Privacy Policy

In compliance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Organic Law on Data Protection and Digital Rights Guarantee 3/2018 (LOPDGDD), ESCUELAS PIAS PROVINCIA EMAUS (RESIDENCIA ALBERGUE JACA), hereinafter DATA CONTROLLER, presents its policy regarding the processing and protection of personal data, which will apply to those individuals who voluntarily communicate through email with the DATA CONTROLLER, fill out data collection forms, formalize a contractual relationship with the DATA CONTROLLER, or use any other service available on the website that involves the communication of data to the DATA CONTROLLER or accessing the services of the DATA CONTROLLER will imply the express acceptance of this policy.

These conditions will also apply in a subsidiary manner to those others that may be established, with a special nature, and communicated, not exclusively, through registration forms, contracts, and/or specific service conditions, with these current policies serving as complementary to the previous ones in cases not expressly provided for and that do not contradict them.

Sending an email to the DATA CONTROLLER, or communicating any other personal data to the DATA CONTROLLER through any means, entails or implies the provision of free, unequivocal, specific, informed, and express consent for the processing of personal data by the DATA CONTROLLER, which will be carried out with the purpose of addressing the communications received.

The DATA CONTROLLER informs the user of the website of the existence of a processing of personal data, the characteristics of which are detailed below:

Who is responsible for the processing of your data?

  • Identity: ESCUELAS PIAS PROVINCIA EMAUS (RESIDENCIA ALBERGUE JACA)
  • Tax ID: R5000029H
  • Postal address: Avenida Perimetral nº2 – 22700 – Jaca (Huesca)
  • Phone: 974360536
  • Email: alberguejaca@escolapiosemaus.org

For what purpose do we process your data?

We process your data for the purpose of allowing navigation on the website, ensuring its proper functioning and security, managing reservations and payments, and addressing user queries.

The processing includes:

  • Ensuring the proper functioning and security of the website, including user session management, prevention of unauthorized access, protection against computer attacks or fraud, and maintenance of the availability and stability of the services offered.
  • Collecting and analyzing navigation data, such as IP address, cookies, and access logs, for statistical purposes, improving the user experience, optimizing content, security, and incident prevention, always respecting user preferences and cookie settings.
  • Managing voluntary user interactions, such as queries through contact forms, comments, or newsletter subscriptions, allowing for effective responses to these requests and maintaining a transparent communication channel.
  • Managing the contractual relationship with customers, including the receipt, processing, and confirmation of reservations, billing, payments, additional services management (breakfast, activities, extras), issuing receipts, post-sales support, and any activity necessary to fulfill the contracted accommodation service.
  • Complying with legal and regulatory obligations, including:
    • Registering travelers with the competent authorities according to current regulations
    • Retention of data for tax and accounting purposes
    • Information communication to authorities if required by law
  • Managing commercial and marketing communications, provided there is prior consent from the interested party, allowing for the provision of information about services, promotions, or news related to the accommodation activity.
  • Informing individuals about their rights, facilitating the exercise of these rights, and ensuring transparency about the use of their personal data, including the communication of privacy policies, terms of use, and cookie settings.

What categories of data do we process?

The following categories of personal data will be processed:

  • Identifying data: name, surname
  • Contact data: email, phone
  • Navigation data: IP, cookies, logs
  • Reservation data: dates, room type, additional services
  • Payment data: banking or card information (processed by external gateways)
  • Official identification data: ID card, passport, or equivalent document (for traveler registration)
  • Content of messages, comments, or forms

Are automated decisions made?

No automated decisions are made or profiles generated automatically.

How long will we keep your data?

  • Navigation data (cookies): according to the cookie policy
  • Access logs: maximum 12 months
  • Form data, comments, or subscriptions: during the management and, at most, 1 year if no contractual relationship is formalized
  • Customer and reservation data: during the contractual relationship, then:
    • 5 years for civil liabilities
    • 4 years for tax obligations

Once the deadlines have expired, the data will be deleted or blocked, remaining available to authorities during the legal periods.

What is the legal basis for processing your data?

The legitimate interest basis, as stated in Article 6.1.f of the GDPR, enables the use of technical and security cookies, as well as activities aimed at preventing fraud and unauthorized access. These measures are strictly necessary for the proper functioning of the website and to ensure a secure environment, allowing for the detection of malicious behaviors or unauthorized access. Being essential for the integrity of the site and the protection of users, they do not require prior consent, although this should be clearly communicated in the cookie policy.

On the other hand, user consent, based on Article 6.1.a of the GDPR, is the legal basis for all non-essential cookies, such as analytics, behavioral advertising, or integration with social networks. In these cases, the website owner must obtain affirmative and clear action from the visitor before installing any files on their device, allowing them to accept or reject these purposes in a granular manner. This same consent legitimizes the processing of data collected through contact forms, queries, comments, or subscriptions, where the user takes a positive action (e.g., checking an unchecked box) confirming that they have read and accepted the privacy policy.

Furthermore, the performance of a contract, covered by Article 6.1.b of the GDPR, is the legal basis that allows for the processing of personal data in the context of accommodation reservations. This authorization allows the company to manage customer information to process the reservation, confirm availability, make the payment or payment management, issue receipts or invoices, and provide the contracted accommodation service. As this is a necessary step to comply with the terms and conditions of the reservation accepted by the user, the processing of this data is mandatory to complete the transaction and the provision of the service correctly.

Finally, compliance with legal obligations, under Article 6.1.c of the GDPR, requires the company to process and retain certain customer data after making a reservation to comply with current regulations. This particularly includes obligations to register travelers with the competent authorities, as well as tax and accounting obligations, such as tax declarations or keeping accounting records required by current regulations. In these cases, the law imposes on the controller the duty to maintain the information for the corresponding legal prescription periods, ensuring its availability for possible inspections, audits, or requests from Public Administration.

To which third-party recipients will your data be communicated?

Your personal data may be communicated to third parties when necessary for the fulfillment of the described purposes, as well as in legally provided cases. In particular, they may be communicated to:

  • Financial institutions: for the management of payments and collections derived from accommodation reservations, only to the extent necessary for the execution of the transaction.
  • Public Administration: when necessary to comply with applicable legal obligations, such as those arising from tax, accounting regulations or other applicable regulations.
  • Competent authorities, judicial bodies, and Security Forces and Bodies: to comply with legal obligations such as traveler registration and other obligations arising from the regulations applicable to the tourism sector.

Which data processors process your data?

For the provision of services necessary for the development of the activity, the DATA CONTROLLER has providers that have entered into data processor contracts in accordance with Article 28 of the GDPR, such as:

  • Data processor located in Madrid for the maintenance of the website service.

These contracts regulate the access and processing of personal data by these providers.

Are there international transfers of your data?

Data transfers to data processors, joint controllers, or recipients in third countries or international organizations not established in the European Union are considered international data transfers.

Your personal data is not transferred to organizations not established in the European Union.

What security measures do we implement to protect your data?

We will treat the data at all times in an absolutely confidential manner and will maintain the corresponding duty of secrecy regarding them, in accordance with the provisions of the applicable legislation, adopting the necessary technical and organizational measures that guarantee the security of your data and prevent their alteration, loss, processing, or unauthorized access, considering the state of technology, the nature of the stored data, and the risks to which they are exposed.

What are your rights when you provide us with your data?

You have the right to request from the Data Controller:

  • 1) Access: Know what personal data of yours we are processing.
  • 2) Rectification: Request the modification of your data when they are inaccurate or incomplete.
  • 3) Objection: Request the cessation of processing when it is based on legitimate interest or public interest, for reasons related to your particular situation, unless there are compelling legitimate reasons or it is necessary for the formulation, exercise, or defense of claims.
  • 4) Deletion: Request the deletion of your personal data, without prejudice to blocking them for compliance with legal obligations.
  • 5) Portability: Receive your data in a structured, commonly used, machine-readable format, or request their transmission to another controller when the processing is based on consent or a contract and is carried out by automated means.
  • 6) Restriction of processing: Request the restriction of the processing of your data in legally provided cases, such as while verifying the accuracy of the data, the legality of the processing, or the prevalence of legitimate reasons.

You can exercise your rights by sending a written request to the addresses (postal or electronic) indicated in this document. The request must be clear and include a contact method. In case of reasonable doubt about your identity, a copy of an official document may be required for verification.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with current regulations.

Accuracy and truthfulness of data

The data subject guarantees that the personal data provided is true and accurate. In order for the information contained in our files to be always up to date and not contain errors, the data subject undertakes to communicate, as soon as possible, any modifications and rectifications of their personal data.

The DATA CONTROLLER will comply with its duty of accuracy by promptly deleting or rectifying any data that proves to be inaccurate in relation to the purposes for which it is processed, whenever it is aware of such inaccuracy or has been notified by the data subject.

Modifications

The DATA CONTROLLER reserves the right to modify this information to adapt it to any relevant legislative updates or to new data processing that may be carried out in the future. In these cases, the changes introduced will be communicated to the interested parties with a reasonable advance notice before they come into effect.

[Updated on April 6, 2026]