In accordance with the provisions of Law 29/2021, of October 28, qualified of data protection (LPDQ) and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (RGPD), we inform all our customers that the personal data collected will be incorporated and processed in the files belonging to the company SPORTHOTELS S.A., (hereinafter referred to as “Sporthotels”) with the sole purpose of administering and contracting lodging, catering and / or activity services.

Our customers and their data are very important to Sporthotels, which is why we are committed to:

• Not to collect personal data without their consent
• We collect your data according to the principle of data minimization, i.e. only the data that is necessary, essential and not abused for our purposes
• We collect and process your data only for the purposes described in our policy and we will inform the recipients of this information
• We only collect and process the data necessary to correctly process your request or to personalize the services requested
• We are committed to taking appropriate measures to ensure the confidentiality of your data and to prevent their disclosure to unauthorized third parties
• In situations where data is transferred to authorized third parties, we take all appropriate measures to ensure the security of such transfers
• Inform you about your rights of access, rectification and opposition according to the law 29/2011, 28 October 2021

1. Basic information on the protection of personal data

Responsible	SPORTHOTELS SA, Cta. General nº2 s/n AD100 Soldeu (Canillo) Principat d’Andorra
Purpose	Personal data management
Legitimacy	Consent of the data subject and legal obligation
Addressees	SPORTHOTELS SA, Cta. General nº2 s/n AD100 Soldeu (Canillo) Principat d’Andorra
Rights	Access, rectification, cancellation, opposition, limitation of processing, data portability and not being subject to automated individualized decisions
More information	Below you will find detailed information about the protection of your data

2. Detailed information on the protection of personal data

2.1. Data controller

The person in charge of the processing of customer data is SPORTHOTELS S.A., Cta. General n2 s/n AD100 Soldeu (Canillo), Principat d’Andorra, NRT A708162T, telephone 00376 870540 and email dpo@sporthotels.ad.

2.2. Purpose of data processing

Sporthotels, collects and processes personal information provided directly and voluntarily: name, address, email, telephone, date of birth, ID card or passport, tax number, gender and credit card number. We do not ask for or process sensitive data such as race, ethnic origin, political opinions, religious or philosophical beliefs or sexual orientation.

We collect your data when:

• You can contact us by phone or by email at our reservation service
• You give us your details at our reception (check in)
• You make a reservation on our website
• You send us an e-mail
• You share a page or offer by sending an email or using a social media network
• You fill in a satisfaction questionnaire

The fact of indicating personal data through the various forms and e-mail addresses of this website implies the acceptance and consent to the treatment of the same in the terms indicated in this privacy policy. In this way, the consent achieves the following purposes, without your data being applied or used for other purposes:

• Management of reservations, appropriate handling of questions, comments, incidents or suggestions
• Improvement and personalization of our care and services
• Manage and support the relationship with our client
• To keep you informed, either by electronic means or mobile devices, or by any other means provided, of customized Sporthotels offers and discounts that may be of interest to you
• Statistical analysis of the visits to the website for commercial purposes
• Management of your requests for access, rectification and opposition
• Debt management and litigation

With regard to the processing of your data for promotional or advertising purposes, the data subject will be provided with the relevant data collection form with the appropriate procedure so that he or she can freely give consent to this. The consent given can be revoked at any time and at no cost to the data subject.

2.2.1. Data retention

The personal data you have provided will be kept by Sporthotels as long as there is a contractual and/or commercial relationship and as long as you do not exercise your right to delete, cancel and/or limit the processing of personal data or, in our case, for the maximum legal period allowed by the legislation on data protection, including the periods of prescription of legal actions for the attention of possible responsibility that may arise from the contractual relationship.

In the latter case, Sporthotels will keep the duly blocked data, without making any use of them, as long as they are necessary for the exercise or defense of claims, or as long as any type of judicial, legal or contractual responsibility may derive from their treatment, which must be assumed and for which their recovery is necessary.

2.2.2. Minors

The Sporthotels website is not intended for minors. In any case, we do not collect any personal data from minors under the age of 16 without the consent of their legal representative. The data collected from minors under 16 years old will be collected at the time of registration in our hotels, by legal obligation, and only the data necessary for this obligation.

2.3. Legitimacy of data processing

The legal basis for our data processing is to process your requests and to be able to keep you informed, including electronically, about our products and services. Any processing of your data is legitimized by your consent.

2.4. Addressees

By registering on our website or in our hotels, you expressly authorize the transfer of your data to SPORTHOTELS SA, so that it can carry out the objectives stated in the present confidentiality policy. In the event that you provide Sporthotels with personal data of third parties, you declare that such data is true and that you have informed and requested the consent of such third parties, whose data you provide to us, for their personal data to be processed by Sporthotels on the same terms as the customer has been informed and given consent in this privacy policy. Similarly, Sporthotels may disclose the personal data processed to third parties, for reasons of legitimate interest and legal obligation.

2.5. Exercise of rights

The customer may exercise the following rights under the QDPA (Qualified Data Protection Act) in relation to the processing of their personal data:

• Right to request access to your personal data
• Right to request a correction or deletion
• Right to request limitation of processing
• Right to object to the processing
• Right to data portability
• Right to be free from automated and individualized decisions

These rights can be exercised by means of a written communication addressed to SPORTHOTELS SA, Cta. General nº2 s/n – AD100 Soldeu (Canillo) Principat d’Andorra, Nrt – A708162T, telephone 00376 870 540 and email dpo@sporthotels.ad. The response from Sporthotels will be immediate and will not exceed in any case the next working day following the reception of the request, accompanied, if necessary, by other information that may be relevant to resolve the request.

2.6. Security measures and levels

Sporthotels has adopted the necessary measures to maintain the level of security required, according to the nature of the personal data processed and the circumstances of the processing, in order to avoid, as far as possible and always according to the state of the art, their alteration, loss, processing or unauthorized access.

In addition, Sporthotels guarantees that it has mechanisms in place to:

1. Ensure that the confidentiality, integrity, and resilience of processing systems and services are maintained
2. Rapidly restore availability and access to personal data in the event of a physical or technical incident
3. Regularly check, evaluate and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the processing
4. Pseudonymize and encrypt personal data, where appropriate.

2.7. Client consent

As a user and customer, you declare that you have read and expressly accepted the present confidentiality policy at the time of your registration with Sporthotels, thus giving your express and unequivocal consent to Sporthotels, for the processing of data in accordance with the objectives and the services reflected here.

2.8. Commercial and promotional information

The personal data you provide through the registration form will be processed by us (Sporthotels) in order to inform you about the content of the activities and the commercial communications.

2.9. Confidentiality and professional secrecy

The data that we collect in all the private communications between the Sporthotels and the clients will be treated with absolute confidentiality, by which we commit ourselves to the obligation of secrecy of the personal data, to the duty to preserve them and to take all the necessary measures to avoid the alteration, the loss and the unauthorized access or treatment, in accordance with the provisions of the applicable legislation on data protection.

In addition, information of any kind that the parties exchange, which the parties agree is of a confidential nature, or which merely relates to the content of such information, will also have the status of confidential information.

2.10. Changes to the security and data protection policy

Sprothotels reserves the right to modify its security and data protection policy in order to adapt it to new legislation or jurisprudence, as well as those that may derive from existing codes of conduct on the matter, or due to strategic decisions of the company, with effect from the date of publication of said modification on our website.

3. Customer-specific data communications

Before providing personal data relative to third parties on our website (Sporthotels), you must obtain their express and preliminary consent, after having informed them of the conditions contained in the present confidentiality policy. You commit yourself to guarantee Sporthotels against any claim, fine or possible sanction that you could be brought to support because of the non-execution by the customer of the obligation described in the present paragraph.

4. Cookies

Access to our website (Sporthotels) may involve the use of cookies. Cookies are small amounts of information that are stored in the browser used by each user so that the server can remember certain information that can be used later. This information allows us to identify you as a specific user and allows us to store your personal preferences, as well as technical information such as the specific visits or pages you visit.

Users who do not wish to receive cookies or who want to be notified before they are stored on their computer can configure their browser accordingly.