PRIVACY POLICY

PRIVACY POLICY FOR HBX GROUP’ WEBSITE

Last version: May 2024

In accordance with applicable data protection regulations, this Privacy Policy is intended to help you understand the following:

DATA CONTROLLER

The Data Controller for the processing of the personal data you have provided us is HBX Group Spain, S.L.U. (hereinafter "HOTELBEDS"), with registered office at Camí Son Fangos, 100, Palma de Mallorca.

DATA PROTECTION OFFICER

HOTELBEDS belongs to a group of companies, referred altogether as HBX Group (hereinafter, “HBX Group”). HBX Group has a Global Data Protection Officer to respond to any queries, requests or clarifications regarding the processing of personal data that may be made by HBX Group in the following email address dataprotection@hotelbeds.com or at our postal address, mentioned in the paragraph above.

HOW DID WE OBTAIN YOUR DATA?

The personal data processed shall be those that you provide to us through the various channels that HBX GROUP makes available to you.

However, for compliance purposes and KYB (Know Your Business) activities, we shall obtain personal data from third parties like service providers for fraud detection.

Also, when you visit the HBX GROUP site various technologies are used to collect and store information and this may include the use of cookies or similar technologies to identify your browser or device. HBX GROUP also uses these technologies to collect and store information when you interact with services offered by HBX GROUP or other features. You can obtain more information about how HBX GROUP process personal data obtained through cookies or as a result of your browsing in the event that you accept the installation of cookies (for more information about cookies on the Website, visit our Cookies Policy ).

WHAT PERSONAL DATA DO WE PROCESS, FOR WHAT PURPOSE AND FOR WHAT REASON

These purposes are listed below depending on which category of data subject you are, indicating which data shall be processed (type of data) and for what reason or on what basis (legal basis). Likewise, we may also process any additional data that you provide us with or that is generated in the course of your relationship with HBX GROUP for the purposes set out above.

CLIENTS AND POTENTIAL CLIENTS
TYPE OF DATA	PURPOSE AND LEGAL BASIS
The following: Identification data: name, surname, passport number. Contact data: e-mail, telephone number.	Performance of a contract between you and/or the company you represent and HBX GROUP or application of pre-contractual measures: Manage the contractual relationship with you and ensure the provision of the contracted products and services, which includes both the management of services offered by HBX GROUP, as well as the service quality, billing, collection and withdrawal of the same. Manage the commercial relationship with potential clients, attending to requests for information on products and services offered by HBX GROUP. Manage and process any legal claims, out-of-court claims and insurance claims received by HBX GROUP in relation to you. b) Legitimate interests of HBX GROUP: Carry out commercial communications related to products and services similar to those contracted by you. In this case, the legitimate interest of HBX Group would be to carry out direct marketing activities aimed at its clients, in accordance with Recital 47 of the General Data Protection Regulation. Conduct surveys and market studies to know the quality of our products or services and the preference of our clients. The legitimate interest of HBX GROUP is to improve the commercial offer and experience to its clients.
PROVIDERS AND POTENTIAL PROVIDERS
TYPE OF DATA	PURPOSE AND LEGAL BASIS
The following: Identification data: name, surname, passport number. Contact data: e-mail, telephone number.	Performance of a contract between you and HBX GROUP or application of pre-contractual measures: Manage the commercial relationship with potential providers, attending to requests for information. Formalize the contractual relationship, which includes the contracting process and signature of the contracts. Manage the contractual relationship with the providers of HBX GROUP, which includes tracking the relationship and payment to them.
CANDIDATES
TYPE OF DATA	PURPOSE AND LEGAL BASIS
Those data requested in the Website and, among others: Identification data: name, surname, age, Curriculum Vitae and/or cover letter. Contact data: email, telephone number, address. Additional data that we can get from the recruiting process. The data generated during the selection processes in which you participate shall also be processed, which implies the possibility of performing an analysis of your personal profile in order to assess your suitability for the corresponding vacancy. Among such additional data, the following may be processed data published on social networks whose privacy settings are not restricted to third parties and/or data published on the Internet.	Performance of a contract between you and HBX GROUP or application of pre-contractual measures: Manage the personnel selection process of HBX GROUP, which will include the revision of the Curriculum Vitae and the conduct of personal interviews. Formalize the contractual relationship, which will include the contracting process and signature of contracts and labor agreements. With your consent: We will keep your profile active as a candidate during a 2 years period for futures job offers.
HBX GROUP CORPORATE CONTACTS
TYPE OF DATA	PURPOSE AND LEGAL BASIS
Personal data that you provide to us in your contact by email, such as: Identification data: name, surname. Contact data: email, telephone number. Data related to the relationship established with HBX GROUP.	The legitimate interest of HBX GROUP derived from the contact for corporate purposes with the data subjects, which is expressly recognized by the privacy regulations, where applicable. The purpose is: To maintain relations of any kind with the company, entity or organization for which you work or collaborate, or with you if you are an independent professional, who contact through the Website or any form, communication channel or email box. Even through the delivery of business cards to HBX GROUP staff.
GENERAL CONTACT
TYPE OF DATA	PURPOSE AND LEGAL BASIS
Personal data that you provide to us in your contact by email.	Legitimate interest on answering your question and/or claim. To deal with requests, queries or complaints through the sections and contact forms on the Website or through other channels such as email for general information about the Website or call centers.
WEB / PLATFORM USERS
TYPE OF DATA	PURPOSE AND LEGAL BASIS
Navigation data Technical data IP address	The processing of your personal data is legitimized by the express consent you give us through the cookie banner made available by HBX GROUP. You may withdraw your consent at any time in accordance with the information provided in our Cookies Policy . However, HBX GROUP may process information obtained through cookies or similar technologies without your consent as long as it is anonymized or aggregated information that does not contain any attribute that can identify directly or indirectly. The purpose is: To personalize and segment the content of the Website through the use of cookies or similar technologies when these are consented to by the user through the corresponding banner.
KNOW YOUR BUSINESS AND COMPLIANCE
TYPE OF DATA	PURPOSE AND LEGAL BASIS
We obtain the following data directly from you: Identification data: name, surname, passport number. Contact data: e-mail, telephone number. Those personal data that you provide us and that are generated in the relationship. We obtain the following data from third parties: Data used to identify individuals, such as names, identification documents. Information about business activities, such as affiliation with and ownership of businesses, employment/role details. When authorised by law, information about court judgments and criminal activity, such as details of offences and court dispositions. When authorised by law, sanctions lists, watch lists and lists of politically exposed persons, including your presence on such lists and you (or your family members’ or business associates’) affiliations with government officials. Information from public media, such as information in published news sources that may reveal connections to suspected criminal activity. Family circumstances information (e.g. your marital status and dependents) if you are a Politically Exposed Person or a close associate of a Politically Exposed Person. Professional and personal affiliations (for example, organisations and individuals that you may be associated with in your professional or personal capacity).	The processing of your personal data is legitimized by HBX Group’s legitimate interest when HBX Group is interested in concluding a deal with a third party as follows. The purpose of this processing is to screen individuals to prevent and detect fraud, terrorism, money laundering, bribery and corruption, and other crimes by conducting checks against databases like WorldCompliance and Accuity provided by LexisNexis or other similar service providers.
SOCIAL MEDIA USERS
TYPE OF DATA	PURPOSE AND LEGAL BASIS
Those personal data that allow us the privacy policy of the social network in which you have an account / user profile, as well as the privacy settings you have as a user of that social network. This data depends on your own privacy settings of the social network and the privacy policy of that social network.	HBX GROUP has active profiles in different social networks, the following personal data processing are applicable to persons who become HBX GROUP stakeholders by being a member, following or being part of such profiles. Performance of the obligations arising from your status as a registered user of the social network and the conditions of use of such social network: Interaction of your profile in the corresponding social network with HBX GROUP, including responding to queries, comments posted on public profiles.
APPLICABLE TO ALL DATA SUBJECTS
TYPE OF DATA	PURPOSE AND LEGAL BASIS
Those personal data that you provide us and that are generated in the relationship.	Fulfilment of our civil, commercial, tax, accounting and legal obligations related to compliance with personal data protection regulations, among others that may be applicable.

WHEN AND WHY DO WE DISCLOSE YOUR PERSONAL DATA TO THIRD PARTIES?

Personal data may be communicated to the following recipients, for the reasons explained below:

RECIPIENT	PURPOSE	LEGAL BASIS
Public administrations; Courts and tribunals; Law enforcement agencies	For the fulfilment of the legal obligations to which HBX GROUP is subject for the development of its activity, and in the cases provided by law, including the obtaining of subsidies and public aid.	Fulfil a legal obligation.
Accounting audit firms	To comply with the legal obligations of account auditing to which HBX GROUP is subject due to its activity.	Fulfil a legal obligation.
Third parties providing screening and compliance data base services	To screen individuals to prevent and detect fraud, terrorism, money laundering, bribery and corruption, and other crimes by conducting checks against databases like WorldCompliance and Accuity provided by LexisNexis or other similar service providers.	The legitimate interest of HBX Group in concluding a deal with a third party.
Companies that are part of HBX Group	We may communicate the data to the other Group companies with the purpose of being able to offer the best service for you taking into consideration your allergies and/or special needs and other administrative purposes.	The legitimate interest of HBX GROUP recognized by the applicable regulations on data protection.
Third parties interested in acquiring all or part of the capital stock of HBX GROUP.	Analysis and execution of commercial operations in which HBX GROUP may be involved due to structural modifications or transfer of business.	Legal empowerment by article 21 of the Organic Law on Data Protection and Guarantee of Digital Rights.

In addition to suppliers who need access to your data for the provision of services that HBX GROUP has contracted to these suppliers, and with which HBX GROUP has signed confidentiality agreements and processing of personal data necessary and required by law to protect your privacy.

From HBX GROUP we shall not share your data with other third parties without first obtaining your consent, except in those cases where it is necessary for compliance with legal or contractual obligations to which HBX GROUP is subject at all times by its nature and activity.

If in the future HBX GROUP shall make other communications of personal data, it shall inform you in a timely manner.

INTERNATIONAL DATA TRANSFERS

HBX GROUP may hire the services of suppliers located in countries outside the European Economic Area, based on decisions of adequacy of the European Commission. In this case, it is considered that the country has equivalent regulations to the European one. In the event that HBX GROUP needs to hire services from suppliers located in countries that do not have regulations equivalent to the European, the contracting shall include all the guarantees and safeguards required by the regulations to preserve your privacy, after verification of the legislation of the destination country.

Such safeguards may consist of the application of contractual clauses and additional guarantees to them, in accordance with the regulations of each destination country, or of binding corporate rules approved by the data protection authorities. We also inform you that the regulations allow us to send your data to such countries, if it is necessary to comply with our obligations arising from the service you request from us.

Likewise, we inform you that the HBX may have companies outside the European Union. In those cases, HBX Group requires that these companies comply with the appropriate measures to protect your personal data following the European regulations.

For more information about the guarantees to your privacy, or the destination countries to which we need to transfer your data to fulfil our contractual obligations to you, you can contact HBX GROUP, through the addresses indicated in the "How can you exercise your rights" section of this Privacy Policy.

AUTOMATED DECISIONS

HBX GROUP does not make decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the above-described processing purposes are carried out with human intervention.

The profiling indicated in the purposes of candidate management, in no case shall be used in making decisions by our entity that may have legal effects for you or that may affect you significantly.

FOR HOW LONG DO WE KEEP YOUR DATA?

We shall only keep your personal data for as long as we need it for the purposes for which we collect it and to comply with legal, financial, business or reporting requirements or until your consent withdrawal. In some circumstances, we may anonymize personal data so that it is no longer identifiable, and we can continue to use it. When we no longer need the personal data, we shall securely delete or destroy it.

HBX GROUP shall retain the data collected to carry out the above purposes for the duration of your relationship with HBX GROUP and, even thereafter, until the statute of limitations on any legal liability arising there.

HOW CAN YOU EXERCISE YOUR RIGHTS?

You may exercise, with respect to the data collected, the rights of access, rectification, opposition, deletion, limitation and portability of data, in accordance with the regulations on data protection and withdraw your consent.

These rights may be exercised by sending a communication:

To the e-mail dataprotection@hotelbeds.com with the subject "Data protection"; or

By any postal means with which there is evidence of receipt by HBX GROUP, addressed to the following address: to Camí Son Fangos, 100, Palma de Mallorca indicating on the envelope the reference "Data Protection".

Also, if you consider that the processing of your personal data violates the regulations or your privacy rights, you can file a complaint:

via the postal and e-mail addresses indicated above, or
before the Spanish Data Protection Authority, by accessing www.aepd.es or at the address Calle Jorge Juan, 6, 28001, Madrid.

CHANGES, MODIFICATIONS OR UPDATES

HBX GROUP reserves the right to revise this Privacy Policy at any time it deems appropriate, in order to reflect regulatory changes, best practices or update the processing activities of personal data. You shall be informed of such updates in accordance with regulatory requirements, in the event that your rights are significantly affected as a result of such modification or update.