Policy on Privacy

1. Data controller

The data controller for the personal data you provide through the website <www.hipartners.com&gt; (“Website”) is Hotel Investment Partners, S.A., with registered address at Edificio Planeta. Avda. Diagonal 662-664, Planta 2, 08034 Barcelona, and email address info@hipartners.com (“HIP” or “Company”).

Additionally, this privacy policy also applies to the subsidiaries of or managed by HIP, which are listed here, all of which have their registered office at Edificio Planeta. Avda. Diagonal 662-664, Planta 2, 08034, Barcelona, Spain (“HIP Group”). For these purposes, when you access this privacy policy to obtain information or communicate with any of the HIP Group companies, the latter shall be considered the data controller. In these cases, HIP shall be considered the data processor, in accordance with the instructions given to it by the corresponding HIP Group company in its capacity as data controller and this Privacy Policy.

HIP and the HIP Group companies have appointed a Data Protection Officer who can be contacted at the following email address: dpo@hipartners.com.

You may contact the DPO to consult on matters relating to the processing of your personal data, as well as to exercise your data protection rights, as detailed in this Privacy Policy.

For the purposes of this Privacy Policy, HIP and the HIP Group companies will not act as joint controllers. In the event that, for a specific processing, there is joint controllership between HIP and any HIP Group company or third parties, such joint controllership will be formalized in accordance with the provisions of Article 26 of the GDPR and the data subjects will be duly informed, with the essential aspects of the joint controllership agreement being made available to them.

2. Purposes of processing and lawful bases for processing

The data controller (whether HIP and/or, where applicable, the HIP Group companies) processes the personal data you provide for the following purposes:

  • To manage relations with customers and potential customers, as well as with any interested party who contacts the data controller. The lawful basis for this processing is the existence of a contractual or pre-contractual relationship, or the legitimate interest of the controller in responding to queries when the aforementioned bases do not prove applicable.
  • To receive and evaluate CVs of candidates for positions of employment, as well as to manage the internal database of applicants and, if a vacancy is found that matches their profile, to contact them. The lawful basis for the inclusion of the applicant's data in the controller's employee database is the consent of the data subject, as well as the application of pre-contractual measures in the stages of the selection process prior to hiring.
  • To send you information about our products or services, including by electronic means. The lawful basis for this processing is your prior consent given by checking the corresponding box or, as the case may be, and as long as you do not object, the legitimate interest of the controller in sending you such information due to the existence of a prior commercial relationship with you.
  • The data controller may process your personal data for the purpose of to attending to and investigating reports received through the Whistleblower’s Channel. You can access the privacy policy of the HIP Ethics Channel and the HIP Group companies via this link.
  • The data controller also uses its own and third-party cookies to ascertain and analyse the use of its website, as well as to adapt and improve its content. You can obtain more information about the controller's use of cookies, and hot to accept, reject, or configure them by means of the buttons provided in the controller's Cookie Policy via this link.

Neither HIP nor the HIP Group companies make automated decisions that may affect you based on the personal information they process.

3. Recipients and international transfers of data

The personal data provided may be communicated to other companies in the group for internal administrative purposes or, when necessary, to comply with the existing contractual relationship with the data subject, for example, to hotels that are part of the group. When necessary, HIP or the relevant HIP Group companies will provide you with further information about the processing of your data.

Apart from this, the data controller has service providers who act as data processors and assist us in the internal management of the company, both in the operation of the business and in its administration. The data controller has signed the corresponding agreements with them to regulate the processing of personal data, in accordance with data protection regulations. In certain situations, HIP may also provide services to other companies in the group, acting in such cases as a processor.

In the event that the data controller must transfer your personal data outside the European Economic Area, it will ensure that such transfers are made with the appropriate safeguards to ensure an adequate level of security in terms of data protection. These safeguards may include, without limitation, the existence of an Adequacy Decision of the European Commission (EC), the adoption of standard contractual clauses also approved by the EC, or the application of any other mechanism recognized by current data protection regulations.

Finally, when there is a legal obligation, we may have to communicate your data to third parties, such as courts and tribunals, State security forces or bodies, and the public prosecutor's office, as well as consultancy and legal advisory firms for the formulation, exercise, or defence of claims.

4. Retention periods

The data controller will retain your personal data for as long as necessary to fulfil the purpose for which it was collected.

In any case, the personal data you provide through the spontaneous application process will be kept in our databases for a period of one year, with the possibility of this retention period being renewed if we have your consent.

Once the purposes have been fulfilled, the data controller will keep the personal data duly blocked to the extent that liabilities may arise for the data controller or any of the companies in the group or when required by applicable regulations.

5. Rights of data subjects

In accordance with the legal obligations established in the applicable data protection regulations and in the terms provided therein, you can exercise your rights of access, rectification, erasure, restriction, objection and portability by sending an email to dpo@hipartners.com, or by post to Edificio Planeta. Avda. Diagonal 662-664, Planta 2, 08034 Barcelona.

If you have given your consent for any purpose, you may likewise withdraw that consent freely and at any time, without any adverse consequence for you.

In any case, you have the right to file a complaint with the competent data protection authority in relation to the processing carried out by the data controller. Depending on the jurisdiction, these are as follows:

  • In Spain: Spanish Data Protection Agency (www.aepd.es)
  • In Portugal: Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt)
  • In Italy: Autorità Garante per la protezione dei dati personali (www.garanteprivacy.it)
  • In Greece: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (www.dpa.gr/en)