Privacy Policy
Ushuaia The Mountain Hotel Arinsal, Andorra
In accordance with the provisions of Law 29/2021, of October 28, on the protection of personal data (LQPD), the regulations that develop it, and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), in the processing activities that are applicable to you, in accordance with Article 3.2 of this regulation, it is reported that the personal data collected are incorporated and processed in the files owned by CEDA, SA (hereinafter, “CEDASA”).
Our clients and their data are very important to us, so we commit to:
The data controller of the client’s data is CEDA, SA, which operates commercially as USHUAIA THE MOUNTAIN HOTEL.
Tax ID: A-700305-H
Registered office: ctra. de Comallemple s/n, AD400 Arinsal
Phone: + 376 73 75 75
Email:
info@ushuaiamountain.com
You can contact the data protection officer by sending a message to lqpd@cisagroup.com or by post to the address indicated above.
CEDASA may collect and process personal information that you have provided directly and voluntarily, such as name, address, email address, phone number, date of birth, billing information, or identification number (passport, ID…). We do not request or process sensitive data, such as those related to race, ethnicity, political opinions, religious or philosophical beliefs, or sexual orientation.
Your data is collected when:
The indication of any personal data through the different forms and email addresses of this website implies acceptance and consent to their processing on the terms indicated in this privacy policy.
In this way, consent or other legal bases, such as contract performance, our legitimate interest, and compliance with legal obligations, include the following purposes, with their respective legal bases, without the data being applicable or used for any other purpose for which they were collected.
The personal data provided by individuals are used exclusively for the following purposes:
CEDASA informs you that your personal data will not be processed for any other purpose than those listed in this section, except in cases where there is a legal obligation, a court order, or your consent.
Your personal data cannot be subject to automated decisions that have legal effects for the data subject.
The legal basis for the processing of your personal data corresponds to the free and legitimate acceptance of the legal relationship by the user at the time of accepting this policy of personal data protection and privacy.
Likewise, the legal basis for the processing of your data for each of the purposes of the processing of personal data identified previously is detailed below:
The personal data provided is retained by CEDASA for as long as there is a contractual or commercial relationship and until you withdraw your consent, exercise your rights to deletion, opposition, and limitation of the processing of personal data, or, in our case, for the maximum legal period allowed by data protection legislation, including the limitation periods of legal actions for the attention of possible liability arising from the contractual relationship.
In this latter case, CEDASA must keep the data duly blocked, without using it, as long as they may be necessary for the exercise or defense of claims, or may entail any type of judicial, legal, or contractual liability from their processing that must be met and for which their recovery is necessary.
CEDASA’s website is not intended for minors. In any case, we do not collect any personal data from individuals under the age of sixteen without the consent of their legal representative. The data collected from individuals under the age of sixteen is obtained at the time of registering in our hotels, by legal obligation, and only the data necessary for this obligation.
CEDASA, in general, does not disclose your personal data to third parties. However, they may be transferred to companies that are part of CEDASA when providing their services and when necessary to fulfill the obligations arising from the contract or compliance with legal obligations, including communications to authorities that request it, such as law enforcement agencies.
Service providers contracted by CEDASA acting on its behalf as data processors may also access this data.
Data subjects have the following rights:
If you have given your consent, you have the right to withdraw it at any time, without affecting the legality of the processing based on the consent given before the withdrawal.
You can exercise your rights in writing by sending a message to the email address lqpd@cisagroup.com or by post to the address ctra. de Comallemple, AD400 Arinsal. The user must specify which right they want to exercise and provide a copy of their identification data (for example, ID/passport). If we need additional data to verify your identity, we will let you know.
You also have the right to file a complaint with the Andorran Data Protection Agency (www.apda.ad) if you believe that we have not processed your personal data in accordance with the regulations.
You declare that all data provided is legal, adequate, relevant, accurate, and, if necessary, up-to-date. The provision of data that does not meet the aforementioned requirements releases CEDASA from liability.
CEDASA has taken the necessary measures to maintain the required level of security, according to the nature of the personal data processed and the circumstances of the processing, in order to prevent, to the extent possible and always according to the state of the art, its alteration, loss, unauthorized access, or processing.
Likewise, CEDASA guarantees that it has implemented mechanisms to:
CEDASA does not make international transfers of data to provide its services. However, if a data processor acting on our behalf processes personal data in a third country, CEDASA will transfer the data based on an adequacy decision or, failing that, will assess whether the third country guarantees an adequate level of data protection and will apply all measures and controls within its reach to protect your personal data, including the signature of standard contractual clauses approved by the European Commission, the adoption of binding corporate rules, and the request for approved and recognized certifications or codes of conduct.
Access to our website may involve the use of cookies. Cookies are small amounts of information stored on the browser used by each user so that the server remembers certain information that can be used later. This information allows you to identify yourself as specific users and store your personal preferences, as well as technical information, for example, visits or specific pages you visit.
Users who do not wish to receive cookies or want to be informed before they are stored on the computer can configure their browser for this purpose.
For more information, please visit our cookie policy.
As users, you are informed that CEDASA has created profiles on the social networks Facebook and Instagram for the purpose of informing about its products, services, and activities.
User data is usually processed by social networks for research purposes. To protect your privacy, when integrating the connection buttons of the specified social networks on our website, no cookies are installed when our web pages are loaded on your device.
Each social network has its privacy policy on how it processes personal data when the user accesses its website. Therefore, when the user accesses or views our profile on Facebook and Instagram, the social network requests express consent to accept cookies, so it is recommended that the user carefully read the data protection information provided by the social network provider.
As a user and client, you declare that you have read and expressly accepted this privacy policy when registering with CEDASA, granting unequivocal and express consent to CEDASA to process the data in accordance with the purposes and services reflected here.
The data collected in all private communications between CEDASA and clients are treated with absolute confidentiality, so we commit to the obligation of professional secrecy regarding personal data, to the duty of storing and adopting all necessary measures to prevent their alteration, loss
Our clients and their data are very important to us, so we commit to:
- Not collect any personal data without your consent.
- Collect your data according to the principle of data minimization, that is, only the necessary, essential, and not excessive data for our purposes.
- Collect and process your data only for the purposes described in our policy and inform the recipients.
- Collect and process only the data necessary for the correct processing of your request or the customization of the services you request from us.
- Commit to taking the necessary measures to ensure the confidentiality of your data and prevent their disclosure to unauthorized third parties.
- In cases of transfers of data to authorized third parties, we take all appropriate measures to ensure the security of this transfer.
- Inform you about your rights of access, rectification, and opposition in accordance with Law 29/2021, of October 28.
1. DATA CONTROLLER
The data controller of the client’s data is CEDA, SA, which operates commercially as USHUAIA THE MOUNTAIN HOTEL.
Tax ID: A-700305-H
Registered office: ctra. de Comallemple s/n, AD400 Arinsal
Phone: + 376 73 75 75
Email:
info@ushuaiamountain.com
You can contact the data protection officer by sending a message to lqpd@cisagroup.com or by post to the address indicated above.
2. DATA TYPES
CEDASA may collect and process personal information that you have provided directly and voluntarily, such as name, address, email address, phone number, date of birth, billing information, or identification number (passport, ID…). We do not request or process sensitive data, such as those related to race, ethnicity, political opinions, religious or philosophical beliefs, or sexual orientation.
3. PROCESSING ACTIVITIES: PURPOSES AND LEGAL BASIS
Your data is collected when:
- You contact our reservation department by phone or email.
- You make a reservation on our website.
- You provide your data when checking in.
- You send an email.
- You share a page or offer by email or through a social network.
- You respond to a satisfaction survey.
- We manage the services you request.
- You subscribe to our newsletter.
- You attend events or activities organized at our facilities.
- Contests or raffles are held.
The indication of any personal data through the different forms and email addresses of this website implies acceptance and consent to their processing on the terms indicated in this privacy policy.
In this way, consent or other legal bases, such as contract performance, our legitimate interest, and compliance with legal obligations, include the following purposes, with their respective legal bases, without the data being applicable or used for any other purpose for which they were collected.
The personal data provided by individuals are used exclusively for the following purposes:
- Managing reservations and services, adequately addressing inquiries, comments, incidents, or suggestions, in accordance with contract performance, pre-contractual operations, legitimate interest, or your consent.
- Keeping you informed by electronic means, mobile devices, or any other similar means about incidents, modifications, inquiries, or similar related to your reservations, contracted services, or inquiries made, based on legitimate interest or your consent.
- Improving and personalizing our attention and service, based on legitimate interest or your consent.
- Managing and nurturing the relationship with our client, according to contract performance, pre-contractual operations, legitimate interest, or your consent.
- Keeping you informed, by electronic means or mobile devices, or by any other means provided and facilitated, about offers, discounts, personalized services, activities, or products of CEDASA that may be of interest to you, in accordance with your consent or CEDASA’s legitimate interest.
- Managing access to the events or activities that CEDASA organizes at its facilities, according to contract performance or your consent.
- Managing and organizing contests or raffles aimed at promoting CEDASA, its establishments, and its brands. Communicating winners and prize delivery, if applicable, according to your consent, including the publication of this data in CEDASA’s external communication media, such as social networks (Facebook, Instagram), or the website www.ushuaiamountain.com.
- Statistical analysis of website visits for commercial purposes, based on CEDASA’s legitimate interest or your consent.
- Managing requests for access, rectification, opposition, limitation, and portability, based on compliance with legal obligations.
- Managing debts and disputes, for compliance with legal obligations and legitimate interest.
CEDASA informs you that your personal data will not be processed for any other purpose than those listed in this section, except in cases where there is a legal obligation, a court order, or your consent.
Your personal data cannot be subject to automated decisions that have legal effects for the data subject.
Legal basis for the processing of your data:
The legal basis for the processing of your personal data corresponds to the free and legitimate acceptance of the legal relationship by the user at the time of accepting this policy of personal data protection and privacy.
Likewise, the legal basis for the processing of your data for each of the purposes of the processing of personal data identified previously is detailed below:
- Reservation, registration, and contracting of products, services, or activities, as well as managing membership registration in the loyalty program: The legal basis for the processing of your personal data is the contractual relationship, and, if applicable, the pre-contractual relationship established between the parties for the execution of the services and products contracted or requested by interested parties, and in particular, for the execution of the reservation of the services, activities, and products of our establishment that you have made, according to the terms and conditions stated in the Terms and Conditions section, as well as compliance with the commercial, fiscal, and accounting obligations that apply. All this is based on Article 6.1, sections a) and b), of the LQPD. Refusal to provide the personal data requested for the reservation thus prevents the conclusion of the contract or the requested reservation. For more information on the contracting of our products and services, please refer to the Conditions and Terms of Contract section. Once the reservation is made, the interested party will receive a confirmation email with the reservation details.
- Provide you with information by electronic means, mobile devices, or any other analog means about incidents, modifications, inquiries, or similar related to the contracted or consulted reservations, services, or activities. This is based on Article 6.1, sections a) and f), of the LQPD.
- Register of traveler entries in hospitality establishments: The legal basis for the processing of your personal data is the legal obligation established regarding the collection, management, and transmission to the competent security bodies required by the Regulation of the Register of Tourist Accommodation Occupancy (ROAT). This is based on Article 6.1, section c), of the LQPD. Refusal to provide the personal data requested thus prevents staying at the establishment.
- Inquiries: The legal basis for the processing of your personal data is the ability to respond to queries freely raised by interested parties. This processing is based on Article 6.1, sections a) and b), of the LQPD.
- Access to the “My Reservation” private area: In case the interested party has registered as a user to be able to access, consult, modify, or cancel the status of “My Reservation” from the website, the legal basis for the processing of your data is the existing contractual or pre-contractual relationship between the parties and allowing access to information on the website regarding the reservation status, as well as to modify the data or cancel it, in case you have registered as a user, as well as your acceptance and free and express consent to process the data. This processing is lawful based on Article 6.1, sections a) and b), of the LQPD. Refusal to provide the requested personal data thus prevents access to this information from the website.
- Advertising of products, offers, discounts, activities, and own services: The legal basis for sending advertising about products, offers, discounts, activities, and services is the free and express consent of the interested party by marking the corresponding checkbox to subscribe to the newsletter or in the legitimate interest of the data controller to offer products or services similar to those already contracted. This processing of personal data is based on Article 6.1, sections a) and f), of the LQPD. We inform you that you have the right to withdraw your consent for this processing at any time, without affecting the legality of the processing based on the consent given before its withdrawal. If you wish to withdraw your consent, please see the Exercise of rights of data subjects section.
- Completion of unfinished reservations: The authorization to process the data in this case is the acceptance and express consent of the interested party for this processing so that the company can contact them in case there may have been a technical incident at the time of making the reservation or contracting. This processing of personal data is based on Article 6.1, section a), of the LQPD. Refusal to provide the requested personal data for the reservation thus prevents the realization and conclusion of the requested contract or reservation.
- Communicate changes in the privacy policy: The authorization to process personal data in this case is based on the convenience of informing interested parties of any changes that may occur in the company’s privacy policy, as well as on its acceptance and free consent for this processing, as established in Article 6.1, sections a) and b), of the LQPD.
- Contests or raffles: The authorization to process personal data in the event of your participation and publication of results is based on consent, as provided in Article 6.1, section a), of the LQPD.
- Keeping you informed by electronic means, mobile devices, or any other analog means about incidents, modifications, inquiries, or similar related to the reservations, activities, contracted services, or inquiries made, based on Article 6.1.f) of the LQPD.
- Statistics: The free acceptance and consent of the interested party for this processing, based on Article 6.1, section a), of the LQPD, is the authorization to process data to carry out market research and statistics on our products and services, without making any decisions based on automated processes with legal effects for the interested party. We inform you that you have the right to withdraw your consent for this processing at any time, without affecting the legality of the processing based on the consent given before its withdrawal. If you wish to withdraw your consent, please see the Rights of data subjects section.
4. DATA RETENTION
The personal data provided is retained by CEDASA for as long as there is a contractual or commercial relationship and until you withdraw your consent, exercise your rights to deletion, opposition, and limitation of the processing of personal data, or, in our case, for the maximum legal period allowed by data protection legislation, including the limitation periods of legal actions for the attention of possible liability arising from the contractual relationship.
In this latter case, CEDASA must keep the data duly blocked, without using it, as long as they may be necessary for the exercise or defense of claims, or may entail any type of judicial, legal, or contractual liability from their processing that must be met and for which their recovery is necessary.
5. MINORS
CEDASA’s website is not intended for minors. In any case, we do not collect any personal data from individuals under the age of sixteen without the consent of their legal representative. The data collected from individuals under the age of sixteen is obtained at the time of registering in our hotels, by legal obligation, and only the data necessary for this obligation.
6. DATA COMMUNICATION TO THIRD PARTIES
CEDASA, in general, does not disclose your personal data to third parties. However, they may be transferred to companies that are part of CEDASA when providing their services and when necessary to fulfill the obligations arising from the contract or compliance with legal obligations, including communications to authorities that request it, such as law enforcement agencies.
Service providers contracted by CEDASA acting on its behalf as data processors may also access this data.
7. EXERCISE OF DATA SUBJECTS’ RIGHTS
Data subjects have the following rights:
- Right of access: You can request information about the personal data we process.
- Right of rectification: You can modify your personal data when they are inaccurate or incomplete.
- Right of deletion or limitation: You can request the limitation or deletion of personal data.
- Right to object: Where applicable, you can request that your personal data not be processed considering your particular situation.
- Right to data portability: Where applicable, you may request the portability of the data you have provided to us.
- Right not to be subject to automated decisions without human intervention.
If you have given your consent, you have the right to withdraw it at any time, without affecting the legality of the processing based on the consent given before the withdrawal.
You can exercise your rights in writing by sending a message to the email address lqpd@cisagroup.com or by post to the address ctra. de Comallemple, AD400 Arinsal. The user must specify which right they want to exercise and provide a copy of their identification data (for example, ID/passport). If we need additional data to verify your identity, we will let you know.
You also have the right to file a complaint with the Andorran Data Protection Agency (www.apda.ad) if you believe that we have not processed your personal data in accordance with the regulations.
8. DATA ACCURACY
You declare that all data provided is legal, adequate, relevant, accurate, and, if necessary, up-to-date. The provision of data that does not meet the aforementioned requirements releases CEDASA from liability.
9. SECURITY MEASURES
CEDASA has taken the necessary measures to maintain the required level of security, according to the nature of the personal data processed and the circumstances of the processing, in order to prevent, to the extent possible and always according to the state of the art, its alteration, loss, unauthorized access, or processing.
Likewise, CEDASA guarantees that it has implemented mechanisms to:
- Ensure the permanent confidentiality, integrity, and resilience of the processing systems and services.
- Restore the availability and access to personal data quickly in the event of a physical or technical incident.
- Regularly verify, assess, and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
- Pseudonymize and encrypt personal data, where appropriate.
10. INTERNATIONAL TRANSFERS
CEDASA does not make international transfers of data to provide its services. However, if a data processor acting on our behalf processes personal data in a third country, CEDASA will transfer the data based on an adequacy decision or, failing that, will assess whether the third country guarantees an adequate level of data protection and will apply all measures and controls within its reach to protect your personal data, including the signature of standard contractual clauses approved by the European Commission, the adoption of binding corporate rules, and the request for approved and recognized certifications or codes of conduct.
11. COOKIES
Access to our website may involve the use of cookies. Cookies are small amounts of information stored on the browser used by each user so that the server remembers certain information that can be used later. This information allows you to identify yourself as specific users and store your personal preferences, as well as technical information, for example, visits or specific pages you visit.
Users who do not wish to receive cookies or want to be informed before they are stored on the computer can configure their browser for this purpose.
For more information, please visit our cookie policy.
12. SOCIAL NETWORKS
As users, you are informed that CEDASA has created profiles on the social networks Facebook and Instagram for the purpose of informing about its products, services, and activities.
User data is usually processed by social networks for research purposes. To protect your privacy, when integrating the connection buttons of the specified social networks on our website, no cookies are installed when our web pages are loaded on your device.
Each social network has its privacy policy on how it processes personal data when the user accesses its website. Therefore, when the user accesses or views our profile on Facebook and Instagram, the social network requests express consent to accept cookies, so it is recommended that the user carefully read the data protection information provided by the social network provider.
13. CUSTOMER CONSENT
As a user and client, you declare that you have read and expressly accepted this privacy policy when registering with CEDASA, granting unequivocal and express consent to CEDASA to process the data in accordance with the purposes and services reflected here.
14. CONFIDENTIALITY AND PROFESSIONAL SECRECY
The data collected in all private communications between CEDASA and clients are treated with absolute confidentiality, so we commit to the obligation of professional secrecy regarding personal data, to the duty of storing and adopting all necessary measures to prevent their alteration, loss
