Privacy policy

INFINITUM RESORT, S.A.U. is particularly committed to protecting the data of users who access the website infinitumliving.com (hereinafter, the “Website”). This Privacy Policy informs users of the processing and uses to which the personal data collected on the Website are subject, so that they may decide, freely and voluntarily, whether they wish to provide the requested information.

CONTROLLER

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”) and Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (hereinafter, the “LOPDGDD”), we inform you that the personal data provided through the forms, as well as your email address, will be processed under the responsibility of INFINITUM RESORT, S.A.U. (hereinafter, “INFINITUM”) as data controller and as the entity responsible for the operation, management and functioning of the Website, with registered office at C/ Camí del Racó, s/n, 43481 Vila-Seca (Tarragona), tax identification number A58612904, and registered with the Commercial Registry of Tarragona, volume 2030, folio 106, sheet T-13239, entry 1.

PERSONAL DATA WE PROCESS

Personal data you provide to us: generally, the personal information you provide to us (through Website forms or when contacting our customer service department) consists of your name and surname, email address and telephone number.
The personal data indicated above are mandatory in order to manage your requests, meaning that refusal to provide it will make it impossible for us to address them and, where applicable, to provide the requested services.

If you provide us with data relating to third parties, you declare that you have a valid lawful basis for communicating such data and undertake to inform them in advance of the content of this Privacy Policy, in particular regarding the identification of the controller, the purposes of processing and the possibility of exercising their rights, and you shall be liable to INFINITUM for any loss or damage that may arise from failure to comply with this obligation. In any event, INFINITUM may carry out reasonable checks and adopt the appropriate due diligence measures to verify this.
Personal data we collect: the Website uses cookies or similar technologies which, depending on their configuration, may allow INFINITUM to collect and process personal data.
Generally, we collect and store limited personal information and anonymous aggregate statistics from all users who visit the Website, whether because they actively provide that information to us or because they are simply browsing it. The information we collect includes the Internet Protocol (IP) address of the device used, the browser software, its operating system, the date and time of access, the Internet address from which they access the Website and information about how they use it.

For further information on the use and configuration of cookies, please see our Cookie Policy.

PURPOSES AND LAWFUL BASIS OF PROCESSING

INFINITUM will process your personal data for the following purposes, relying on the corresponding lawful bases:

(i) Sending commercial communications about our products or services by electronic means, provided that prior consent has been given.
(ii) Sending satisfaction surveys in order to: i) improve customer service procedures and update the catalogue of products and services; ii) understand how you interact with INFINITUM; and iii) determine your level of satisfaction, on the basis of our legitimate interests in assessing and improving our products and services, unless prior consent is required due to the channel used, the content of the communication or the profile of the data subject.
(iii) Managing requests submitted through the channels enabled on the Website, for the purposes notified at the time the data is collected, on the basis of the performance of a contract or the taking of steps prior to entering into a contract, as applicable.
(iv) Statistical analysis and profiling based on your browsing habits, according to the consent you have given in the cookie use settings.
(v) Attribution of marketing campaigns by tracking the origin, channel and performance of user interactions (UTMs), on the basis of INFINITUM’s legitimate interests in optimising commercial actions and improving the content and services offered.
(vi) Statistical analysis and customer segmentation based on nationality, on the basis of INFINITUM’s legitimate interests in identifying consumption trends by geographical origin and facilitating strategic planning, the definition of marketing campaigns and the improvement of the customer experience.
(vii) Disclosure of your data to competent authorities and bodies (courts, tribunals or any other analogous third parties), on the basis of compliance with a legal obligation applicable to INFINITUM.
(viii) If you provide information through the Grupo Criteria Ethics Channel, INFINITUM may, on an ad hoc basis, disclose personal data to CRITERIA CAIXA, S.A.U., on the basis of compliance with the various legal obligations applicable under Law 2/2023 of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption.

DISCLOSURE OF PERSONAL DATA

As indicated in the preceding section, on the basis of compliance with a legal obligation, your personal data may be disclosed to:

Competent authorities and bodies (courts, tribunals or any other analogous third parties);
CRITERIA CAIXA, S.A.U., where it requests specific information within the Grupo Criteria Ethics Channel, pursuant to Law 2/2023.

Regardless of this, INFINITUM has contracted various services (for example, virtual infrastructure services, cloud computing services, commercial intermediaries, processing agencies, security, etc.) from certain suppliers which, as data processors, may access your personal data where necessary for the provision of those services. In accordance with Article 28 of the GDPR, these suppliers will process the data on behalf of INFINITUM, subject to a duty of confidentiality and always following its instructions; under no circumstances may they use such data for their own purposes or for any unauthorised purposes.

In this context, data may be transferred to third countries outside the European Economic Area (hereinafter, “EEA”). In such cases, users’ personal data will be transferred on the basis of an adequacy decision or, in the absence of such a decision, on the basis of appropriate safeguards.

By means of an adequacy decision, the European Commission declares that a third country or international organisation ensures a level of protection of personal data equivalent to that of the EEA, allowing international transfers of data to that territory without the need for additional authorisations.

For their part, appropriate safeguards include, among others:

Binding Corporate Rules: these apply to groups of undertakings or groups of enterprises engaged in a joint economic activity, enabling the flow of personal data on the basis of self-regulation accepted and assumed by each of the signatory entities;
Standard Contractual Clauses: these are a standardised contracts, aligned with the provisions of the GDPR and approved by the European Commission, signed between a data exporter located in the EEA and a data importer located in a third country;
Code of conduct or certification mechanism: together with binding and enforceable commitments assumed by the recipient, these constitute a framework that ensures the application of appropriate safeguards for the protection of the personal data transferred.

In the absence of the safeguards referred to above, your personal data may be transferred to a third country or international organisation, on an exceptional basis, where permitted by the mechanisms provided for in data protection legislation. You may obtain further information in this regard by sending a request to protecciondatos@infinitumliving.com.

SECURITY MEASURES

INFINITUM has adopted appropriate technical and organisational measures to ensure the security and confidentiality of personal data stored in its information system, thereby preventing its alteration, loss, unauthorised processing or access. These measures have been implemented taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of Website users.

The measures include, among others, access controls, enhanced authentication, encryption, device and media management, monitoring, incident management, backups and contractual requirements for external suppliers to apply equivalent measures.

DATA STORAGE

Your personal data will be stored only for as long as necessary to fulfil the purposes for which it was collected, or while you do not object to the processing based on legitimate interests or do not withdraw your consent, where this is the lawful basis for processing.

Once those purposes have been fulfilled, INFINITUM may retain the data for the periods necessary to address potential legal liabilities, including the establishment, exercise or defence of legal claims, during the corresponding limitation periods.

During these additional periods, the data will remain duly blocked and will not be used, except for being made available to competent authorities. Once the applicable statutory periods have expired, the data will be securely destroyed.

In any event, INFINITUM will process personal data lawfully, fairly and transparently, limiting it to what is strictly necessary and ensuring its confidentiality and security at all times, and adopting the reasonable measures necessary to rectify or erase it without delay where it is inaccurate or not up to date.

USERS’ RIGHTS

Users of this Website, in their capacity as data subjects, may exercise the rights afforded to them under the GDPR and the LOPDGDD, namely:

Right of access: in accordance with Article 15 GDPR.
Right to rectification: in accordance with Article 16 GDPR.
Right to erasure: in accordance with Article 17 GDPR. Please note that, while the commercial or contractual relationship we maintain remains in force, it will be essential to process certain personal data in order to comply with the obligations arising from the contract.
Right to restriction of processing: in accordance with Article 18 GDPR.
Right to data portability: in accordance with Article 20 GDPR.
Right to object: in accordance with Article 21 GDPR. Where the purpose of processing is to send own or third-party commercial information, you may opt, free of charge and voluntarily, into an advertising opt-out mechanism (further information is available at the following link: https://www.aepd.es/areas-de-actuacion/publicidad-no-deseada).
Right to withdraw consent: in accordance with Article 7.3 GDPR.
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Notwithstanding that INFINITUM makes decisions based on automated systems, such decisions (i) either do not produce legal or significant effects on the data subject; or (ii) are not taken solely by automated means.

You may exercise the aforementioned rights by sending an email to protecciondatos@infinitumliving.com or by post to C/ Camí del Racó, s/n, 43481 Vila-Seca (Tarragona), indicating an address for notification purposes and providing, in the case of representation, documentary evidence thereof.

In addition, you may contact the Data Protection Officer at the following email address: dpo@criteria.com.

Finally, we remind you that you also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

LINKS

This Website may include, display or provide links to other websites for your convenience and information. Those websites may operate independently of us and may therefore have their own privacy policies.

To the extent that any linked website you visit is not owned or controlled by us, we are not responsible for the content of those websites, their use or their privacy practices.

We therefore recommend that you review the privacy policy of any third-party website you access from our Website, as we are not responsible for their content or their practices in this regard.

UPDATES

INFINITUM reserves the right to amend this Policy in order to adapt it to legislative or case-law developments or to reflect changes in its personal data processing activities.

We will publish a prominent notice on the Website to notify any significant change to our Policy and will indicate at the bottom of it when it was last updated.

You may send any questions, queries or comments regarding this Policy to the following email address: protecciondatos@infinitumliving.com.