New York in a CR7 Hotel

Privacy Policy

1. Personal data information

In accordance with current regulations on data protection conformed by Regulation (EU) 2016/679 General Data Protection (GDPR) and Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (LOPDGDD), we inform you of some questions about the processing of your personal information by Travel Compositor and INTERVISA- VIAGENS E TURISMO UNIPESSOAL, LDA.

1.1.-Whoare the personal data controllers for the data processing?

Corporate name: Travel Compositor S.L. (“Travel Compositor”)

NIF: B57876484

Address: Calle Puerto Rico. 15, 3º. 07006 – Palma, Illes Balears (España)

Contact: info@travelcompositor.com 

And in a joint controllership 

Corporate name: INTERVISA - VIAGENS E TURISMO UNIPESSOAL, LDA (“In”ervisa")

NIF:  502669152

Address: Rua Jau n.º 54, 1300-

314 Lisboa

Contact: dpo@pestana.com 

Jointly referred as “we” or “the personal data controllers” 

1.2.- What is the purpose of collecting and processing your data?

Provision of services: Travel Compositor collects your data to be able to manage your request about the services we offer that may include flights, accommodation, transportation, activities and transfers and communicates your data, namely, to Intervisa, in order to enable it to make the hotel’s reservation and its management.

Commercial communications: Whenever you give us your consent, we will process your contact information to send you information about our services and products, as well as offers and information that we think may be of interest to you. 

1.3.- How long do we keep your data?

Provision of services: As a general rule, your data will be kept until the end for which they were collected is achieved. In addition, for reasons of current tax legislation, Travel Compositor. will store

your data for a period of five years, and Intervisa will store your data for a period of ten years, after which we will destroy it if there is no request for conservation.

Commercial communications: In order to keep you informed of our products and services, the data processing for commercial purposes will remain with Travel Compositor until you exercise your right of opposition or deletion and with Intervisa during 5 (five) years. 

1.4.- Are automated decisions made about your data?

Yes, automated decisions about your personal data are planned.

1.5.-What is the legitimacy for the processing of your data?

The consent will be the basis of legitimation in those processing in which they have been required and you have granted it to us, for example, the sending of commercial communications.In the event that you have contracted certain services with us, the legal basis of the processing of your data is the contractual relationship that binds us and whose processing is essential for the execution of the services.In addition, different regulations in force such as the tax law establish that the personal data controllers must perform certain processing. In these cases, the legitimacy of the processing of your data will be based on an applicable legal obligation.

1.6.- Who do we communicate your data to?

There are third parties that manage part of our services. The personal data controllers require them to comply with this Privacy Policy and current regulations on data protection, as applicable. Where these third parties are deemed to be data processors for the purposes of processing personal data, Data Processing Agreements for the processing of personal data will be concluded.We also inform you that these companies have their own privacy policy in which Travel Compositor will not be responsible for compliance with it.Under some circumstances, Travel Compositor may share, use, preserve or disclose Personal Information with third parties, in a non-aggregated manner to provide our services to:

1.  Suppliers: Such as Intervisa, airline or activity rental providers, which satisfy your travel reservation request. All services provided by a third party provider are described as such. We recommend that you examine the privacy policies of any third party that provides travel services from whom you purchase products through Travel Compositor. Please note that these providers may also contact you as necessary to obtain additional information.

2. Service providers that provide services or perform functions on our behalf: Credit card processing, business analytics, customer service or marketing. Service providers may collect and access the information necessary to perform their functions, but they are not allowed to share or use the information for any

other purpose.

3.  Competent authorities: In some cases, we must cooperate with the competent authorities.

Thus:

3.1.  If we believe that it is reasonably necessary to satisfy any law or legal process anywhere in the world and we believe that doing so may diminish our responsibility or allow us to defend our legal rights. In any case, we will only provide the required information.

3.2. If we believe that this action is appropriate to enforce the terms and conditions of website, including any investigation of possible violations of them.

3.3. If necessary to detect, prevent, or in any way address and prosecute fraud, security or technical issues related to Travel Compositor.

3.4. If that action is adequate to protect the rights, property or security of Travel Compositor, its employees and users.

3.5. If we believe it is reasonably necessary to satisfy any law or on its own initiative or at the request of third parties

that demonstrate a legitimate interest.

3.6. Likewise, if the personal data controllers participate in a merger, acquisition or other transaction that involves the

sale of all or some of its assets or securities with voting rights, the User's information, including Personal Information obtained through the Service, may be included in the transferred assets or securities. If this occurs, the User's

Personal Information will continue to be the subject of this Privacy Policy.

1.7 Who do we communicate your data to?

On the occasion of the execution of the contracted services, we will transfer your data to the companies that request this, such as hotels, car rental companies, airlines, etc. You should keep in mind that such assignments are essential to facilitate the contracted services.The data communicated to the suppliers will consist of your name, surname, identity document (ID or passport), age, date of birth and nationality, as well as the possible observations that you have noted in your reservation. 

1.8 Are international transfers made?

Many of the service providers of the services you request are located in countries outside the European Union. The General Data Protection Regulation regulates such international transfers and, therefore, we can only transfer the data to countries that guarantee adequate measures for your data.

1.9. What are your rights by providing us with your information?

You should know that, by processing your personal data, you have some rights that we detail bellow:

• Right of access: You can request access to all your personal data that we process.
• Right of rectification: You will have the right to rectify your data, either because they are inaccurate or because they have changed.
• Right of deletion: You can also request the deletion of your data as long as any of the causes of art. 17.3 GDPR
• Right to object: You will have the right to request that your personal data not be processed for certain purposes. 
• Right to the limitation of the processing: You can also request the limitation of the processing of your data in the following cases:

o  During the challenge study because of the inaccuracy of your data.

o  If the processing is illegal, you object to the deletion of the data.o   When we do not need to process your data, but you need them for the exercise or defense against possible claims.

o  If you have opposed the processing of the data claiming public or legitimate interest, while we are analyzing whether our reasons for the processing prevail over your interests

• Right to portability: You will have the right to have your personal data delivered electronically, so that it is manageable by you.
• Right not to be subject to automated individual decisions: Finally, you will have the right to not be subject to a decision based on the automated processing of your personal data and may have legal effects on you.When the basis of legitimation for the processing of the data is based on your consent, you have the right to withdraw that consent at any time.To exercise these rights before Travel Compositor you can send your request to the postal or electronic address that you will find at the beginning of this Privacy Policy with the right you exercise and providing a copy of your identification document (ID / NIE) or your Passport. 

To exercise these rights before Intervisa, you can make your request through the following Platform: https://pestanahotelgroup.atlassian.net/servicedesk/customer/portal/5 or you may contact the Data Protection Officer of Intervisa by sending an e-mail to the address indicated at the beginning of this Privacy Policy. 

In addition, we remind you that you also have the possibility to file a claim with the Data Protection Supervisory Authority. For more information you can check the website of the Spanish Agency for Data Protection,www.aepd.es or the website of the Portuguese Data Protection Authority www.cnpd.pt

1.10.- Is your data safe?

We collect, process and store your data by applying information security policies and regulations. These security measures apply to both information in electronic and paper format, and guarantee the

confidentiality, integrity and availability of your data. If there is an event

or incident that compromises your data, we will notify you as soon as possible.

1.11.- Other questions

Travel Compositor in some cases conditions the use of the Service to the previous completion of the corresponding User registration, and must indicate at least the information marked with a yellow dot on certain personal data.

We remind you that to carry out a correct provision of the service you must provide us with the exact and truthful data, reserving the right of exclusion of the services to the interested parties who have provided false information and without prejudice to the legal actions that the Responsible can initiate.

When you make a reservation for another person through Travel Compositor, we will request personal information and travel preferences from that person. You must obtain the consent of these other persons before providing us with your personal information and travel preferences.

2.-Use of the web

In this case, the Service collects, if you consent, in addition to the IP address from which it is accessed, the following User information, from which Travel Compositor is the sole personal data controller:

·  If the Service has been reached by clicking on a link from another website.

·  Storage of cookies on the hard disk of the User's computer, with the prior consent of the User. See our Cookies Policy for more information.

·  Specific data on the User's device (for example, the type of model, the version of the operating system, errors that occur when using the Service, the type of browser, the language, the date and time of the request, the URL of reference or the mobile network used, among others).

·  Data on the physical location of the User through different technologies, such as through GPS signals sent by a mobile device, information on Wi-Fi access points or nearest mobile phone antennas, among others. Always according to the privacy settings on your device.

·In addition, the personal data controllers use Google Analytics, an analytical service provided by Google, Inc. based in the United States with headquarters at 1600 Amphitheater Parkway, Mountain View, California 9404. For the provision of these services, they use cookies that collect the information, including the user's IP address, which will be transmitted, processed and stored by Google in the terms set on the website www.google.com. Including the possible transmission of said information to third parties for reasons of legal requirement or when said third parties process

the information on behalf of Google.

3.- Changes to the Privacy Policy

We remind you that our Privacy Policy may be updated in the future.

We will inform you about substantial changes to this Privacy Policy by sending a notice to the email address you provided and placing a notice in a prominent place on our website.