Privacy Policy

1. Data Processing Principles

CASA PEPE IBIZA SL shall ensure that personal data collected through this website are processed in accordance with the following principles set out in Article 5 of Regulation (EU) 2016/679 (GDPR):

• Lawfulness, fairness and transparency — data are processed lawfully, fairly and in a transparent manner in relation to the data subject.
• Purpose limitation — data are collected for specified, explicit and legitimate purposes and are not processed in a manner incompatible with those purposes.
• Data minimisation — data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy — data are accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that inaccurate data are erased or rectified without delay.
• Storage limitation — data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed.
• Integrity and confidentiality — data are processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical and organisational measures.
• Accountability — CASA PEPE IBIZA SL is responsible for, and able to demonstrate compliance with, all of the above principles.

2. Lawful Basis for Processing

Processing shall only be lawful if, and to the extent that, at least one of the following conditions applies:

• The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Where processing is based on the data subject's consent, the controller must be able to demonstrate that consent was given. If consent is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.

The data subject shall have the right to withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw consent as to give it.

3. Information Provided to Data Subjects (Art. 13 & 14 GDPR)

When CASA PEPE IBIZA SL collects personal data directly from a data subject, it shall provide the following information:

• The identity and contact details of the controller and, where applicable, of the controller's representative; the contact details of the data protection officer, where applicable; and the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing.
• The legitimate interests pursued by the controller or by a third party, where processing is based on legitimate interests.
• The recipients or categories of recipients of the personal data and, where applicable, the controller's intention to transfer personal data to a third country or international organisation.
• The period for which the personal data will be stored, or if this is not possible, the criteria used to determine that period.
• The existence of the right to request access to and rectification or erasure of personal data, restriction of processing, the right to object to processing, and the right to data portability.
• Where processing is based on consent, the existence of the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal, and the right to lodge a complaint with a supervisory authority.
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide such data.
• The existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are not collected directly from the data subject, the controller shall also provide the categories of personal data concerned and the source from which they originate, including whether they come from publicly accessible sources.

4. Layered Information Approach

In order to present information clearly and in an accessible manner, CASA PEPE IBIZA SL adopts a layered approach to data protection information, in accordance with Article 11 of Organic Law 3/2018 (LOPDGDD):

• First layer — Basic information: A concise summary is presented at the same time and through the same means by which the data are collected.
• Second layer — Additional information: Comprehensive and detailed information is available in an appropriate, structured, concise and precise format, accessible via a link to this Privacy Policy.

4.1 Basic Data Protection Information

Online Reservation Management

Controller	CASA PEPE IBIZA SL
Purpose	Registration and management of online reservations.
Rights	Access, rectification and erasure of data, as well as other rights as described in the additional information.
Additional information	Further detailed information on data protection is available in the Privacy Policy section of our website.☐ I have read and accept the basic data protection information.

Commercial Communications — Web Form

Controller	CASA PEPE IBIZA SL
Purpose	Collection, registration and processing of data for the purpose of responding to enquiries and/or requests, as well as for advertising and commercial prospecting.
Rights	Access, rectification and erasure of data, as well as other rights as described in the additional information.
Additional information	Further detailed information on data protection is available in the Privacy Policy section of our website.☐ I have read and accept the basic data protection information.☐ I agree to receive commercial communications.

Web User Management

Controller	CASA PEPE IBIZA SL
Purpose	Collection, registration and processing of user data.
Rights	Access, rectification and erasure of data, as well as other rights as described in the additional information.
Additional information	Further detailed information on data protection is available in the Privacy Policy section of our website.☐ I have read and accept the basic data protection information.

Cookie Installation

Controller	CASA PEPE IBIZA SL
Purpose	Management and installation of cookies.
Rights	Access, rectification and erasure of data, as well as other rights as described in the additional information.
Additional information	Further detailed information on data protection is available in the Privacy Policy section of our website.☐ I have read and accept the basic data protection information.

Web Contact Form

Controller	CASA PEPE IBIZA SL
Purpose	Responding to enquiries and/or requests.
Rights	Access, rectification and erasure of data, as well as other rights as described in the additional information.
Additional information	Further detailed information on data protection is available in the Privacy Policy section of our website.☐ I have read and accept the basic data protection information.

5. Who Is Responsible for Processing Your Personal Data?

CASA PEPE IBIZA SL is the DATA CONTROLLER and informs you that your personal data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD).

What are the purposes and legal basis for processing your data?

Depending on the form through which your personal data were collected, they will be treated confidentially for the following purposes:

Contact Form

• To respond to enquiries or any type of request made by the user through any of the contact methods available on the website. (legitimate interest of the controller, Art. 6.1.f GDPR)
• To conduct statistical analyses and market research. (legitimate interest of the controller, Art. 6.1.f GDPR)

Reservation Form

• To process reservations at the controller's establishment. (performance of a contract or pre-contractual steps, Art. 6.1.b GDPR)
• To send commercial communications to customers regarding similar products or services, by electronic or physical means. (legitimate interest of the controller, Art. 6.1.f GDPR; Art. 21.2 LSSI)

Newsletter

• To send newsletters, news, offers and online promotions. (consent of the data subject, Art. 6.1.a GDPR)

How long will we keep your personal data?

Your data will be kept for no longer than is necessary for the purpose of the processing, or as required by applicable legal obligations. When data are no longer needed for these purposes, they will be deleted with appropriate security measures to ensure anonymisation or complete destruction.

Who do we share your personal data with?

No disclosure of personal data to third parties is envisaged, except where necessary for the development and execution of the processing purposes — in particular, to our service providers related to communications, with whom the DATA CONTROLLER has entered into the confidentiality and data processing agreements required by applicable privacy regulations.

What are your rights?

• The right to withdraw consent at any time.
• The right of access, rectification, portability and erasure of your data, and the right to restriction of or objection to its processing.
• The right to lodge a complaint with the supervisory authority (www.aepd.es) if you believe that the processing does not comply with applicable regulations.

6. Mandatory or Optional Nature of the Information Provided

By ticking the relevant boxes and entering data in fields marked with an asterisk (*) in the contact form, users expressly and freely confirm that their data are necessary in order to process their request, while inclusion of data in the remaining fields is voluntary. The USER guarantees that the personal data provided to the DATA CONTROLLER are accurate and undertakes to notify any changes.

The DATA CONTROLLER informs users that all data requested through the website are required, as they are necessary to provide the best possible service.

7. Security Measures

In accordance with applicable data protection regulations, the DATA CONTROLLER complies with all provisions of the GDPR and LOPDGDD for the processing of personal data under its responsibility — in particular with the principles described in Article 5 of the GDPR, under which data are processed lawfully, fairly and transparently in relation to the data subject, and are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

The DATA CONTROLLER guarantees that it has implemented appropriate technical and organisational policies to apply the security measures required by the GDPR and the LOPDGDD, in order to protect the rights and freedoms of USERS.

8. Privacy Policy on Social Media

CASA PEPE IBIZA SL has created profiles on social media platforms (including Instagram and Facebook) and is responsible for the processing of personal data carried out on those platforms, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

The DATA CONTROLLER has access to and processes publicly available information provided by the USER, in particular their contact name. This data is used solely within the social media platform itself and will only be incorporated into a file held by the DATA CONTROLLER where necessary to process the USER's request.

Access to and registration via the DATA CONTROLLER's social media profiles is prohibited for persons under 14 years of age.