Privacy Policy
Please note that the English translation of the Spanish original POLÍTICA DE PRIVACIDAD is a courtesy translation only. The original Spanish version shall be binding.
Last update: 19.04.2024
I. Privacy and Data Protection Policy
Following current legislation, Cortijo El Sarmiento (hereinafter, also Website) undertakes to adopt the necessary technical and organizational measures, according to the level of security appropriate to the risk of the data collected.
Laws incorporated in this privacy policy
This privacy policy is adapted to current Spanish and European legislation on the protection of personal data on the Internet. Specifically, it respects the following regulations:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural individuals about the processing of personal data and on the free movement of such data (GDPR).
- Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
- Royal Decree 1720/2007, of 21 December, approving the Regulation implementing Organic Law 15/1999, of 13 December, on the Protection of Personal Data (RDLOPD).
- Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
Identity of the party responsible for the processing of personal data
The person responsible for the treatment of the personal data collected in Cortijo El Sarmiento is:
Registration of Personal Data
In compliance with the provisions of the RGPD and the LOPD-GDD, we inform you that the personal data collected by Cortijo El Sarmiento, through the forms provided on its pages, will be included and processed in our file to facilitate, expedite and fulfill the commitments established between Cortijo El Sarmiento and the User or the maintenance of the relationship established in the forms that the User fills in, or to attend to a request or query from the User. Likewise, following the provisions of the RGPD and the LOPD-GDD, unless the exception provided for in article 30.5 of the RGPD applies, a register of processing activities is kept which specifies, according to its purposes, the processing activities carried out, and the other circumstances established in the RGPD.
What user Information does Cortijo El Sarmiento process?
Cortijo El Sarmiento may record the following user data, depending on the purpose of our services and the functionality performed by the user:
- When you contact us to make reservations at our “Casa Rural”, either through the Website or by telephone:
- Identification details: name, surname, identification document (expiry date and nationality), date of birth, address, and nationality.
- Contact details: e-mail address and telephone number.
- Location data: Country of origin and province.
- Details of your application.
- In the case of registration via the web, browsing data: IP address and variables to maintain the browsing session through cookies.
- When you contact us to manage your booking:
- Identification details: name, surname, identification document (expiry date and nationality), date of birth, address, and nationality.
- Contact details: e-mail address and telephone number.
- Location data: Country of origin and province.
- Details of your application.
- In the case of registration via the web, browsing data: IP address and variables to maintain the browsing session through cookies.
- When you subscribe to our newsletter:
- Identification data: name, surname.
- Contact data: e-mail address.
- In the case of registration via the web, browsing data: IP address and variables to maintain the browsing session through cookies.
- When you contact us via the contact form:
- Identification data: name, surname.
- Booking data: date of arrival, date of departure, number of rooms requested, number of people staying.
- Contact details: e-mail address and telephone number.
- Details of your application.
- In the case of registration via the web, browsing data: IP address and variables to maintain the browsing session through cookies.
- When you interact with us on social media:
- In the participation in competitions on Facebook we treat your information such as Name, surname, Country, and email. To accomplish this, the rules for how to use it are clearly stated.
- In any other case of interaction with the user, with third-party media, your data is not incorporated into our information systems.
- When you contact us to inform us of an incident or complaint:
- Identification details: name, surname, identification document (expiry date and nationality), date of birth, address, and nationality.
- Personal characteristics’ data, date of birth, and gender.
- Contact details: e-mail address, telephone number.
- Transactions of goods and services in Cortijo El Sarmiento: Products and services purchased, Information related to your claim.
- In the case of registration via the web, browsing data: IP address and variables to maintain the browsing session through cookies.
- When you interact with us as a professional travel agent:
- Identification data: name, surname.
- Contact details: e-mail address and telephone number.
- Language
- Role/position in the agency (Job title)
- Personal characteristics’ data, date of birth, and form of address (Form of address)
- Transactions of goods and services at Cortijo El Sarmiento booked and contracted
- When you interact with us through our website, social networks, or any of the communication channels of Cortijo El Sarmiento:
- Identification details: name, surname, identification document (expiry date and nationality), date of birth, address, and nationality.
- Contact details: e-mail address and telephone number.
- Location data: Country of origin and province.
- In the case of registration via the web, browsing data: IP address and variables to maintain the browsing session through cookies.
In addition, in any information request form, we process the basic information on your request: Name and surname, email, telephone, and the message that is addressed to Cortijo El Sarmiento.
If the User provides data of third parties, he/she declares that he/she has their consent and undertakes to transfer the information contained in this Privacy Statement to the interested party, the owner of said data, exempting Cortijo El Sarmiento from any liability in this regard. However, Cortijo El Sarmiento may carry out the necessary verifications to verify this fact, adopting the corresponding due diligence measures, under data protection regulations.
Principles applicable to the processing of personal data
The processing of the User’s personal data shall be subject to the following principles set out in Article 5 of the GDPR and in Article 4 et seq. of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights:- Principle of lawfulness, fairness, and transparency: the consent of the User shall be always required following fully transparent information on the purposes for which the personal data is collected.
- Purpose limitation principle: personal data will be collected for specified, explicit, and legitimate purposes.
- Principle of data minimization: personal data collected will be only that which is strictly necessary to the purposes for which they are processed.
- Accuracy principle: personal data must be accurate and always up to date.
- Principle of limitation of the storage period: personal data shall only be kept in a form that allows the User’s identification for the time necessary for the purposes for which they are processed.
- Principle of integrity and confidentiality: personal data shall be processed in such a way as to ensure their security and confidentiality.
- Principle of proactive accountability: the Controller shall be responsible for ensuring that the above principles are complied with.
Categories of personal data
The categories of data processed by Cortijo El Sarmiento are solely identification data. In no case are special categories of personal data processed within the meaning of Article 9 of the GDPR.
Legal basis for the processing of personal data
What is the legal basis for processing your personal data?
The legal basis for the processing of personal data is consent. Cortijo El Sarmiento undertakes to obtain the express and verifiable consent of the User to the processing of his/her personal data for one or more specific purposes.
When is personal data stored?
- when you contact us for bookings at our “Casa Rural”, either via the website or by telephone, you give us your consent with this statement. It is in our legitimate interest to congratulate you on your birthday so that we can better fulfil your expectations and increase your satisfaction.
- if you contact us for the management of a booking, you give us your consent with this declaration.
- if you subscribe to our newsletter, you give us your consent with this declaration.
- if you interact with us on social media, you give us your consent with this declaration.
- if you contact us to report an incident or complaint, you give us your consent with this declaration.
- if you interact with us as a professional travel agent, you give us your consent with this declaration.
- if you interact with us through our website, social networks, or any of the communication channels of Cortijo El Sarmiento, you give us your consent with this declaration.
In general, when browsing our websites and applications for legitimate interest, we store and manage your IP address and the traffic made.
The purpose of this processing is focused on analyzing the use of the Website and checking the preferences and behaviour of users to show content in accordance with their preferences.
The User will have the right to withdraw his/her consent at any time. It will be as easy to withdraw consent as it is to give it. Generally, withdrawal of consent shall not condition the use of the Website.
When users need to input their information through forms for inquiries, information requests, or any content-related reasons on the website, they are notified that filling out the form is obligatory. This is crucial for ensuring the accurate processing of the operation.
Purposes of the processing for which the personal data is used
The personal data is collected and managed by Cortijo El Sarmiento to facilitate, speed up, and fulfill the commitments established between the Website and the User or the maintenance of the relationship established in the forms that the latter fills in.
Similarly, the data may be utilized for commercial, personalization, operational, and statistical purposes, as well as for activities related to the corporate objective of Cortijo El Sarmiento. Additionally, it may be utilized for the extraction and storage of data, as well as for conducting marketing studies to tailor the Content provided to the User and to enhance the quality, operation, and browsing of the Website.
Specifically, Cortijo El Sarmiento may process the following purposes, depending on the request and functionality made by the User:
- When contacting us to make reservations at our “Casa Rural”, either through the Website or by telephone:
- To manage the completion of the bookings requested by the user via the website or by telephone.
- Sending confirmation and documentation of the reservation made.
- In the event of giving consent to do so, the sending of commercial communications by Cortijo El Sarmiento.
- In the event of giving consent to do so, for the recovery of the search carried out.
- To manage the making of reservations “Tailor-made offers” for groups, companies, and/or incentives.
- To better meet the expectations and increase the degree of satisfaction, to congratulate you on your anniversary.
- When you contact us to manage your booking:
- To manage requests for access, modification, or cancellation of your reservation requested by the user to Cortijo El Sarmiento through the “Contact form” or by telephone.
- To send the reply to the request made to Cortijo El Sarmiento.
- Access to the reservation via pager, email, and more (Booking management).
- Access to the reservation using the guest’s details and e-mail address.
- When you subscribe to our newsletter:
- Manage the subscription and/or unsubscription of the newsletter, commercial communications of our stays, offers, and other services of our company, and registration made through the specific forms on our website.
- When you interact with us on social media:
- Manage the publication of your comments in the community spaces on Facebook, Instagram, X, Pinterest, YouTube, LinkedIn, TikTok, and WhatsApp, both in the public space or in direct messages that you may have sent us.
- Conducting competitions on Facebook
- In the event of giving consent to do so, the sending of commercial communications by Cortijo El Sarmiento.
- If this is necessary, check the content of users’ comments and, where appropriate, delete those whose content does not comply with the conditions applicable to this privacy statement.
- When you deal with us as a professional travel agent:
- As a company and/or agent, manage the reservations in real-time at Cortijo El Sarmiento.
- As a member of Cortijo El Sarmiento, to manage access codes and make reservations for clients of professional agents (travel agents).
- In Cortijo El Sarmiento, if the information processed is necessary from the loyalty program professionals of the agencies.
- Sending promotional emails and products of Cortijo El Sarmiento.
- When you interact with us through our website, social networks, or any of the communication channels of Cortijo El Sarmiento:
- Carrying out market analysis.
- To be able to provide more personalized services to its users, it will create profiles based on data extracted from the sales made to its users, as well as attend to tourist preferences, travel history, etc.
- The data used in these profiles may have been obtained both from the information generated by the user in the “Casa Rural”, and from external sources (for example: the internet, and social networks) and from the interaction of the user in the communication channels that Cortijo El Sarmiento makes available.
- This information is very useful for Cortijo El Sarmiento to offer its users personalized products based on their commercial interests shown in the use of the services offered in Cortijo El Sarmiento, improving the user’s experience both in the provision of the requested service and in future contracts.
In all the processing carried out on our websites, we analyze the use and check the preferences and behaviour of users to display content by their preferences.
When personal data is obtained, the User will be informed of the specific purpose of the processing for which the personal data will be used, i.e. the use or uses to which the information collected will be put.
Retention periods of personal data
In general, the personal data to which you have access will be processed for the time necessary to fulfil the purpose for which they were collected.
After that, Cortijo El Sarmiento will keep the personal data when they are no longer relevant for the purposes for which they were collected, securely stored, to be made available to the competent Public Administrations, judges, and Courts or the Public Prosecutor’s Office during the period of limitation of actions that may arise from the relationship maintained with the client and/or the legally stipulated retention periods. Cortijo El Sarmiento will proceed to the physical deletion of your data once these periods have expired.
Recipients of personal data
We inform you that your data will not be communicated to any third party, unless:
- The transfer is authorised by law.
- The processing is in response to the free and legitimate acceptance of a legal relationship whose development, fulfilment and control necessarily involves the connection of such processing with third party files, such as, for example, banking institutions for the billing of the products or services contracted.
- The data are requested by the Ombudsman, the Public Prosecutor’s Office, judges, courts or the Court of Auditors, in the exercise of the functions attributed to them.
Likewise, they may be communicated to those suppliers who provide a service to Cortijo El Sarmiento and for which they need access to your personal data.
The User’s personal data will be shared with the following recipients or categories of recipients:
- Beds24 GmbH
Davoser Str. 1g – 14199 Berlin – Germany - Stripe Payments Europe, Limited
The One Building – 1 Grand Canal Street Lower – Dublin 2 – Co. Dublin – Ireland - GetResponse S.A.
Al. Grunwaldzka 413 – 80-309 Gdańsk – Poland - Paycomet (Grupo Banco Sabadell)
Calle Camino de Valladolid, 2 – 28250 Torrelodones, Madrid – Spain
If the controller intends to transfer personal data to a third country or international organisation, the User will be informed at the time the personal data are obtained about the third country or international organisation to which the data are intended to be transferred, as well as the existence or absence of a Commission adequacy decision.
Personal data of minors
In compliance with the provisions of Articles 8 of the GDPR and 7 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights, only those over 16 years of age may give their consent to the processing of their personal data lawfully by Cortijo El Sarmiento. In the case of children under 16 years of age, the consent of the parents or guardians is required for the processing, and the processing will only be considered lawful to the extent that the parents or guardians have given their consent.
Secrecy and security of personal data
Cortijo El Sarmiento undertakes to adopt the necessary technical and organizational measures, according to the level of security appropriate to the risk of the data collected, to guarantee the security of personal data and prevent the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored or otherwise processed, or the unauthorized communication of or access to such data.
The Website has an SSL (Secure Socket Layer) certificate, which ensures that personal data is transmitted securely and confidentially, as the transmission of data between the server and the User, and in return, is fully encrypted or encoded.
However, because Cortijo El Sarmiento cannot guarantee the impregnability of the Internet or the total absence of hackers or others who fraudulently access personal data, the Data Controller undertakes to notify the User without undue delay when there is a breach of security of personal data that is likely to involve a high risk to the rights and freedoms of natural persons. By Article 4 of the GDPR, a breach of security of personal data means any breach of security resulting in the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or the unauthorized disclosure of or access to such data.
Personal data shall be treated as confidential by the Controller, who undertakes to inform and to ensure using a legal or contractual obligation that such confidentiality is respected by its employees, associates, and any other person to whom it makes the information accessible.
Rights arising from the processing of personal data
If the user’s personal data is processed, the user is considered a data subject within the meaning of the RGPD and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights. After successful identification, the user has the following rights towards Cortijo El Sarmiento:
- Right of access: this is the User’s right to obtain confirmation of whether Cortijo El Sarmiento is processing their personal data and, if so, to obtain information about their specific personal data and the processing that Cortijo El Sarmiento has carried out or will carry out, as well as, among others, the information available about the origin of said data and the recipients of the communications made or planned of the same.
- Right of rectification: This is the User’s right to have his/her personal data amended if it proves to be inaccurate or, considering the purposes of the processing, incomplete.
- Right of erasure (“the right to be forgotten”): This is the User’s right unless otherwise provided for by law, to obtain the erasure of his or her personal data when it is no longer necessary for the purposes for which it was collected or processed; the User has withdrawn his or her consent to the processing and the processing has no other legal basis; the User objects to the processing and there is no other legitimate reason to continue the processing; the personal data have been processed unlawfully; the personal data must be erased in compliance with a legal obligation; or the personal data have been obtained as a result of a direct offer of information society services to a person under 14 years of age. In addition to erasure, the Controller shall, considering the technology available and the cost of its implementation, take reasonable steps to inform controllers who are processing the personal data of the data subject’s request for erasure of any link to those personal data.
- Right to restriction of processing: This is the User’s right to restrict the processing of his or her personal data. The User is entitled to obtain the restriction of processing where the User contests the accuracy of his or her personal data; the processing is unlawful; the Controller no longer needs the personal data, but the User needs it to make claims; and where the User has objected to the processing.
- Right to data portability: Where processing is carried out by automated means, the User shall have the right to receive from the Controller his or her personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller. Where technically feasible, the Controller shall transmit the data directly to that other controller.
- Right to object: This is the User’s right not to have their personal data processed, or to cease processing of it by Cortijo El Sarmiento.
- Right not to be subject to a decision based solely on automated processing, including profiling: This is the User’s right not to be subject to an individualized decision based solely on the automated processing of their personal data, including profiling, unless the legislation in force establishes otherwise.
Therefore, the User may exercise his/her rights through a written communication addressed to the Data Controller with the reference “RGPD-el-sarmiento.com”, specifying:
- Name, surname(s) of the User, and a copy of the User’s ID card. In those cases, in which representation is admitted, it will also be necessary to identify the person representing the User by the same means, as well as the document accrediting the representation. The photocopy of the DNI may be substituted by any other legally valid means that accredits identity.
- Request with the specific reasons for the request or information to which access is sought.
- Address for notification purposes.
- Date and signature of the applicant.
- Any document that accredits the request being made.
This request and any other attached documents may be sent to the following address and/or e-mail address:
Postal address: CAMINO DE GATAR 2, 04638 MOJÁCAR (ALMERÍA), SPAIN
E-mail: [email protected]
Links to third-party websites
The Website may include hyperlinks or links that allow access to third-party websites apart from Cortijo El Sarmiento, and which are therefore not operated by Cortijo El Sarmiento. The owners of these websites will have their data protection policies, being themselves, in each case, responsible for their files and their privacy practices.
Complaints to the Supervisory Authority
If the User considers that there is a problem or infringement of the regulations in force in the way in which his or her personal data is being processed, he or she shall have the right to effective judicial protection and to complain with a supervisory authority, in particular, in the State in which he or she has his or her habitual residence, place of work or place of the alleged infringement. In the case of Spain, the supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es/).
II. Acceptance and changes to this Privacy Policy
It is necessary that the User has read and agrees with the conditions on the protection of personal data contained in this Privacy Policy, as well as that he/she accepts the processing of his/her personal data so that the Data Controller can proceed in the manner, during the periods and for the purposes indicated. The use of the Website implies acceptance of the Privacy Policy of the same.
Cortijo El Sarmiento reserves the right to modify its Privacy Policy, according to its own criteria, or motivated by a legislative, jurisprudential or doctrinal change of the Spanish Data Protection Agency. Changes or updates to this Privacy Policy will not be explicitly notified to the User. The User is recommended to consult this page periodically to keep abreast of the latest changes or updates.
This Privacy Policy was updated to adapt to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and on the free movement of such data (RGPD) and to Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights.