Privacy Policy

PRIVACY POLICY

1. USER INFORMATION

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you about the processing of your personal data.

2. DATA CONTROLLERS

Name	SLR Bahia Hotels, S.L.	SLR Turismo España, S.L.
Tax ID (NIF)	B76229897	B76229814
Address	C/ Artistas Canarios, 8 - Urb. Costa Calma, Pájara - 35627 Las Palmas	C/ Artistas Canarios, 8 - Urb. Costa Calma, Pájara - 35627 Las Palmas
Telephone	928 546 050	928 546 050
Email	lopd@r2hotels.com	lopd@r2hotels.com
Web	[https://www.r2hotels.com/](https://www.r2hotels.com/)	[https://www.r2hotels.com/](https://www.r2hotels.com/)

3. DATA PROTECTION OFFICER (DPO)

The companies have appointed as Data Protection Officer:

Grupo Ático34, S.L.

You may contact the DPO regarding any matter related to the processing of your personal data and the exercise of your rights via email at: lopd@r2hotels.com

4. PURPOSES OF PROCESSING, LEGAL BASIS, AND CONSERVATION PERIODS

4.1. Reservation management and provision of hotel services

Purpose: To process and manage reservations made through the website, as well as the provision of the contracted hotel services.
Legal basis: Execution of a contract (Art. 6.1.b GDPR).
Conservation: During the contractual relationship and subsequently for up to 5 years in accordance with commercial and tax obligations.

4.2. Online payments

Purpose: To securely process payments made through the online reservation platform. Payment data is managed through secure payment gateways with PCI-DSS certification. Under no circumstances do we store full credit card details.

Legal basis: Execution of the contract (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR).
Conservation: 5 years from the transaction in accordance with tax and fraud prevention regulations.

4.3. Club R2 – Loyalty Program

Purpose: To manage your registration and participation in Club R2, our loyalty program for customers, which includes:

Creation and management of your member account in the Customer Area.
Accumulation, consultation, and redemption of points obtained for stays and contracted services.
Access to exclusive advantages, discounts, and promotions for members.
Sending personalized communications regarding the status of your points, benefits, and special Club offers.
Booking history and preference management from the Customer Area.

Legal basis: Consent of the data subject (Art. 6.1.a GDPR) formalized at the time of registration to the Club.
Conservation: While you maintain your status as an active member. In the event of requesting cancellation, the data will be blocked and kept for the legally required period to handle potential claims, after which they will be permanently deleted.
Note: Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

4.4. Customer Area

Purpose: To allow personalized access to the user's private space on the website, where they can manage their reservations, check their Club R2 points balance, update personal data and preferences, download documentation, and access their stay history.
Legal basis: Execution of the contract for the provision of the private area service (Art. 6.1.b GDPR).
Conservation: For as long as you keep your account active. After 2 years without activity, we may notify you to confirm your wish to keep the account active.

4.5. Sending commercial communications

Purpose: To send you information about our services, promotions, special offers, and news, including those specific to Club R2.
Legal basis: Consent (Art. 6.1.a GDPR) or legitimate interest in the case of existing customers (Art. 6.1.f GDPR), in accordance with Art. 21.2 LSSI.
Conservation: Until withdrawal of consent or request to unsubscribe from communications.

4.6. Whistleblowing Channel

Purpose: To receive, manage, and investigate communications related to potential legal, ethical, or regulatory compliance breaches, within the framework of Law 2/2023, of February 20.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
Conservation: Data will be kept only for the time necessary to decide whether to initiate an investigation and, in any case, will be deleted within 3 months of receipt. If a procedure is initiated, they will be kept for the duration of its processing.
Confidentiality: The confidentiality of the informant's identity is guaranteed.
Prohibition of retaliation: Any retaliation against persons who make communications in good faith is expressly prohibited.

4.7. Traveler Registry

Purpose: To comply with the legal obligation of registration and communication of traveler data in accordance with Royal Decree 933/2021.
Data collected: Name, surname, identity document, date of birth, nationality, sex, check-in/check-out dates, and room number.
Recipients: Ministry of the Interior and State Security Forces and Corps.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
Conservation: 3 years from the date of accommodation.

4.8. Equality Plan

Purpose: To comply with the obligations derived from the company's Equality Plan.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
Conservation: In accordance with applicable labor regulations.

4.9. Customer service and inquiry management

Purpose: To respond to inquiries, requests, complaints, and claims raised by users.
Legal basis: Legitimate interest (Art. 6.1.f GDPR) and execution of the contract (Art. 6.1.b GDPR).
Conservation: For the time necessary for the inquiry and up to 3 years thereafter.

5. DATA RECIPIENTS

Your personal data will not be transferred to third parties except under legal obligation, to data processors (technology providers, DPO), or through international transfers with adequate guarantees.

6. RIGHTS OF THE DATA SUBJECTS

You may exercise your rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to automated decisions.

How to exercise your rights: By writing, including a copy of your ID/NIE, to lopd@r2hotels.com. You have the right to lodge a complaint with the AEPD (Spanish Data Protection Agency).

7. SECURITY MEASURES

We have adopted the necessary technical and organizational measures to guarantee the security of your data.

8. MINORS

Our services are not directed to minors under 14 years of age.

9. MODIFICATIONS TO THE PRIVACY POLICY

We reserve the right to modify this policy, notifying changes in advance.

Last update: March 2026