apply appropriate technical and organizational measures to prevent alteration, loss, unauthorized processing, or access, considering the state of technology, the nature of the data, and the existing risks.

However, no system is absolutely invulnerable. In the event of a security breach affecting personal data, actions will be taken in accordance with the procedures required by applicable regulations.

Rights of Data Subjects

The data subject can exercise the following data protection rights:

1.- Right of access to their personal data.

2.- Right to rectification of inaccurate or incomplete data.

3.- Right to erasure when data is no longer necessary or other legal grounds arise.

4.- Right to object to processing in legally stipulated cases.

5.- Right to request the restriction of processing.

6.- Right to data portability, where applicable.

7.- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior.

To exercise these rights, the data subject can send a request to lopd@palafoxhoteles.com, indicating the right they wish to exercise and providing necessary information to verify their identity.

If they believe their personal data has not been handled appropriately, they may file a complaint with the Spanish Data Protection Agency.

Commercial Communications

The user may receive commercial communications from Grupo Zaragoza Urbana, S.A. when they have provided consent or when there is another valid legal basis according to applicable regulations. Each communication will offer a simple and free means to unsubscribe or opt-out from receiving further commercial communications.

Video Surveillance

The facilities may have duly signposted video surveillance systems. Images are processed to preserve the safety of people, property, and facilities. The legal basis will be the legitimate interest of the controller, without prejudice to any applicable legal obligations.

Images are retained for a maximum period of one month, unless they need to be kept to document relevant events or at the disposal of competent authorities.

Health Treatments or Extraordinary Measures

If at any time Grupo Zaragoza Urbana, S.A. must apply extraordinary health measures involving personal data processing, the data subject will be informed in advance about the purpose, legal basis, data processed, retention period, and applicable rights.

Modification of the Privacy Policy

Grupo Zaragoza Urbana, S.A. may modify this privacy policy to adapt it to regulatory changes, control authorities’ criteria, sector practices, or changes in processing activities. When changes are significant, users will be informed appropriately.