Privacy policy

This privacy policy describes how we collect, use, and manage your information. Your privacy is important to us, and we are committed to protecting our Users’ personal data in compliance with the EU General Data Protection Regulation (GDPR) and Organic Law 3/2018 (LOPDGDD). However, we cannot assume liability for damages resulting from alterations caused by third parties to user systems or files.

1. DATA CONTROLLER

Your personal data will be processed by BAEZA RUIZ HOTELES S.L., holder of NIF B70693262, registered office at AVDA CASTILLA LA MANCHA, 31 – 45270 MOCEJÓN (Toledo) SPAIN, telephone +34 925114041, email direccion@zaruhotelboutique.com.

2. PURPOSES OF PROCESSING

  • Purpose 1 (Inquiries and Requests): To address inquiries or send requested information. Only data belonging to the user or represented third parties should be provided. In instant messaging channels, only necessary data will be processed.
  • Purpose 2 (Contractual Obligations): To fulfill contractual obligations upon purchasing products/services, and manage administrative, tax, and accounting tasks.
  • Purpose 3 (Commercial Communications): To send periodic commercial information about products/services, newsletters, or third-party partner offers, where consented to or based on prior contractual relationship.
  • Purpose 4 (Website and Social Media Publications): To publish images or user details with prior consent (excluding incidental public event images). Users or guardians may request removal at any time. Social media followers consent to processing under each platform’s rules and terms. Interactions, inquiries, and commercial communications via internal messaging are permitted within social media environments.
  • Purpose 5 (Recruitment): To process job applications and CVs sent by candidates for selection processes.

3. COOKIES

BAEZA RUIZ HOTELES S.L. may use cookies. Please consult our Cookie Policy via the link on the homepage.

4. LEGAL BASIS FOR PROCESSING

  • Purpose 1: Data subject’s consent granted upon submitting an inquiry.
  • Purpose 2: Performance of a contract for product/service acquisition and legal tax obligations.
  • Purpose 3: Consent for periodic commercial communications or legitimate interest if a prior contractual relationship exists.
  • Purpose 4: Consent for publications on social media and websites. Following official profiles constitutes consent to process profile public data within the social network.
  • Purpose 5: Consent to participate in selection processes granted upon sending a CV. Email submission implies consent to process the CV under our privacy policy.

5. DATA RETENTION PERIODS

  • Purposes 1 & 2: Retained for statutory limitation periods and while mutual interest remains; deleted when no longer required.
  • Purpose 3: Retained until consent is withdrawn or the data subject objects to processing.
  • Purpose 4: Published images/data are retained while displayed on profiles and until consent is withdrawn. Afterwards, data will be kept blocked during statutory limitation periods.
  • Purpose 5: Discarded CVs are destroyed, with a maximum retention period of one year.

6. UPDATING PERSONAL DATA

Users guarantee that provided data are truthful, accurate, current, and complete, and agree to notify any changes via the contact addresses specified below.

7. RECIPIENTS OF INFORMATION

Data will not be disclosed to third parties unless required by law or explicitly consented to. Data processors with confidentiality contracts include:

  • Technology service providers: IT support, data hosting, electronic communications.
  • Professional advisors: Management consultancies and auditors.
  • Logistics and transport: Delivery companies for product purchases.

8. INTERNATIONAL DATA TRANSFERS

Using social media services (Facebook, Twitter, YouTube, LinkedIn, Instagram) may involve international data transfers outside the EU. These entities operate globally and utilize standard contractual clauses and cookies. Relevant policies:

  • Twitter: https://help.twitter.com/es/rules-and-policies/global-operations-and-data-transfer
  • LinkedIn: https://es.linkedin.com/legal/l/dpa
  • Google: https://cloud.google.com/security/compliance/eu-mcc?hl=es
  • Facebook: https://es-es.facebook.com/privacy/explanation
  • WhatsApp: https://www.whatsapp.com/legal/updates/privacy-policy/?lang=es

9. RIGHTS OF THE DATA SUBJECT

Data subjects have rights to access, rectification, erasure, restriction of processing, objection, and data portability, as well as the right to withdraw consent at any time. Complaints may be lodged with the Spanish Data Protection Agency (www.aepd.es).

10. EXERCISING YOUR RIGHTS

Written requests should be sent to BAEZA RUIZ HOTELES S.L., AVDA CASTILLA LA MANCHA, 31 – 45270 MOCEJÓN (Toledo) SPAIN, or via email to direccion@zaruhotelboutique.com. Commercial communications include opt-out links or can be stopped by emailing with the subject “Unsubscribe from Communications Service”.

11. SECURITY MEASURES

The CONTROLLER implements appropriate technical and organizational measures in accordance with GDPR and LOPDGDD Article 5 principles to protect user rights and freedoms.

12. SECURITY WARNING ON FINANCIAL COMMUNICATIONS

Due to digital fraud risks, users must verbally verify bank account changes over the phone with their usual contact before making payments. The CONTROLLER is not liable for fraudulent payments if this check is omitted.

13. ADDITIONAL SOCIAL MEDIA INFORMATION

Profile Usage: The Controller accesses public profile information, posts updates on user profiles, and sends direct messages. Users control privacy settings directly on each platform.

Publications: Users joining profiles may post text, links, or images if they hold copyright/consent. Offensive or unlawful content will be removed immediately without notice.

Minors & Special Needs: Access is prohibited for under-18s on Controller social media profiles. Representatives must act for individuals with special needs. Profiles do not intentionally collect minor data.

14. ACCEPTANCE AND CONSENT

The user acknowledges being informed of the data protection policy and consents to processing as described. Specific terms may apply to certain website services.

Entity adapted to privacy regulations by ARCODATOS (www.protecciondedatos.com.es). 

Document date: 17/07/2026.