This Privacy Policy provides information about the processing of personal data carried out through the website of MONASTERIO DEL SANTÍSIMO CRISTO DE LA VICTORIA, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation) and applicable Spanish data protection legislation.

1. Data Controller

Data Controller: MONASTERIO DEL SANTÍSIMO CRISTO DE LA VICTORIA
Address: Calle Liberato Alonso, 17, 10530 Serradilla, Cáceres, Spain
Tax Identification Number (CIF): [PENDING CONFIRMATION]
Email: Hospederiasantisimocristo@gmail.com
Telephone: +34 633 484 531

2. What Data We Process

We may process the following categories of data, depending on the forms, channels and services available on the website:

• identification and contact details, such as first name, surname, telephone number and email address;
• information contained in messages or enquiries submitted by the user;
• technical browsing data, IP address, online identifiers, logs and data derived from the use of cookies or similar technologies;
• any other information that the user voluntarily provides through the available forms or channels.

The user guarantees that the information provided is truthful, accurate and up to date, and undertakes to communicate any changes to such information.

3. Purposes of Processing and Legal Basis

a) Handling enquiries and requests submitted through forms or email

We process personal data in order to manage and respond to enquiries, requests, information requests or communications submitted by the user.

Legal basis: the consent of the data subject when submitting an enquiry and, where applicable, the implementation of pre-contractual measures at the request of the data subject.

b) Technical management, security and operation of the website

We process certain technical data to ensure website security, prevent misuse, detect incidents and ensure the proper functioning of our systems.

Legal basis: legitimate interest in ensuring the security and continuity of the website.

c) Compliance with legal obligations

We may process and retain certain data when necessary to comply with legal obligations, respond to requests from competent authorities, or establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and, where applicable, legitimate interest in legal defence.

d) Sending informational communications or newsletters

Legal basis: the consent of the data subject or, where applicable, legitimate interest within the limits permitted by law.

e) Management of registration, admission, enrolment, donations or other online procedures

Legal basis: performance of the relationship requested by the data subject, implementation of pre-contractual measures, consent and/or compliance with legal obligations, as applicable.

4. Mandatory Data

Fields marked as mandatory in the forms are necessary to properly process the user’s request. If this information is not provided, it may not be possible to process the enquiry or provide the requested service.

5. Data Recipients

As a general rule, personal data will not be disclosed to third parties, except where required by law or where necessary for the provision of services related to the website, such as technology providers, web hosting, maintenance, email, security or support providers, who will act as data processors in accordance with the instructions of the Data Controller.

6. International Data Transfers

As a general rule, no international transfers of personal data are foreseen.

However, if technology providers located outside the European Economic Area are used, or if access from third countries is involved, such transfers will be carried out with the appropriate safeguards required by applicable legislation.

7. Data Retention Period

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and, subsequently, for the legally required periods in order to address any potential liabilities.

In particular:

• Enquiry or contact form data: for as long as necessary to respond to the request and, thereafter, for the period necessary to manage any potential liabilities;
• Technical and security data: for the periods necessary for technical control, security and traceability purposes;
• Data processed due to legal obligations: for the period required by applicable legislation;
• Data processed on the basis of consent: until the data subject withdraws their consent, without affecting the lawfulness of processing carried out prior to withdrawal.

8. Rights of Data Subjects

The data subject may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw consent at any time where processing is based on consent.

To exercise these rights, a request may be sent to:

MONASTERIO DEL SANTÍSIMO CRISTO DE LA VICTORIA
Calle Liberato Alonso, 17, 10530 Serradilla, Cáceres, Spain
Tax Identification Number (CIF): [PENDING CONFIRMATION]
Email: Hospederiasantisimocristo@gmail.com

The request must sufficiently identify the applicant and specify the right they wish to exercise.

Furthermore, if the data subject considers that the processing of their personal data does not comply with applicable legislation, they may lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Minors

Minors should not provide personal data through the website without the authorisation of their parents, guardians or legal representatives where such authorisation is required.

10. Automated Decision-Making and Profiling

As a general rule, no automated decisions are made, nor are profiles created that produce legal effects concerning the user or similarly significantly affect them.

11. Security

Reasonable technical and organisational measures have been implemented to protect personal data against loss, destruction, unauthorised access, alteration or improper disclosure, taking into account the state of the art, the nature of the data and the risks associated with the processing.

12. Changes to the Privacy Policy

This Privacy Policy may be updated whenever necessary in order to adapt it to regulatory, technical or functional changes to the website. The version published at any given time shall be the applicable version.