| 3.1Handling your requests for information and preparing personalised proposals (web forms, telephone, email, WhatsApp). | Identification and contact details, language, country, service or programme of interest and content of your enquiry. | Taking steps at your request prior to entering into a contract (art. 6.1.b GDPR). | Until your request is resolved and, if you do not go on to book, up to 18 months from the last interaction. |
| 3.2Advising you on the most suitable programme when, of your own choice, you share information about your health with us so that we can assess your needs and offer you guidance on the programme that may be suitable for you. | Health-related data that you voluntarily decide to provide to us. | Your explicit consent to the processing of your health data, in accordance with art. 9.2.a GDPR, in conjunction with the legal basis applicable to the processing of ordinary personal data. Where appropriate, the processing of personal data may be necessary to take steps requested by you prior to entering into a contract, in accordance with art. 6.1.b GDPR. | The data will be kept until your request for guidance has been resolved. If you book our services, the data necessary to provide the service will be incorporated into and kept in your medical record in accordance with the legally applicable periods (section 3.5). If you ultimately do not book, the health data provided exclusively for this purpose will be deleted within a maximum of 30 days from the resolution of your request, unless there is a legal obligation to retain them or it is necessary to keep them for the establishment, exercise or defence of possible legal claims. |
| 3.3Managing your booking and your stay: accommodation, food and beverage, spa and other contracted services, payment guarantee, invoicing and collection. | Identification and contact details, companions, dates and preferences for your stay, payment and billing data. | Performance of the contract (art. 6.1.b GDPR). Compliance with tax and accounting obligations (art. 6.1.c GDPR). | For the duration of the contractual relationship. Thereafter, 6 years for accounting records (art. 30 Spanish Commercial Code) and 4 years for tax records (art. 66 Spanish General Tax Law). |
| 3.4Guest document registration and information, and its communication to the Ministry of the Interior. | Identity data, ID document, dates of stay, contact and payment details required by law, including those of minors staying with us. | Legal obligation (art. 6.1.c GDPR): art. 25 of Organic Law 4/2015 on the protection of public safety, and Royal Decree 933/2021. | Three years, in accordance with Royal Decree 933/2021. |
| 3.5Providing you with healthcare as part of our programmes and treatments: prior health questionnaire, assessment, diagnostic tests, treatments and follow-up, and management of your medical record. | Identification data, health data, genetic data (genomic medicine), clinical images, habits and nutritional data. | Healthcare or treatment by professionals bound by professional secrecy (art. 9.2.h and 9.3 GDPR), in conjunction with the performance of the contract (art. 6.1.b) and the obligations under Law 41/2002 on patient autonomy and Law 10/2014 of 29 December on Health of the Valencian Community (art. 6.1.c). In emergencies, protection of vital interests (art. 9.2.c GDPR). | Medical record: at least 5 years from discharge for each care episode (art. 17.1 Law 41/2002). Genetic data: at least 5 years from when they were obtained (art. 52 Law 14/2007), where applicable. |
| 3.6Adapting our food offering to your allergies, intolerances or dietary needs. | Allergies, intolerances, dietary guidelines. | If it is part of a health programme: art. 9.2.h GDPR. If you are staying without a programme: your explicit consent (art. 9.2.a GDPR). | During your stay. They are only kept for future stays if you consent to it. |
| 3.7Sending you commercial communications (news, offers, events) by email, SMS or WhatsApp. | Name, contact details, language and commercial preferences. Never health data. | If you are not a customer: your consent (art. 6.1.a GDPR and art. 21.1 LSSI-CE). If you are a customer: legitimate interest in offering you our own products or services similar to those you have contracted (art. 6.1.f GDPR and art. 21.2 LSSI-CE). You can object in each communication. | Until you withdraw your consent or object or, failing that, after 18 months without interaction. |
| 3.8Creating a commercial profile to personalise our offers. | Services contracted, stated preferences and, if you have accepted the corresponding cookies, browsing data. Never health data. | Your consent (art. 6.1.a GDPR). No automated decisions with legal or similarly significant effects are taken (art. 22 GDPR). | Until you withdraw your consent. |
| 3.9Conducting quality and satisfaction surveys. | Contact details and opinions about our services. | Legitimate interest in improving our services (art. 6.1.f GDPR). You can object at any time. | 12 months from your response. |
| 3.10Handling complaints, claims and the exercise of your rights. | Identification and contact details and content of the complaint or request. | Legal obligation (art. 6.1.c GDPR): consumer and user protection legislation and the GDPR. | 5 years from the resolution or closure of the complaint, claim or request and, in any case, for as long as legal liabilities may arise. |
| 3.11Managing our social media profiles and interacting with you. | Username, profile picture and messages. | Your consent when you follow us or write to us (art. 6.1.a GDPR). | For as long as you follow our profile or as necessary to reply to you. |
| 3.12Analysing browsing and displaying advertising through cookies. | Online identifiers and browsing data. | Technical cookies: exempt from consent (art. 22.2 LSSI-CE). Others: your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE). | As detailed in the Cookie Policy. |