Privacy policy

In accordance with Spanish Organic Law 3/2018 of 5 December on Data Protection and the Guarantee of Digital Rights (LOPDGDD), this policy explains how we process your personal data.

Who is the data controller?

You can contact us by any of the means above.

We reserve the right to amend or update this Privacy Policy at any time. We recommend that you check it regularly; if you have registered and log in to your account or profile, we will notify you of any changes.

Please see the section below that applies to you:

Guests

Why do we process your personal data?

We process your data to manage your booking and your stay at the hotel, and to secure payment of the charges arising from your stay.

Your data will be disclosed to the law enforcement authorities as required by law, and to any travel agencies or tour operators involved.

We keep the data for at least 6 years to comply with tax, commercial and consumer protection law and the rules on guest registration.

What is our legal basis for processing your data?

The legal basis is your consent.

Website and email enquiries

What data do we collect through the website?

We may process, anonymously, your IP address, the operating system or browser you use and even the length of your visit. If you send us your details through the contact form, you will be identifying yourself so that we can get back to you if necessary.

Why do we process your personal data?

• To answer your enquiries, requests or questions.
• To manage the service you have requested, respond to your request or process your application.
• To send you information about your request by electronic means.
• To send you marketing or event information by electronic means, where you have expressly agreed to this.
• To analyse and improve the website, our products and our services, and to improve our commercial strategy.

What is our legal basis for processing your data?

The data subject’s acceptance and consent: where a request is made by filling in a form and clicking the ‘Send’ button, doing so means that the data subject has been informed of, and has expressly consented to, the data protection notice attached to the form, or has accepted the privacy policy.

Mandatory fields on all our forms are marked with an asterisk (*). If you leave them blank or do not tick the box accepting the privacy policy, the form cannot be sent. The box usually reads: ‘□ I am over 14 and I have read and accept the Privacy Policy’.

Suppliers

Why do we process your personal data?

• To send you information about your request by electronic means.
• To send you marketing or event information by electronic means, where you have expressly agreed to this.
• To manage the administrative, communications and logistics services carried out by the Controller.
• Invoicing and filing the relevant tax returns.
• Processing the relevant transactions.
• Credit control and debt recovery.

What is our legal basis for processing your data?

The legal basis is your acceptance of a contractual relationship or, failing that, your consent when you contact us or offer us your products by any means.

Social media contacts

Why do we process your personal data?

• To answer your enquiries, requests or questions.
• To manage the service you have requested, respond to your request or process your application.
• To interact with you and build a community of followers.

What is our legal basis for processing your data?

Your acceptance of a contractual relationship on the relevant social network, in accordance with its privacy policy:

• Facebook
• Instagram
• X
• LinkedIn
• Pinterest
• YouTube

How long do we keep your personal data?

Because we operate our own profile, we can only view or remove your data to a limited extent. We will process it for as long as you allow us to, by following us, being friends with us or clicking ‘Like’, ‘Follow’ or similar buttons. Any correction of your data, or any restriction of information or posts, must be made through your profile or account settings on the social network itself.

Job applicants

Why do we process your personal data?

• To run recruitment processes to hire staff.
• To invite you to job interviews and assess your application.
• If you have given us your consent, we may share your data with partner or associated companies, solely to help you find work.
• If you tick the box accepting the privacy policy, you consent to our sharing your application with the companies in our group so that they can include you in their recruitment processes.

We will securely destroy your CV one year after receiving it.

What is our legal basis for processing your data?

The legal basis is your unambiguous consent, given when you send us your CV.

Complaints and claims

Why do we process your personal data?

To record your complaint or claim so that we can deal with it.

What is our legal basis for processing your data?

The data subject’s acceptance and consent: where a request is made by filling in a form and clicking the ‘Send’ button, doing so means that the data subject has been informed of, and has expressly consented to, the data protection notice attached to the form, or has accepted the privacy policy.

Mandatory fields on all our forms are marked with an asterisk (*). If you leave them blank or do not tick the box accepting the privacy policy, the information in the form cannot be sent.

CCTV

Why do we process your personal data?

• To ensure security and control access to the premises.
• To monitor the work of employees and other similar staff.
• To assess the quality of our service.

What is our legal basis for processing your personal data?

Protection of the public interest.

Who may we disclose your personal data to?

To law enforcement authorities and/or the courts:

• Where criminal offences are committed, to establish serious misconduct, and in similar situations.
• To bring legal proceedings in exercise of our right to effective judicial protection.

How long do we keep your personal data?

For a maximum of 30 days.

Do we process personal data of third parties?

No. As a general rule, we only process data provided by the data subjects themselves. If you provide us with data relating to other people, you must first inform them and obtain their consent; otherwise, you release us from any liability for failure to meet this requirement.

What about children’s data?

We do not process data of children under 14. If you are under 14, please do not provide your data, and do not provide data of third parties under that age. ADRALÉS HOTELES, S.L. (HOTEL TRUITA) accepts no liability for any failure to comply with this provision.

Will we contact you electronically?

• Only to deal with your request, and only if that is one of the contact methods you have given us.
• We will only send you marketing communications if you have expressly agreed to them in advance.

How do we keep your data secure?

Rest assured that we have adopted a high level of protection for the personal data we handle, and have put in place all the technical means and measures available to us, in line with the state of the art, to prevent the loss, misuse, alteration, unauthorised access and theft of personal data.

Who will we share your data with?

We will not disclose your data to third parties unless required by law. Specifically, it will be disclosed to the Spanish Tax Agency (Agencia Estatal de Administración Tributaria) and to banks and financial institutions to collect payment for the services provided or products purchased, and to the data processors needed to perform the agreement.

If you make a purchase or payment using an app, website, platform, bank card or any other online service, your data will be disclosed to that provider or processed within its systems, always with the highest level of security.

Our web development and maintenance company and our hosting provider will have access to our website when we instruct them to. They are bound by a service agreement that requires them to maintain the same level of privacy as we do.

What are your rights?

• The right to find out whether or not we are processing your data.
• The right of access to your personal data.
• The right to rectification of your data if it is inaccurate.
• The right to erasure of your data if it is no longer necessary for the purposes for which it was collected, or if you withdraw your consent.
• The right to restriction of processing of your data in certain circumstances, in which case we will only retain it as permitted by applicable law.
• The right to data portability: to receive your data in a structured, commonly used or machine-readable format, or, if you prefer, to have us send it to another controller of your choice. This right only applies in certain cases.
• The right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority if you believe we have not handled your request properly.
• The right to withdraw your consent at any time for any processing to which you have consented.

If any of your details change, please let us know so that we can keep our records up to date.

Do you need a form to exercise your rights?

• We have forms for exercising your rights: just ask us by email or, if you prefer, use the forms published by the Spanish Data Protection Agency (AEPD) or by third parties.
• Where there is reasonable doubt as to the identity of the person making the request, the form must be signed electronically or accompanied by a copy of their ID card or passport.
• Forms may be handed in in person, or sent by post or email to the Controller’s address given at the beginning of this policy.

How long do we take to respond to a rights request?

It depends on the right, but no more than one month from receipt of your request, or two months if the request is particularly complex, in which case we will let you know that we need more time.

Do we use cookies?

If we use cookies other than strictly necessary ones, you can read our cookie policy via the link on our home page.

How long do we keep your personal data?

• We keep personal data for as long as you have a relationship with us.
• Once that relationship ends, the personal data processed for each purpose will be kept for the statutory periods, including any period during which a court may require it, having regard to the limitation periods for legal claims.
• Data will be kept until those statutory periods have expired, where there is a legal obligation to retain it or, where there is no such period, until the data subject requests its erasure or withdraws their consent.
• We will keep all information and communications relating to your purchase or to the provision of our services for as long as the guarantee on the products or services lasts, in order to deal with any claims.

Last updated: 28 May 2026

This is a courtesy translation. The Spanish version prevails.