The Spanish version of the Internal Regulations, the Cancellation Policies, Legal Notice and Privacy Policy are the only valid and current version of this document. Any translated version is provided only to make the Spanish version easier to read and understand. Any translated version is not legally binding and cannot replace the original version. In case of disagreement or conflict, the legal agreements and policies in Spanish will prevail at all times.
Privacy Policy
This privacy and data protection policy is aimed at providing you with the amount of information you need to understand the scope and purpose of the data processing so that the acceptance, absolutely necessary to be able to access and use the web, is based on consent perfectly informed contained in Organic Law 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights and in Regulation 2016/679, of April 27, 2016, regarding the protection of natural persons in what regarding the processing of personal data and the free movement of such data.
Who is responsible for the processing of your data?
Our website is managed by Mirai España S.L., C/ Fuencarral 6, 4º. 28004 Madrid, which guarantees the protection and confidentiality of personal data of any kind provided by users, in accordance with the provisions of the General Regulations for the Protection of Personal Data. Therefore, there is co-responsibility regarding the treatment of user data by the Nocal-Ical accommodation. SL, hereinafter MADRIDCITO provided with C.I.F. B87258869, with registered office at C/Casino, 4 Esc Derecha Puerta A, 28005 Madrid, and by the reservation manager provider of the establishment. Relationship formalized through the corresponding contract.
Where do we get your data?
Your data has been provided to us directly by you, or by third parties involved in booking intermediation, such as travel agencies, reservation centers, etc.
For what purpose do we process personal data?
MADRIDCITO will provide the personal data provided by users with a treatment aimed at achieving the following objectives:
- For the provision of the service, users must fill out a form, from which the necessary data for the fulfillment of the contract will be collected, these data being: full name, email, telephone and economic data once the contract is formalized.
- In addition, the traveler registration data will be requested together with the previous ones, sex, nationality, copy of ID / passports and signature, for the communication of data to the competent authorities that the accommodation must carry out.
- For the invoicing of the services, identification and tax address will be requested. To proceed with the collection of amounts owed and other accounting processes.
These data are necessary and mandatory to complete the registration process and for the contracting and provision of services, as well as the processing of incidents with the reservation and/or inform about the status of your requests. Failure to provide the required information implies the impossibility of subscription, you will not be able to complete the registration, nor will it be possible to contract the services.
- The browsing data will be linked to the user’s registration data, identifying the specific user who browses the website. In this way, it will be possible to track and secure the contracting of the online service, as well as personalize the service.
- Manage the queries raised through the contact email. In the event that the interested party has only contacted MADRIDCITO, the latter will process their data to attend to requests or requests for information that they make regarding the services offered. MADRIDCITO will only process the personal data that is strictly necessary to manage or resolve the request or request.
- For commercial purposes, the interested party who is actually a MADRIDCITO customer, once their stay has ended, will be contacted by e-mail or WhatsApp to evaluate their experience on Google or TripAdvisor, as well as news about products or loyalty campaigns, for the purpose of improve processes and services. However, the client is informed that he may object at any time by contacting MADRIDCITO through the channels already indicated.
- Manage the data of web users that are collected through cookies that will be processed to guarantee that the content of the web is adapted to your needs and those of your team, analysis of user behavior and our services, show you advertising related to your preferences based on a profile prepared from your web browsing habits and all with the aim of improving the offer of products or services that we offer.
What is the legitimacy for the processing of your data?
The legal basis for the processing of your data is:
- Management of pre-contractual and, where appropriate, contractual measures based on article 6.1.b) of the GDPR, since we collect and process your personal data mainly for the execution of contracts according to the terms and conditions of the reservation.
- Manage the queries raised through the contact email. This treatment is based on article 6.1.f) of the GDPR the legitimate interest that MADRIDCITO has to meet the information requirements through the Web.
- We may obtain and process your personal data for our legitimate interests based on article 6.1.f) of the GDPR (or those of any third party). Such legitimate interests include: The offer of products and services finds its legitimacy in the legitimate interest of the person in charge of the treatment, being able to express at any time his opposition to this type of treatment without in any case the exercise of this right conditions the execution of the contract.
- In international data transfers, it is reported that its legitimacy is covered by article 49.1 b) of Regulation (EU) 2016/679, as these are necessary transfers for the execution of a contract between the interested party and the data controller or for the execution of pre-contractual measures adopted at the request of the interested party.
- Manage the data of the users of the web that are collected through cookies, this treatment is legitimized in the unequivocal consent granted by the users.
- For compliance with legal obligations.
How long do we keep your personal data?
MADRIDCITO processes your personal data for the period necessary to fulfill the purposes established in this Privacy Policy, as well as to keep your personal information in compliance with the provisions of the relevant laws and regulations.
Specifically, the data will be kept during the entire period of validity of the contract, being blocked at the expiration of the same. In this way, the data will be blocked and kept for 5 years, this being the limitation period for actions that may derive from the contractual relationship signed.
The data that the user has given his consent for the sending of commercial information will be kept until he requests the withdrawal, from which time the same will be deleted.
To which recipients will your data be communicated?
MADRIDCITO Your data will not be transferred to third parties, except legal obligation. Specifically, they will be transmitted to the State Agency of the Spanish Tax Administration and to the banks and financial institutions to collect the service provided or product purchased, as well as to the providers in charge of the necessary processing for the provision of the services.
For the provision of services requested by users of MADRIDCITO, to third-party providers related to the Controller (digital marketing platform, etc.) whose intervention is necessary to fulfill the purposes described herein.
MADRIDCITO manages its reservations directly through its management platform Mirai España S.L and with online intermediation companies (such as Booking.com, Expedia and Airbnb), for which it uses the channel manager Siteminder, based in Australia, whose servers are located outside the European Union, which means a flow of personal data from Spanish territory to recipients established in countries outside the European Economic Area (International Data Transfers). Siteminder guarantees adequate security levels, through security certifications and follow-up audits, its legitimacy is protected by article 49.1 b) of Regulation (EU) 2016/679. You can access the information about its measures from the following link Siteminder privacy policy (and include a link https://www.siteminder.com/es/legal/compliance-rgpd/ ).
Outside of the cases described here, no data will be communicated, except legal obligation.
What are your rights when you provide us with your data?
Anyone has the right to obtain confirmation as to whether MADRIDCITO is processing personal data that concerns them.
The interested party will have the right to withdraw their consent at any time, as long as the treatment is not necessary for the fulfillment of the contract. The withdrawal of consent will not affect the legality of the treatment based on the consent prior to its withdrawal.
You can exercise your rights as an interested party of access, rectification, deletion, limitation, portability and opposition to the processing of personal data, at any time and for free by sending an email to info@madridcito.com or by writing to C/Casino , 4 Esc Derecha Puerta A 28005 Madrid, indicating the right you wish to exercise and the identifying data.
In addition, the interested party, if he considers that his rights have not been addressed, may file a claim with the Spanish Agency for Data Protection (AEPD) as the supervisory and control authority in terms of data protection in Spanish territory.
Last update: May 2022.