Private Policy – YOMO BCN Port

This Policy applies to visitors to this website (our Website), to users of the services that BCN Port offers for the purposes described in section ‎‎4 of this Policy, and to all persons whose personal data (for example, their images) may appear on our website or in the context of said services.

The only controller for the use of your personal data as indicated in the previous section is the owner of this website:

PUPESH BARRASKILO SL. (BCN Port), with Tax Registration Number B87261178 and registered office at the street Muntaner, 354 – apartment 4 floor 2, 8021 Barcelona, ​​Spain.

We have a Data Protection Officer whom you can contact by email at dpo@yomohotels.com.

BCN Port is not responsible for the activities carried out by other websites, even if they are accessed through links on our website. That is why we strongly recommend that you carefully read the information provided by these other controllers before giving them your personal data (especially the privacy and cookie policies of each website you visit), and that you contact said controller if you have any concerns or questions.

In general, it is you who directly provide us with your personal data —for example, when you call us by phone or complete the forms on this website—. The only exceptions to this rule are:

• Your image, when it is eventually picked up by our video surveillance cameras;
• Data provided to us by third parties (for example, a travel agency) that reserve or purchase BCN Port products or services on your behalf;
• The photographs in which you may appear of the events that we organize or in which we participate;
• The images that correspond to any news in which we consider that the public interest and the right to information prevail over the possible interests of the people whose image or other personal data is published on our website;
• The data about you that may appear in reservations of which the holder has made you the beneficiary, or that they provide us about you in the emails we receive;
• The last four digits of your credit card, together with the amount of the purchase and the transaction number returned to us by our payment service provider, as they will be necessary in the event that you wish to consult or revoke the transaction;
• The contact details provided to us by our service and product providers when you act as their commercial or contractual representative; and
• The cookies on this website, about which you will find more information in our cookie policy.

To manage your stay in our facilities

We collect your data for the purpose of:

• Completing the arrival and departure registration;
• Making available to the police authorities a copy of the identity documents of all guests, for one year;
• Processing your promotional codes and payments;
• Providing you with a consistent and personalized service, advising you on the services you can enjoy in our facilities (based on the use you have made previously or on the preferences you have communicated to us);
• Providing you with left-luggage, safe and parking services;
• Buying or booking services offered by third parties, when you ask us to do so and on your behalf (for example, arranging excursions and other tourist visits, requesting taxis or chauffeured vehicles, and facilitating restaurant and event reservations);
• Managing and providing you with access to Wi-Fi, television and other connectivity services (including access to business center services such as fax and copier services) and entertainment systems (such as PlayStation or streaming videos on demand);
• Providing you with the catering service in the room (which includes respecting the food restrictions, health or any other type of personal needs that you communicate to us);
• Providing you with room service (including room cleaning, laundry services, and anything you want to request from us for your convenience that we can provide, such as a pillow, duvet, or mobile phone charger);
• Managing the rest of your requests and queries, or your complaints and suggestions; and
• Determining if you qualify for age-restricted products and services (such as alcohol or in-room adult entertainment).

The bases that legitimize us to process your data in relation to each of the previous purposes are the fact that it is necessary for the execution of the contract of your stay in our facilities or the contract of acquisition of services from third parties, our legal obligations (for example, with regard to the collection of identity documents or the invoicing), the consent you express when indicating your food preferences, and our legitimate interest in respecting your preferences (for example, in relation to whether you want us to set your room near the elevator or on a high floor).

To create a user account for our hotels

We collect the data you provide us when you register on our website to create a personal account with which to facilitate the management of your reservations or purchases and the evaluation of our services.

The basis that legitimizes this processing is the execution of the user contract that you sign at the end of the registration.

To manage your reservations or purchases online or by phone

We process the data that you provide us in relation to the reservation of or purchase of our products and services (for example, when you book your stay in our hotel) or promotions that combine our services and products with those of our partners (for example, nights of hotel and tickets to attend a show), to formalize your purchase or reservation and communicate by email or by telephone any information related to it, as well as to manage and issue supporting documents of the reservation or sale and any related communication that could be necessary for its formalization.

We can also process the data that you provide us during the purchase or reservation to manage, administer, provide, expand and improve the contracted services and products, and to extract statistics in relation to the interest that these and our promotions arouse. Specifically, we can collect the number and expiration date of one of your credit cards, together with the name of the holder, as a guarantee of the reservation and fraud control, and add to said data the code that appears on the back of said card to use it as a guarantee of payment from your entry into the hotel.

The basis that legitimizes these processing is the sales contract or the reservation agreement of the product or service that you sign when completing the purchase or reservation, and our legitimate interest in improving the quality of the services that we offer you.

To analyze your assessment of our services and the interest aroused by our marketing campaigns, in order to improve

We can process the data you provide us, for example, during the purchase or reservation of products or services, to request your assessment of the attention received.

We can also extract aggregate statistics (that is, whose statistical result does not include personal information of any kind) in relation to the interest that our marketing campaigns arouse.

The basis that legitimizes these processing is our legitimate interest in improving the quality of our services and the events that we manage or promote, as well as our marketing campaigns.

To send you information, promotions and discounts of your interest

We process your email when you subscribe to our newsletter service to inform you about news, events, exclusive content, and discounts or promotions so that you can make the most of our facilities and services.

Additionally, we collect your email when you purchase our services, to inform you about news, events, exclusive content, discounts or promotions and contests, so that you can take full advantage of the services of your interest.

The legal basis of this processing is your consent, and you can withdraw it at any time by exercising your right as indicated later in this policy, or through the link at the bottom of each email. The only consequence of withdrawing consent is that you will no longer receive the information we sent you and you will no longer be able to participate in the promotions, contests or raffles reserved for our subscribers.

If you receive the information because you have purchased our services, the legal basis for this processing is our legitimate interest in keeping you informed about our products and services related to those you have purchased, which you can oppose at any time, as in the previous case and with identical consequences, exercising your right as indicated later in this policy or through the link for that purpose in the footer of all our emails.

To attend to your requests, queries or claims

We collect the personal data that you provide us in your emails, by phone, or through the form on the contact page or the requests for the exercise of rights, to attend to your requests, queries or claims in relation to our services, or to attend the rights that you have about your personal data.

The legal basis of this processing is the consent that you express when sending or giving us these data, our legal obligation to attend to your requests for rights, and our legitimate interest in serving you. The provision of your personal data is, therefore, voluntary, although if you do not provide us with the personal data that we need, we will not be able to process your request, query or claim. You can revoke your consent whenever you wish, although, likewise, such revocation will make it impossible to continue processing your request, query or claim.

To manage any future claims

We keep blocked the data that may be necessary to manage your possible claims, or ours, based on our legitimate interest in defending ourselves to safeguard our rights.

To control access to our facilities, events or services through tickets or credentials

We use the data from your reservation and your ID or passport, and even a document proving your protection status against Covid-19 (the latter, only if we are legally obliged to do so), to authorize or not your access to our facilities, to control the access to the restricted areas of our events or services, as well as to analyze and control the occupation and logistics of the different areas, and ensure your health and safety (including the prevention of the spread of diseases and the tracking of contacts of people affected by Covid-19).

The legal basis for this processing is the contract for your stay in the hotel or the services contract to which you are a party, and, in the event that we request documents proving your protection status against Covid-19, our legal obligation.

To guard and return the objects that you lose in our facilities

If you have lost a mobile phone or any other object that contains personal data, we will keep said personal data until the legitimate owner of the lost object successfully claims it at our customer service point or, after a reasonable time, we deliver it to the police authorities so that they are the ones who manage their custody and eventual return.

The basis that legitimizes us to process personal data from mobile phones, wallets, backpacks and other objects that may contain personal data in this way is our legitimate interest in preventing their theft and returning them to you. 

To give media coverage to events

If you participate in person at our events, the independent press and our own professionals can record your image and, on previously agreed occasions, your voice, in the context of that event.

The legal basis for this processing is our legitimate interest in the media coverage of the events that we organize or sponsor for the purpose of using the recordings in our promotional materials, including our website and our accounts on social networks.

You are not required to appear on a recording. If you wish, you have the right to oppose our legitimate interest and ask us to remove the material in which you are identified. In order to be able to evaluate your opposition against our legitimate interest, and where appropriate, immediately remove the images that identify you, we will ask you to tell us where you have seen them.

To promote our facilities, products and services

If you have signed a contract or consent to transfer image rights with us, we may collect photographs or videos of our facilities, products or services in which you are identified, and perhaps heard, for later use in promotional campaigns, or we can publish them in the media such as the national or international press, our website, or our social networks. If you have signed a consent to transfer image rights, we inform you that you can revoke it at any time so that we can remove your image from our website and/or our networks, without the revocation having any effect on the dissemination of your image that has taken place before we process your consent revocation.

Additionally, we can graphically record the environment of our facilities to promote our premises, and its products and services and, eventually, your image and your voice may appear in said graphic material. Unlike what is indicated in the previous paragraph, in this case the legal basis for the processing of your images is our legitimate interest, which you can oppose at any time if you consider that it is contrary to your own interests. In order to be able to evaluate your opposition against our legitimate interest, and where appropriate, immediately remove the images that identify you, we will ask you to tell us where you have seen them.

To initiate or maintain the relationship with our suppliers

If you represent a provider of products or services, we collect your contact information and your signature for the purposes of:

1. 1. Managing our relationships of all kinds with the supplier you represent.
   2. Managing the corresponding record of our list of authorized suppliers.
   3. Managing the budgets and invoices of the supplier you represent.

The processing linked to purposes ‎a) and ‎b) are legitimized by the employment or service contract that you have signed with the provider you represent and our legitimate interest in contacting them. And the processing linked to the purpose ‎c) is legitimated because it is necessary for the execution of the contract you have signed with us.

To preserve security through video surveillance

We collect your image through our video surveillance systems in order to preserve the safety of people, goods and the facilities themselves.

The basis of legitimacy for the aforementioned processing is the public interest in public security, our legitimate interest in the security of our establishments, and the legitimate interest of third parties who want to request judicial protection over a crime that can be proven by a few minutes of a recording.

To select and hire our staff

We treat the data of the CV that you voluntarily send us to manage the relationship with the candidates for a job position at BCN Port, including the process of searching, filtering and storing the CVs of potential candidates, the personnel selection process and the process of hiring.

The basis of legitimacy for the aforementioned processing is your consent, which you express when you send us your CV, the execution of pre-contractual measures, and if we do not have an open contracting process or you are not selected and we consider that you can fit in future selection processes, our legitimate interest in keeping your CV to include it in said future processes.

To ensure the proper functioning of our website (functional cookies)

We use functional cookies to ensure the proper functioning of our website.

As these cookies are necessary for the proper functioning of the website, their use does not require you to give us your consent, and the basis that legitimizes us to use them is our legitimate interest in being able to offer you the services of our website.

You can find more information about these cookies in our cookie policy.

To extract aggregate statistics of the use that visitors make of our website (analytical cookies)

We use analytical or statistical cookies to identify the most and least visited pages, analyze what content is of greatest interest to our visitors, and measure the success of our information campaigns, all with the aim of improving the services we offer you through the Web. All these purposes provide aggregated results, in which it is not possible to identify the interests of any specific person.

As these are non-necessary cookies, we will not use them until we have your consent, and not giving it to us or withdrawing it will have no effect other than hindering our goal of improving the website by analyzing aggregate statistics of our visitors’ browsing.

You can find more information about these cookies in our cookie policy.

To send you personalized direct advertising (advertising cookies)

We use our own and third-party advertising cookies to send you personalized advertising, from us or from our partners.

As these are non-necessary cookies, we will not use them until we have your consent, and not giving it to us or withdrawing it will have no more effect than that your visit to our website cannot be used to improve the interest of the advertising you receive.

You can find more information about these cookies in our cookie policy.

To be able to use Google services

Additionally, as an obligation that Google LLC imposes on the entities that, like us, use the Google services, we inform you that these services are operated by Google Inc., domiciled at 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, and that Google Inc. is a beneficiary party of them.

The information generated by the cookies about your use of this website and your advertising preferences is generally transmitted to a Google server in the USA and stored there. If you want more information, you can consult the page that describes how Google uses the information on our website and/or Google’s privacy policy regarding the aforementioned services.

We inform you that we have activated the IP anonymization function to our website, in order to add additional safeguards in the standard contractual clauses that protect this international data transfer to the USA. With this, Google will shorten your IP address before transmitting it to the USA (identity obfuscation process). Only in exceptional cases is the full IP address sent to a Google server in the USA and abbreviated there. Google guarantees that the IP address transmitted by your browser to Google Analytics will not be processed together with any other data held by Google.

You can review the categories of personal data processed by these services at privacy.google.com/businesses/adsservices

For other purposes that are not incompatible with the above

We may use your personal data for other purposes that are not incompatible with those indicated above (such as archiving purposes for reasons of public interest, scientific or historical research purposes, or statistical purposes) provided that it is permitted by the regulations in force for what regards personal data protection, and, of course, acting in accordance with these and with the rest of the applicable regulations.

We do not share with anyone your personal data, unless:

• You are the one who requests it.
• We have a legal obligation to do so (for example, we are legally obliged to provide copies of invoices to the Department of Taxes and Borders of the Government of Andorra when requested to do so).
• We act as intermediaries, for example, when we have to make a reservation on your behalf (for example, at a show).
• You contract our products or services through intermediaries (for example, a travel agency) to whom we have to deliver products or services that they have purchased on your behalf (for example, the ticket to a show),
• We are co-responsible for data collection, so that, always with your consent, other entities process them on their own behalf. This is the case of:
  • Google Ireland Ltd, with registered office at Gordon House 4, Barrow – Dublin, Ireland, which acts as BCN Port’s data processor for the processing of cookie data that is necessary to use its Analytics and Ads services, and as independent controller for all processing carried out on your behalf in accordance with its privacy policy. We transfer data to Google Ireland Ltd based on the data protection agreement that said company located in the EU includes in the addendum to the standard contract for the countries appropriate to the GDPR, as is the case of Andorra, to which we add the additional safeguard of activating the anonymization of the IPs that collect the cookies.
• We need to protect your rights, our rights, those of our employees, or those of third parties (which may require disclosure to the police for security reasons or to health authorities to prevent the spread of disease, for example, for contacts tracing purposes), for example:
  • If our video surveillance cameras record a theft at our premises; or
  • If a third party requests video surveillance images from us based on their legitimate interest in requesting effective judicial protection regarding the commission of a crime or requesting compensation for the damages that the transferred images prove, and provided that said third party commits in writing to use them exclusively for the denunciation of said crime or for the claim for the damages suffered, and reducing the transfer of images to the minimum essential to fulfill the intended purpose.
• We need them to be processed by our service providers, on our behalf, and under the terms and conditions of the corresponding data processor contract.
• You expressly authorize us to share data collected by advertising cookies with third-party advertising companies to publish their own ads in the spaces designated for this purpose on our website. We are co-responsible for the collection of your personal data through said cookies, as long as you consent, since without our website said data would not be collected, and third-party companies use these data so that said third parties can show you more personalized advertisements in accordance with the interests that can be deduced from your Internet browsing. In our cookie policy you will see what advertising cookies we offer you and how to configure them.

Any international transfer that we eventually need to make will comply with what is established by the regulations in force that apply to us.

BCN Port keeps your personal data exclusively for the duration of the processing activities that require them, and, afterwards, we will keep them blocked for as long as it takes to prescribe the legal responsibilities that apply to us at all times, derived from the processing in question (including the obligation to be able to demonstrate that we have responded to your request for the destruction of personal data).

For example:

• We will keep the video surveillance recordings for a maximum of 30 days when they do not contain incidents, and, if exceptionally a security incident has occurred during that period or there are indications of the commission of a crime (for example, a robbery), we will extract a copy of the part of the recording that includes the incident that will be kept until it is delivered to the police or to the interested party involved who requires it to prove their request for judicial protection.
• We keep your email address for the purpose of sending you newsletters as long as you do not revoke the consent that legitimizes us to send them to you.
• We keep the invoices of your stay at the hotel for a period not exceeding 6 years.

When we do not have a legitimate purpose to process some of your personal data, we will delete or anonymize those data, and if this is not possible (for example, because they are in backup copies), we will store them securely and block it to isolate them from any further processing until deletion is possible.

You have the right to obtain confirmation as to whether or not BCN Port has any personal data of you.

We remind you that when you share personal data with other controllers, you must exercise your rights directly against those controllers, following the instructions provided in their own privacy policies. Specifically, in relation to the data that our cookies share with Google, we inform you that you can install in your browser Chrome, Internet Explorer, Safari, Firefox and/or Opera, the plugin to not send Google Analytics data to Google Inc.

Next, we explain what other rights you have and how to exercise them.

Your rights

In accordance with the provisions of the LQPD and the GDPR, you can request the execution of the following rights:

• Access to your personal data.
• Rectification of any of your personal data, specifying the reason.
• Erasure of some or all of your personal data.
• Limitation of the processing of your data, specifying the reason for the limitation.
• Opposition to the processing of your personal data.
• Portability of your data when the legitimacy basis for its collection has been your consent or a contract.
• Right not to be subject to automated individual decisions.

Where and how you can exercise your rights

You can exercise your rights:

1. By sending a written request, addressed to BCN Port at our postal address indicated in section 2 of this policy, indicating a means of contact to be able to respond to your request, or request more information if necessary. We would appreciate it if you would indicate us in the envelope “Exercise of Personal Data Protection Rights”.
2. By sending the form associated with the right you wish to exercise, or a message containing said information, to the email address dpo@yomohotels.com, indicating in the subject “Exercise of Personal Data Protection Rights”. You will find these forms later, in this same section of this privacy policy.

In both cases, if it is not possible for us to verify that you are who you say you are, we will ask you to please send us proof of your identity, and thus ensure that we only respond to the data subject or his/her legal representative.

Likewise, if you consider that you have not obtained full satisfaction in the care of the exercise of your rights, we inform you that you can file a claim with the national control authority of your country, or by contacting the Andorran Data Protection Agency for this purpose (APDA).

Forms for the exercise of your rights

In order to facilitate the exercise of your rights, we recommend that you use the corresponding application forms from among the following:

• Form for exercising the right of access
• Form for exercising the right of rectification
• Form for exercising the right to object (model A, and model B)
• Form for exercising the right of erasure
• Form for exercising the right to limitation of processing
• Form for exercising the right to portability
• Form for exercising the right not to be subject to automated individual decisions

We are fully committed to protecting your privacy and your personal data. We have prepared a record of all the personal data processing activities (ROP) carried out by BCN Port, we have analyzed the risk that each of these activities may pose to you, and we have implemented the appropriate legal, technical and organizational safeguards to avoid, as far as possible, the alteration of your personal data, their misuse, loss, theft, unauthorized access, or unauthorized treatment. We conveniently keep our policies updated to ensure that we provide you with all the information we have about the processing of your personal data, and to ensure that our staff receives the appropriate guidelines regarding how they should treat your personal data. We have signed data protection agreements with all our service providers, meeting the need that each one has to process personal data. We restrict access to personal data to those employees who really need to know them to carry out any of the processing activities mentioned in this policy, and we have trained them and made them aware of the importance of and maintaining the confidentiality, integrity and availability of your information, as well as on the disciplinary measures that would imply any eventual infraction in this matter.

We will update this policy when necessary to reflect any changes that occur in the regulations or in our processing activities. If the changes are important, we will notify you before they come into force by sending you a notice or posting a prominent notice on this website, and you will have the option to exercise your rights as we have informed in a previous section. In any case, we recommend that you periodically review this privacy policy to learn how we protect your personal data.

If you have any questions about this policy, do not hesitate to contact us by sending an email to dpo@yomohotels.com.