Who are we? We are HOTEL PRINCESA YAIZA, S.A., and we process your data as the data controller. This means that we are responsible for how your personal data is used and protected.

What do we use your data for? We use the data you have provided to us online or through any other means for the following purposes.

Why do we process your data? We are authorised to process your data on various legal grounds. When you complete a form or send us an email with an enquiry or suggestion, we have a legitimate interest in responding to it.

Who do we share your data with? We will only share your data with partner companies where necessary to respond to requests received, provide our services or supply our products, as well as with banking institutions and public authorities where required by law. We never sell your data to third parties.

What rights do you have? You have the right to access, rectify or erase your personal data. You also have the right to object to our use of data you have previously authorised us to process, to request data portability and not to be subject to automated individual decision-making.

When processing your personal data, we apply the following principles to ensure the highest level of protection:

• Principle of lawfulness, fairness and transparency: We will always request your consent to process your personal data for one or more specific purposes, which we will inform you about in advance with complete transparency.
• Principle of data minimisation: We will only request personal data that is strictly necessary for the purposes for which it is required, keeping the amount of data collected to a minimum.
• Principle of storage limitation: Your data will not be retained for longer than is necessary for the purposes for which it is processed. Depending on the purpose, we will inform you of the corresponding retention period. In the case of subscriptions, we will periodically review our lists and delete records that have remained inactive for a considerable period.
• Principle of integrity and confidentiality: Your data will be processed in a manner that ensures appropriate security and confidentiality. We take all necessary precautions to prevent unauthorised access to or misuse of our users’ personal data by third parties.

This Privacy Policy provides detailed information about how we use the personal data of our customers, suppliers and users, as well as anyone who contacts us, regardless of the means of communication used (online forms, telephone, email or in person).

We believe in being transparent about how we process your personal data, ensuring that you understand the implications of its use and the rights available to you.

For this reason, we keep our Privacy Policy, Legal Notice and Cookie Policy up to date. You can consult this information on this website.

If you have any questions or would like further information about our Privacy Policy, please continue reading this document.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

The controller responsible for processing your personal data is HOTEL PRINCESA YAIZA, S.A.:

HOTEL PRINCESA YAIZA, S.A. informs users that the data they provide while browsing our website, completing the various data collection forms or sending emails will be processed by HOTEL PRINCESA YAIZA, S.A.

Such processing is recorded in the Record of Processing Activities maintained by HOTEL PRINCESA YAIZA, S.A. in accordance with the provisions of the General Data Protection Regulation (GDPR).

2. WHAT DO WE USE YOUR PERSONAL DATA FOR?

At www.princesayaiza.com, we process data relating both to users of our website and to third parties who maintain a relationship with us.

To help you understand how we process your data, we have distinguished between the purposes of processing, the types of data collected and the legal basis for processing according to the category of individuals whose data we process.

Below, we classify these individuals according to the nature of their relationship with HOTEL PRINCESA YAIZA, S.A.

WEBSITE USERS

What data do we collect from our website users?

a) Data relating to users who complete any of the available forms:

The personal data requested by HOTEL PRINCESA YAIZA, S.A. includes:

• Identification details: First name and surname, telephone number, postal address and email address.
• Data relating to the request.

b) Data relating to users who browse our website: Data provided by cookies and Google Analytics.

For what purposes do we process your personal data?

When users accept our Privacy Policy, they authorise us to process their personal data for the following purposes:

• To provide the information and services requested through the various forms available on our website.

How do we obtain your data?

We obtain your personal data through the following means:

• The form completed by the website user for the purpose specified therein. Completion of the form is subject to acceptance of this Privacy Policy by ticking the corresponding box.

What is the legal basis for processing your data?

The user’s express consent (Article 6(1)(a) of the GDPR), given by completing the relevant forms and ticking the corresponding boxes, constitutes the legal basis for processing by HOTEL PRINCESA YAIZA, S.A.

Users may withdraw their consent at any time. However, withdrawing consent does not affect the lawfulness of any data processing carried out before its withdrawal.

Legitimate interest in creating browsing profiles and identifying user preferences through the installation of cookies.

The performance of a contract or the implementation of pre-contractual measures when a customer submits a request through the various forms available on our website or requests information about the services provided by HOTEL PRINCESA YAIZA, S.A.

CUSTOMERS

What data do we collect from our customers?

a) Data relating to customers who complete any of the forms available at www.princesayaiza.com or at the physical premises of HOTEL PRINCESA YAIZA, S.A.

• Identification details: First name and surname, telephone number, postal address and email address.
• Data relating to the request.

How do we obtain your data?

If you are an online customer, we obtain your data through the following means:

The information request form completed by the user. Completion of the form is subject to acceptance of this Privacy Policy by ticking the corresponding box.

• Browsing data collected through the various cookies that customers accept when first accessing www.princesayaiza.com.

If you are a customer who purchases our services in person, we obtain your data through the following means:

• The customer registration form.
• Acceptance of the quotation provided.
• The signed contract.

For what purposes do we process your personal data?

• To generate and manage documentation associated with your requests and purchases.
• To provide information about offers, products and services related to your purchase.
• To process your online booking or purchase through our platform.

What is the legal basis for processing your data?

The performance of a pre-contract or contract to provide the necessary information and manage the service delivered or product supplied. Without this processing, it would not be possible to provide the corresponding service or product.

Users may withdraw their consent at any time.

3. HOW LONG DO WE RETAIN YOUR DATA?

WEBSITE USERS

Data processed on the basis of a website user’s consent will be retained for as long as it remains relevant to the purpose for which it was collected and the consent has not been withdrawn.

Data processed on the basis of legitimate interest will be retained for the period necessary to fulfil the purpose that justified its collection, always ensuring appropriate safeguards and respecting the rights and freedoms of the individuals concerned.

Data processed on the basis of the performance of a contract or the implementation of pre-contractual measures will be retained for as long as the contractual relationship remains in force, as well as for any additional period required by law.

IP addresses obtained through cookies will be retained for one year for the purpose of demonstrating the user’s consent.

For further information about cookie retention periods, please consult the “Cookie Policy” section of our website.

CUSTOMERS

Data processed on the basis of a customer’s consent will be retained for as long as it remains relevant to the purpose for which it was collected and the consent has not been withdrawn.

Data processed on the basis of legitimate interest will be retained for the period necessary to fulfil the purpose that justified its collection, always ensuring appropriate safeguards and respecting the rights and freedoms of the individuals concerned.

Data processed on the basis of a contract, as well as data whose processing is partly justified by a legal obligation, will be retained for as long as the contractual relationship remains in force.

Once the contractual relationship has ended, where processing is linked to a legal obligation, the data will be retained for the period established by the applicable legislation.

In such cases, the data subject may not withdraw authorisation for the processing of their data, except where legally established provisions concerning the blocking of such data apply.

4. ADDITIONAL INFORMATION ABOUT DATA PROCESSING

Only individuals over the age of 14 may provide data through our website or by email. If you are under this age, you must obtain the consent of your parents or legal guardians.

Users guarantee that all data provided to HOTEL PRINCESA YAIZA, S.A. is authentic and up to date, declare that they are over 14 years of age and accept sole responsibility for any false or inaccurate statements they make.

The personal data processed by HOTEL PRINCESA YAIZA, S.A. may be mandatory or voluntary.

To protect your privacy, we will not request special categories of personal data through our website forms.

If the collection of special categories of personal data is necessary to provide a service, such data will be requested through an alternative channel.

The data requested through our forms is as follows:

Voluntary information is information that users are not required to provide in order to contact us.

Fields marked with an asterisk (*) or the word “required” on our forms must be completed.

Failure to provide this information will make it impossible for us to provide the requested service or respond to your request.

If you provide us with personal data relating to third parties, you declare that you have obtained their consent and undertake to inform them of the information provided in this clause, thereby releasing HOTEL PRINCESA YAIZA, S.A. from any obligation in this regard.

Nevertheless, HOTEL PRINCESA YAIZA, S.A. may carry out checks to verify that the third party has been informed, adopting the due diligence measures established under data protection legislation.

5. TO WHOM MAY YOUR DATA BE DISCLOSED?

Personal data will not be disclosed to third parties unless required by law or where necessary to respond to your request.

Recipients to whom your data may be disclosed include:

• HOTEL LOS FARIONES S.A., HOTEL AGUERE, S.L., HOTEL PRINCESA YAIZA, S.A., GESTION ATLANTICA LANZAROTE S.L., CENTRO DEPORTIVO FARIONES, S.L., FINCA DE UGA, S.L.
• Public administrations and authorities where required by tax, employment, Social Security or any other applicable legislation. Data processors, including fraud detection and prevention providers, technology service providers, customer service providers, advertising and marketing service providers and, in general, third-party suppliers necessary for the provision of the services offered by HOTEL PRINCESA YAIZA, S.A., such as courier and transport service providers, etc.

6. ARE INTERNATIONAL DATA TRANSFERS CARRIED OUT?

www.princesayaiza.com is hosted in Spain, a country located within the European Union and the European Economic Area, which complies with the guidelines established in Articles 46 and 47 of the GDPR. Therefore, the data provided by users through the website will not be subject to international data transfers.

Our website only accesses user data through the following means:

• Through the contact forms made available to users on the website.

International data transfers may also occur as part of the aforementioned disclosures or communications.

In such cases, HOTEL PRINCESA YAIZA, S.A. will use the mechanisms provided for in Articles 46 and 49 of the GDPR as safeguards for transfers to countries that are not covered by an adequacy decision issued by the European Commission.

In all cases, third parties with whom certain personal data is shared must have previously demonstrated that they have adopted appropriate technical and organisational measures to ensure its proper protection.

Transfers to third countries will only take place where there is a legally binding instrument in accordance with Article 46 and the subsequent provisions of the GDPR.

By accepting this Privacy Policy, users acknowledge that international data transfers may take place in accordance with the safeguards described above.

If the requirements established by the GDPR are not met, the data subject may give their consent to the international transfer, or a contract may be performed in the interests of the data subject.

Otherwise, authorisation must be requested from the Supervisory Authority.

HOTEL PRINCESA YAIZA, S.A. does not sell its users’ data to third parties under any circumstances.

7. WHAT RIGHTS DO YOU HAVE AND HOW CAN YOU EXERCISE THEM?

Users may exercise the following rights in relation to HOTEL PRINCESA YAIZA, S.A.:

a) Access their personal data.

b) Rectify their personal data when it is inaccurate or incomplete.

c) Request the erasure or deletion of their personal data when, among other reasons, it is no longer necessary for the purposes for which it was collected.

d) Object to the processing of their personal data.

e) Request the restriction of the processing of their personal data when any of the conditions established by law apply.

f) Request the portability of their personal data in the cases provided for by law.

g) Exercise their right not to be subject to automated decision-making.

h) Withdraw any consent previously given.

To exercise these rights, users must submit a written request specifying the right they wish to exercise, accompanied by a document proving their identity and a postal or email address for notification purposes.

Requests may be submitted by post to:

HOTEL PRINCESA YAIZA, S.A.
PAPAGAYO 22
35580 – PLAYA BLANCA (LANZAROTE)

Alternatively, requests may be sent to the following email address: lopd@rosahotels.com.

HOTEL PRINCESA YAIZA, S.A. must respond to requests concerning the exercise of data protection rights within one month of receiving the request.

This period may be extended by a further two months where necessary, taking into account the complexity and number of requests.

We will inform you of any extension within one month of receiving your request, explaining the reasons for the delay.

Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Spanish Data Protection Agency) if they believe that HOTEL PRINCESA YAIZA, S.A. has infringed their rights under data protection legislation, at www.aepd.es.

8. IS MY DATA SECURE?

HOTEL PRINCESA YAIZA, S.A. has an active contract with the hosting company Dinahosting S.L. for the hosting of its website.

Dinahosting S.L. is a European company that uses the latest security systems and measures.

In all cases, HOTEL PRINCESA YAIZA, S.A. guarantees that appropriate measures have been adopted to ensure the confidential processing of personal data, taking into account its sensitive and confidential nature.

The company undertakes to keep such data confidential and to handle it with the utmost discretion.

It also declares that it has implemented information security policies appropriate to the type of data processed within its information systems, in accordance with the provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

All data provided through our platform is collected using a secure protocol.

Our website has an SSL certificate, which establishes an encrypted connection whenever a user visits our website and exchanges information with us.

9. LINKS TO OTHER WEBSITES

If you choose to leave our website through links to other websites that do not belong to our organisation, HOTEL PRINCESA YAIZA, S.A. will not be responsible for the privacy policies of those websites or for any cookies they may store on your computer.

Date: 14/09/2026

Version: V.1.0