PRIVACY POLICY

1. Identity of the Data Controller

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you that the personal data collected through this website will be processed by:

Data Controller: ARCASO 2000 SL
Trade name: Fonda dels Pics
Tax ID (CIF/NIF): B10831188
Address: C/ de la Font, nº 2, 17539 Bolvir – Meranges (Girona), Spain
Telephone: +34 653 03 55 61
Email: hostal@fondadelspics.com
Website: https://fondadelspics.com/
Data Protection Officer (DPO): Not applicable.

This Privacy Policy regulates the processing of data collected through the website fondadelspics.com, as well as via the contact and booking forms hosted on it or linked platforms.

2. Data we process, purposes and legal bases

ARCASO 2000 SL will process your personal data for the following purposes:

2.1. Website management and cookies

Purpose:
- Enable browsing on the website.
- Manage, analyse and improve the user experience.
- Administer technical, analytics and advertising cookies (Google Analytics, Google Ads).
Data processed: browsing data, online identifiers, IP address, device, browser, language, browsing behaviour.
Legal basis:
- Legitimate interest of the controller in maintaining the website (technical cookies).
- User consent for analytics and advertising cookies (through the cookie banner).
Retention period: according to each cookie’s duration and until consent is withdrawn.

2.2. Accommodation booking management (hostal)

Purpose: manage room bookings and stays made through the website, the booking platform (Avirato) or via email/phone.
Data processed: name, surname, email, phone number, check-in and check-out dates, number of guests, accommodation preferences and any other information provided voluntarily.
Legal basis:
- Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
- Compliance with legal obligations in tax and accounting matters (Art. 6.1.c GDPR).
Retention period:
- Booking data: for the duration of the contractual relationship and, thereafter, for the limitation periods of legal liabilities (generally 5–6 years for tax/accounting purposes).
Disclosures:
- Booking management platforms (Avirato) as data processors.
- Public authorities, tax authorities, banks and accounting/tax advisors when required to comply with legal obligations.

2.3. Restaurant booking management

Purpose: manage restaurant table reservations and any changes or cancellations.
Data processed: name, phone number, number of guests, date and time of booking, comments or requests (allergies, events, etc.).
Legal basis:
- Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
- Legitimate interest in organising the restaurant service.
Retention period: as long as necessary to manage the booking and for the applicable limitation periods.

2.4. Handling enquiries and information requests

Purpose: handle and respond to enquiries, information requests or messages submitted via the contact form, email or phone.
Data processed: name, email, phone, subject, message and any other data provided by the user.
Legal basis:
- Data subject’s consent (Art. 6.1.a GDPR).
- Where applicable, pre-contractual measures (Art. 6.1.b GDPR).
Retention period: as long as necessary to process the enquiry and, if applicable, as long as liabilities may arise (max. 1–2 years unless it becomes a contractual relationship).

2.5. Administrative, accounting and tax management

Purpose: manage invoicing, payments, refunds and accounting/tax obligations derived from bookings and services.
Data processed: identification data, contact details, financial and invoicing data.
Legal basis:
- Compliance with legal obligations (Art. 6.1.c GDPR).
Retention period: for the periods established by law (typically 5–10 years according to tax and commercial regulations).
Disclosures: tax authorities, financial institutions, accounting/tax advisors and other public bodies where legally required.

2.6. Publication of images on the website and social networks

Purpose: promote the establishment, its activities and events and, where applicable, customers who have given their consent, through the website and social networks (Instagram).
Data processed: images and/or videos, name if voluntarily provided.
Legal basis:
- Data subject’s consent (Art. 6.1.a GDPR).
Retention period: as long as consent is maintained and the publication remains appropriate, or until removal is requested.

2.7. Compliance with legal obligations

Purpose: comply with requests from authorities, law enforcement bodies and courts, and comply with applicable laws (tourism, consumer protection, safety, etc.).
Legal basis:
- Compliance with legal obligations (Art. 6.1.c GDPR).
- Legitimate interest in the legal defence of the establishment (Art. 6.1.f GDPR).
Retention period: as long as necessary to comply with legal obligations and limitation periods.

3. Service providers and data processors

To provide its services, the controller may work with third parties that can access personal data solely to provide the contracted service:

Hosting provider: IONOS (website and email hosting).
Booking platform: Avirato (accommodation booking management).
Web design and maintenance agency: Beyond The Big.
Analytics and advertising tools: Google Analytics, Google Ads (Google Ireland/LLC).
Social networks: Instagram (Meta Platforms).

All of them act as data processors, with limited access to data and under data processing agreements in accordance with Art. 28 GDPR.

International data transfers may occur when using services provided from outside the EEA (e.g. Google or Meta). In such cases, appropriate safeguards will be implemented (standard contractual clauses, adequacy decisions, etc.).

4. Information security

ARCASO 2000 SL implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data, in accordance with Art. 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of individuals.

However, users should be aware that no security measures on the Internet are completely infallible.

5. Data subjects’ rights

As a user/data subject, you are entitled to:

Access your personal data.
Rectify inaccurate data.
Erase your data when, among other reasons, they are no longer necessary for the purposes for which they were collected.
Restrict the processing of your data in certain circumstances.
Object to the processing of your data on grounds relating to your particular situation.
Data portability, where the processing is based on consent or a contract and is carried out by automated means.

You may exercise your rights by sending a request, together with a copy of your ID document, to:

Email: hostal@fondadelspics.com
Postal address: C/ de la Font, nº 2, 17539 Bolvir – Meranges (Girona), Spain

Please clearly indicate which right you wish to exercise and in relation to which data.

If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es.

6. Minors

The services offered through this website are not directed to children under 16. Fonda dels Pics does not knowingly collect data from minors. If any processing of minors’ data is detected without proper authorisation, such data will be deleted.

7. Social networks

Fonda dels Pics is present on social networks such as Instagram, where it may process data of users who interact with its profiles (comments, “likes”, private messages, etc.). Processing is governed by this Privacy Policy and by the terms and policies of each platform.

8. Changes to this Privacy Policy

ARCASO 2000 SL reserves the right to modify this Privacy Policy to adapt it to legislative or case-law developments and changes in its services. Any changes will be published on this page, so we recommend that you review it regularly.