In accordance with the General Data Protection Regulation (GDPR) EU 679/2016 and Organic Law 3/2018 of December 5, on Personal Data Protection and Guarantee of Digital Rights, the following information regarding the processing of your personal data is provided:

Who is responsible for processing your personal data? Data Controller: BODEGAS BORDOY S.L.U., Tax ID (NIF/CIF): B57135907, Address: C/ INDUSTRIA Nº10, CP: 07013, PALMA, Phone: 971255296, Email: privacy@bordoyhotels.com.

What data do we process? At BODEGAS BORDOY S.L.U. we process the personal data provided by you through the completion of the forms enabled for this purpose on this website, the personal data derived from the provision or contracting of our services or products, and/or the personal data derived from the commercial relationship you maintain with us. In addition, we process personal data generated in the context of your activity on our website, within which category your Browse data obtained through the website are included. It is important for us to keep your personal data record updated. You have the obligation to keep us informed of any change or error in your personal data as soon as possible by contacting us at the email: privacy@bordoyhotels.com.

For what purpose do we process your personal data? Purpose: BODEGAS BORDOY S.L.U. may process your personal data for the following purposes: Management and maintenance of the services provided through the website. Management and attention to inquiries and information requests made by users through the contact form. The email address and personal data you provide us through the contact form on the website will be used exclusively to answer the queries you raise through this means. Compliance with applicable legal obligations. Sending commercial communications and newsletters, as well as advertising for our services and products. Management of information requests or requests for quotes for our services or products. If you have consented, and in order to offer you services tailored to your interests, your personal data may be used to create a commercial profile. No automated decisions will be made based on this profile.We retain your personal data in our systems and files for the time necessary to carry out the purposes of processing and to comply with applicable legislation. Your personal data will be kept as long as there is a contractual and/or commercial relationship with you, or as long as you do not exercise your right of erasure and/or limitation of the processing of your data. The retention period of personal data will vary depending on the purposes of processing and, in general:

Your personal data will be kept as long as they are useful for the indicated purposes, and, in any case, for the legally established periods and the time necessary to address possible liabilities arising from the processing.

Data Security We have appropriate technical and organizational security measures to protect your personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, ensuring their integrity and confidentiality. The implemented technical and organizational security measures allow for: ensuring the permanent confidentiality, integrity, availability, and resilience of processing systems and services; restoring the availability and access to personal data quickly in the event of a physical or technical incident; and regularly verifying, evaluating, and assessing the effectiveness of the technical and organizational measures implemented to ensure processing security. These technical and organizational security measures have been designed taking into account our IT infrastructure, the state of the art in accordance with current standards and practices, the cost of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks of varying probability and severity that the processing entails for your personal data.

What is the legal basis for processing your data? Legal Basis: The legal basis for processing your personal data is based on

The execution and maintenance of a contractual and commercial relationship with you, such as contracting the entity’s products and services, managing and requesting quotes for the entity’s products and/or services, all in accordance with the provisions of Article 6.1.B of the GDPR (EU) 679/2016 and Organic Law 3/2018, of December 5 (LOPDPGDD). Your express consent for one or more purposes, such as sending advertising communications or newsletters from us or third parties, managing curriculum vitae submissions, participating in activities or contests, all in accordance with the provisions of Article 6.1.A of the GDPR (EU) 679/2016 and Organic Law 3/2018, of December 5 (LOPDPGDD). Compliance with various legal obligations, all in accordance with the provisions of Article 6.1.C of the GDPR (EU) 679/2016 and Organic Law 3/2018, of December 5 (LOPDPGDD). The satisfaction of legitimate interests pursued by the data controller or a third party, for example, for security reasons, to improve our services, and/or to manage your requests or inquiries.

During the data collection process, and at each point on the website where personal data is requested, the user will be informed, either through a hyperlink or by including the appropriate mentions in the form itself, of whether the collection of their personal data is mandatory or not.The personal data requested in the forms on the website are, in general, mandatory (unless otherwise specified in the required field) to fulfill the established purposes. Therefore, if the requested personal data is not provided, or is not provided correctly, the purposes cannot be met. There is an obligation to provide your personal data in cases of contracting a service or product, and/or in cases of requesting quotes or offers. The sending of advertising communications, newsletters, or informational bulletins about our products and services is based on the consent requested from you, without the withdrawal of this consent in any case conditioning the contractual or commercial relationship you maintain with us.

The personal data requested in the forms on the website are, in general, mandatory (unless otherwise specified in the required field) to fulfill the established purposes. Therefore, if the requested personal data is not provided, or is not provided correctly, the purposes cannot be met. There is an obligation to provide your personal data in cases of contracting a service or product, and/or in cases of requesting quotes or offers. The sending of advertising communications, newsletters, or informational bulletins about our products and services is based on the consent requested from you, without the withdrawal of this consent in any case conditioning the contractual or commercial relationship you maintain with us.

To which recipients will your data be communicated? Recipients: In general, your personal data will not be communicated to any third party outside the entity, unless legally obligated. However, we inform you that third-party providers may have access to your personal data as data processors, within the framework of providing a service for the data controller. We inform you that you can request the complete list of recipients who may receive your personal data as data processors or as third-party recipients by transfer at the email: privacy@bordoyhotels.com. In addition to the above, the entity may make assignments or communications of personal data to meet its obligations to Public Administrations in cases where required, in accordance with current legislation.

International Data Transfers: To carry out the data processing activities detailed above, we may transfer data to countries outside the European Economic Area (EEA), and store such data in physical or digital databases managed by entities acting on our behalf. Database management and data processing are limited to the purposes of processing and are carried out according to current data protection laws and regulations. Should data be sent outside the EEA, the company will use appropriate contractual measures to ensure data protection, which may include, among others, contracts based on the standard data protection clauses adopted by the European Commission applicable to the sending of personal data outside the EEA.

What rights do you have regarding the processing of your personal data?6 Rights: You have the right to obtain access to your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request their erasure when, amo7ng other reasons, the data are no longer necessary for the purposes for which they were collected. In certain circumstances, you can request the limitation of the processing of your data, in which case we will only retain them for the exercise or defense of claims. Likewise, and for reasons related to your particular situation, you can object to the processing of your data, in which case your personal information will stop being processed for those purposes for which you have expressed your opposition. Where technically possible, you can request the portability of your data to another data controller. To exercise these rights, in accordance with current legislation, you can write by postal mail, attaching a copy of an identity document (DNI), to BODEGAS BORDOY S.L.U. at C/ INDUSTRIA Nº10, CP: 07013, PALMA, or to the email privacy@bordoyhotels.com. You have the right to file a complaint with the Supervisory Authority: Spanish Data Protection Agency (www.agpd.es). Origin of Personal Data: the interested party themselves. You expressly accept the inclusion of the personal data collected during Browse on the website and/or provided by completing any form, as well as those derived from a possible commercial relationship, in the automated personal data files of the entity.8 The entity guarantees the confidentiality of users’ per9sonal data. However, the entity will disclose to the competent public authorities personal data and any other information in its possession or accessible through its systems when required, in accordance with the legal and regulatory provisions applicable to the case. Personal data may be retained in the files owned by BODEGAS BORDOY S.L.U. even after the commercial relationships formalized through the entity’s website have ended, exclusively for the purposes indicated above and, in any case, for the legally established periods, at the disposal of administrative or judicial authorities.

Use of Social Networks When you interact with our website through various social networks, such as connecting or following us or sharing our content on social networks (Facebook, Twitter, LinkedIn, Instagram, or others), we may receive information from those social networks, including information about your profile, user ID associated with your social media account, and any other public information you allow to be shared with third parties on the social network. The entity uses social networks for the purpose of informing about the services it offers, as well as any other activity or event that takes place and wishes to publicize, but at no time will it obtain personal data from users who interact on them, unless there is express authorization. This data is only used within the social network itself and is not incorporated into any processing system. Social networks have their own terms of use and privacy policies that you are obliged to consider and observe their compliance if you use them.