Who are we?
What do we use your data for? We collect your personal data directly as you browse our website through cookies and similar technologies, which allow us to analyse your behaviour and preferences. We may also receive your data through emails that you voluntarily send us to contact us or subscribe to our services.
Why do we process your data? We are authorised to process your data on various legal grounds. When you complete a form or send us an email with an enquiry or suggestion, we have a legitimate interest in responding to it.
Who do we share your data with? We will only share your data with partner companies where necessary to respond to requests received, provide our services or supply our products, as well as with banking institutions and public authorities where required by law. We never sell your data to third parties.
What rights do you have? You have the right to access, rectify or erase your personal data. You also have the right to object to our use of data you have previously authorised us to process, to request data portability and not to be subject to automated individual decision-making.
When processing your personal data, we apply the following principles to ensure the highest level of protection:
This Privacy Policy provides detailed information about how we use the personal data of our customers, suppliers and users, as well as anyone who contacts us, regardless of the means of communication used (online forms, telephone, email or in person).
We believe in being transparent about how we process your personal data, ensuring that you understand the implications of its use and the rights available to you. For this reason, we keep our Privacy Policy, Legal Notice and Cookie Policy up to date. You can consult this information on this website.
If you have any questions or would like further information about our Privacy Policy, please continue reading this document.
The controller responsible for processing your personal data is GESTION ATLANTICA LANZAROTE S.L.:
| Identity | GESTION ATLANTICA LANZAROTE S.L. – B16699159 |
|---|---|
| Address | TIMANFAYA 2, PLANTA 1 35510 – PUERTO DEL CARMEN, TIAS, LANZAROTE |
| Telephone | 928 81 60 00 |
| lopd@rosahotels.com;lopd@rosagroup.com |
GESTION ATLANTICA LANZAROTE S.L. informs users that the data they provide while browsing our website, completing the various data collection forms or sending emails will be processed by GESTION ATLANTICA LANZAROTE S.L.
Such processing is recorded in the Record of Processing Activities maintained by GESTION ATLANTICA LANZAROTE S.L. in accordance with the provisions of the General Data Protection Regulation (GDPR).
At https://rosagroup.es/, we process data relating both to users of our website and to third parties who maintain a relationship with us.
To help you understand how we process your data, we have distinguished between the purposes of processing, the types of data collected and the legal basis for processing according to the category of individuals whose data we process.
Below, we classify these individuals according to the nature of their relationship with GESTION ATLANTICA LANZAROTE S.L.
What data do we collect from our website users?
For what purposes do we process your personal data?
When users accept our Privacy Policy, they authorise us to process their personal data for the following purposes:
How do we obtain your data?
We obtain your personal data through the following means:
What is the legal basis for processing your data?
The user’s express consent (Article 6(1)(a) of the GDPR), given by completing the relevant forms and ticking the corresponding boxes, constitutes the legal basis for processing by GESTION ATLANTICA LANZAROTE S.L.
Users may withdraw their consent at any time. However, withdrawing consent does not affect the lawfulness of any data processing carried out before its withdrawal.
Legitimate interest in creating browsing profiles and identifying user preferences through the installation of cookies.
The performance of a contract or the implementation of pre-contractual measures when a customer submits a request through the various forms available on our website or requests information about the services provided by GESTION ATLANTICA LANZAROTE S.L.
What data do we collect from our customers?
How do we obtain your data?
If you are an online customer, we obtain your data through the following means:
If you are a customer who purchases our services in person, we obtain your data through the following means:
For what purposes do we process your personal data?
What is the legal basis for processing your data?
The performance of a pre-contract or contract to provide the necessary information and manage the service delivered or product supplied. Without this processing, it would not be possible to provide the corresponding service or product.
Users may withdraw their consent at any time.
Data processed on the basis of a website user’s consent will be retained for as long as it remains relevant to the purpose for which it was collected and the consent has not been withdrawn.
Data processed on the basis of legitimate interest will be retained for the period necessary to fulfil the purpose that justified its collection, always ensuring appropriate safeguards and respecting the rights and freedoms of the individuals concerned.
Data processed on the basis of the performance of a contract or the implementation of pre-contractual measures will be retained for as long as the contractual relationship remains in force, as well as for any additional period required by law.
IP addresses obtained through cookies will be retained for one year for the purpose of demonstrating the user’s consent.
For further information about cookie retention periods, please consult the “Cookie Policy” section of our website.
Data processed on the basis of a customer’s consent will be retained for as long as it remains relevant to the purpose for which it was collected and the consent has not been withdrawn.
Data processed on the basis of legitimate interest will be retained for the period necessary to fulfil the purpose that justified its collection, always ensuring appropriate safeguards and respecting the rights and freedoms of the individuals concerned.
Data processed on the basis of a contract, as well as data whose processing is partly justified by a legal obligation, will be retained for as long as the contractual relationship remains in force.
Once the contractual relationship has ended, where processing is linked to a legal obligation, the data will be retained for the period established by the applicable legislation. In such cases, the data subject may not withdraw authorisation for the processing of their data, except where legally established provisions concerning the blocking of such data apply.
Only individuals over the age of 14 may communicate with us by email. If you are under this age, you must obtain the consent of your parents or legal guardians.
Users guarantee that all data provided to GESTION ATLANTICA LANZAROTE S.L. is authentic and up to date, declare that they are over 14 years of age and accept sole responsibility for any false or inaccurate statements they make.
If you provide us with personal data relating to third parties, you declare that you have obtained their consent and undertake to inform them of the information provided in this clause, thereby releasing GESTION ATLANTICA LANZAROTE S.L. from any obligation in this regard.
Nevertheless, GESTION ATLANTICA LANZAROTE S.L. may carry out checks to verify that the third party has been informed, adopting the due diligence measures established under data protection legislation.
Personal data will not be disclosed to third parties unless required by law or where necessary to respond to your request.
Recipients to whom your data may be disclosed include:
https://rosagroup.es/ is hosted by Cloudflare, which stores data in data centres located in the United States.
Personal data provided by users may be stored in the United States by Cloudflare as part of the service relationship between the two parties, resulting in an international transfer of data.
This international transfer complies with the provisions of the GDPR, as it is based on an adequacy decision. The European Commission has recognised the United States as a country providing an adequate level of protection (EU-US Data Privacy Framework – Decision of 10 July 2023), and Cloudflare is included in the “Data Privacy Framework List”.
Our website only accesses user data through the following means:
International data transfers may also occur as part of the aforementioned disclosures or communications. In such cases, GESTION ATLANTICA LANZAROTE S.L. will use the mechanisms provided for in Articles 46 and 49 of the GDPR as safeguards for transfers to countries that are not covered by an adequacy decision issued by the European Commission.
In all cases, third parties with whom certain personal data is shared must have previously demonstrated that they have adopted appropriate technical and organisational measures to ensure its proper protection.
Transfers to third countries will only take place where there is a legally binding instrument in accordance with Article 46 and the subsequent provisions of the GDPR.
By accepting this Privacy Policy, users acknowledge that international data transfers may take place in accordance with the safeguards described above.
If the requirements established by the GDPR are not met, the data subject may give their consent to the international transfer, or a contract may be performed in the interests of the data subject. Otherwise, authorisation must be requested from the Supervisory Authority.
GESTION ATLANTICA LANZAROTE S.L. does not sell its users’ data to third parties under any circumstances.
Users may exercise the following rights in relation to GESTION ATLANTICA LANZAROTE S.L.:
To exercise these rights, users must submit a written request specifying the right they wish to exercise, accompanied by a document proving their identity and a postal or email address for notification purposes.
Requests may be submitted by post to:
GESTION ATLANTICA LANZAROTE S.L.
TIMANFAYA 2, PLANTA 1
35510 – PUERTO DEL CARMEN, TIAS, LANZAROTE
Alternatively, requests may be sent to the following email addresses: lopd@rosahotels.com;lopd@rosagroup.com.
GESTION ATLANTICA LANZAROTE S.L. must respond to requests concerning the exercise of data protection rights within one month of receiving the request.
This period may be extended by a further two months where necessary, taking into account the complexity and number of requests.
We will inform you of any extension within one month of receiving your request, explaining the reasons for the delay.
Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Spanish Data Protection Agency) if they believe that GESTION ATLANTICA LANZAROTE S.L. has infringed their rights under data protection legislation, at www.aepd.es.
GESTION ATLANTICA LANZAROTE S.L. has an active contract with the hosting company Cloudflare for the hosting of its website.
In all cases, GESTION ATLANTICA LANZAROTE S.L. guarantees that appropriate measures have been adopted to ensure the confidential processing of personal data, taking into account its sensitive and confidential nature.
The company undertakes to keep such data confidential and to handle it with the utmost discretion.
It also declares that it has implemented information security policies appropriate to the type of data processed within its information systems, in accordance with the provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
All data provided through our platform is collected using a secure protocol. Our website has an SSL certificate, which establishes an encrypted connection whenever a user visits our website and exchanges information with us.
If you choose to leave our website through links to other websites that do not belong to our organisation, GESTION ATLANTICA LANZAROTE S.L. will not be responsible for the privacy policies of those websites or for any cookies they may store on your computer.
Date: 11/09/2026
Version: V.1.0
