Data Protection Policy for the Internal Information System Invisa Hotels

Data Protection Policy for the Internal Information System

1. Data controller

HOTELES TRINIDAD, S.L. is the Data Controller responsible for processing all personal data provided through the Internal Information System.

Address:  Calle Vicente Cuervo, 9 – 07800 Ibiza. Balearic Islands. Spain.

Email: cdih@invisahoteles.com.

Telephone: +34 971 311 500 / 971 311 050

2. Purpose of data processing

Personal data provided through the Internal Information System will be processed for the following purposes:

• ­                To manage disclosures received through the Internal Information System.
• ­                To assess and investigate the reported facts.
• ­                To take, where applicable, such preventive, corrective, disciplinary, or legal measures as may be deemed appropriate.
• ­                To comply with the obligations set out in Law 2/2023 and other applicable legislation. 

3. Legal basis for processing

The processing of personal data is carried out on the following legal bases:

• ­                Compliance with legal obligations set out in Law 2/2023 and other applicable legislation.
• ­                The public interest in the prevention, detection, and investigation of breaches.
• ­                The legitimate interest of HOTELES TRINIDAD, S.L. in ensuring compliance with applicable internal rules and external legislation. 

4. Data processed

Only personal data necessary for the proper management of the disclosure may be processed. This may include identifying and contact details, professional or employment data, the information and documentation submitted, as well as personal data relating to affected individuals, witnesses, or other third parties connected to the reported facts.

Only data that are adequate, relevant, and limited to what is necessary for receiving, assessing, investigating, and resolving the disclosure shall be processed.

Disclosures may be submitted anonymously. In such cases, the only personal data processed will be those provided voluntarily or those that prove necessary during the management and investigation of the facts.

5. Data recipients

Only individuals authorised to manage and investigate the disclosures shall have access to the data. Where legally required, such data may be disclosed to competent administrative or judicial authorities, the Public Prosecutor’s Office (Ministerio Fiscal), law enforcement agencies, or the Independent Authority for Whistleblower Protection.

No data transfers will be made other than those legally required.

6. Confidentiality

HOTELES TRINIDAD, S.L. guarantees the confidentiality of the identity of the whistleblower, affected individuals, and any third party mentioned in the disclosure, as well as all information processed throughout the procedure, unless mandated to share such information by law or by order of a competent authority.

7. Data retention

Personal data shall be retained solely for the period necessary to manage the disclosure and during the timeframes set out in Law 2/2023 and other applicable legislation. Once these periods have expired, the data will be deleted or blocked in accordance with current legislation.

8. Data subject rights

Data subjects may exercise their rights of access, rectification, erasure, restriction of processing, opposition, and any other rights recognised under data protection legislation by writing to:

HOTELES TRINIDAD, S.L.

Email: cdih@invisahoteles.com.

They may also lodge a complaint with the Spanish Data Protection Agency.

9. Security measures

HOTELES TRINIDAD, S.L. implements the technical and organisational means necessary to guarantee the security, confidentiality, and integrity of the personal data processed, restricting access exclusively to duly authorised personnel.

10. Updates to this policy

This policy may be updated to adapt to legislative or organisational changes. The current version will be available alongside access to the Internal Reporting Channel.