Privacy Policy

Updated: June 23

Basic Information on Data Protection




Provision of online services

Management of web users

Commercial communications related to our services.

Manage data provided by candidates for the personnel selection process.


Express consent, contract execution, and legitimate interest.


No data will be disclosed to third parties, except:

  • To companies specialized in personnel selection and profile analysis for job candidates.
  • To reservation centers
  • By legal obligation


Access, rectify, and delete data and other rights, as specified in the additional information.

Additional information

You can consult the additional and detailed information on Data Protection in the annexed Clauses found at:

BALNEARI PRATS, S.A. (hereinafter BALNEARI PRATS) we work to offer you the best possible experience through our products and services. In some cases, it is necessary to collect information to achieve this. We care about your privacy and we believe that we must be transparent in this regard.

Therefore, and for the purposes of the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and the LAW 34/2002, of July 11, 2002, on Information Society Services and Electronic Commerce (hereinafter, “LSSI”), BALNEARI PRATS informs the user that, as the data controller, it will incorporate the personal data provided by users in an automated file.

Our commitment begins by explaining the following:

  • Your data is collected so that the user experience is improved, attending to your interests and needs.
  • We are transparent about what data we collect about you and why we collect it.
  • Our intention is to provide you with the best possible experience. Therefore, when we use your personal information, we will always do so in a compliant manner, and when necessary, we will ask for your consent.
  • We understand that your data belongs to you. Therefore, if you decide not to authorize us to process them, you can ask us to stop processing them.
  • Our priority is to ensure your security and to process your data in accordance with European regulations. 

For more information about the processing of your data, please see the different sections of the privacy policy below:

Who is responsible for the processing of your personal data?

Company name: BALNEARI PRATS, S.A.

Commercial name: BALNEARI PRATS

Registered office: Plaça Sant Esteve, 7 – 17455 -Caldes de Malavella (Girona)  



BALNEARI PRATS has designated an internal contact person as coordinator of the adaptation within its organization. If you have any queries regarding the processing of your personal data, please contact him at  

What personal data do we collect?

  • Name, address, and date of birth.
  • Telephone number and e-mail address.
  • Location.
  • Payment and return information.
  • IP address, date and time you accessed our services, the internet browser you use, and data about the device’s operating system.
  • Curriculum Vitae (CV) data of job applicants.
  • Any other information or data you choose to share with us.

In some cases, it is mandatory to fill in the registration form to access and enjoy certain services offered on the web; also, not providing the requested personal data or not accepting this data protection policy means the impossibility of subscribing, registering, or participating in any of the promotions in which personal data is requested.

Why and for what purpose do we treat your data?

At BALNEARI PRATS we process the information provided by the interested parties for the following purposes:

  • Manage the contracting of any of our services, either online or in our physical offices.
  • Manage the sending of the information requested.
  • Manage the data provided by candidates for a job through their Curriculum Vitae (CV) for the sole purpose of carrying out the recruitment process.
  • Develop commercial actions and perform the maintenance and management of the relationship with the user, as well as the management of the services offered through the website and information tasks, being able to perform automatic assessments, profiling, and segmentation tasks of customers in order to customize the treatment according to their characteristics and needs and improve the customer’s online experience. Develop and manage contests, sweepstakes, or other promotional activities that may be organized.
  • In some cases it will be necessary to provide information to Authorities or third-party companies for auditing purposes, as well as to handle personal data from invoices, contracts, and documents to respond to claims from customers or Public Administrations.

We inform you that the personal data obtained as a result of your registration as a user will be part of the Register of Activities and Processing Operations (RAT), which will be updated periodically in accordance with the provisions of the RGPD.

What is the legitimacy of the processing of your data?

The processing of your data may be based on the following legal bases:

  • Consent of the interested party for contact forms, requests for information, or registration in newsletters.
  • Execution of a contract for the contracting of services and products or the hiring of personnel in the field of employment.
  • Legitimate interest in the processing of data of our customers in direct marketing actions and express consent of the person concerned for all matters relating to automatic evaluations and preparation of reports.
  • Fulfillment of legal obligations for fraud prevention, communication with public authorities, and third-party claims.

How long do we keep your data?

The processing of data for the purposes described above will be kept for the time necessary to fulfill the purpose of its collection (for example, for the duration of the business relationship), as well as for compliance with legal obligations arising from the processing of data.

The conservation time of the CVs of the candidates to personnel selection processes, not selected, will be of one year from the reception of the same.

To which recipients are your data communicated?

In some cases, only when necessary, BALNEARI PRATS will provide user data to third parties. However, the data will never be sold to third parties. External service providers (e.g. payment providers or delivery companies) with whom BALNEARI PRATS works may use the data to provide the corresponding services, however, they will not use such information for their purposes or transfer it to third parties.

BALNEARI PRATS seeks to ensure the security of personal data when it is sent outside the company and ensures that third-party service providers respect confidentiality and have appropriate measures in place to protect personal data. These third parties must ensure that the information is handled following data privacy regulations.

In some cases, personal data may be required by law to be disclosed to public bodies or other parties, only what is strictly necessary for the fulfillment of such legal obligations will be disclosed.

Personal data obtained may also be shared with other current or future BALNEARI PRATS companies.

Where is your data stored?

In general, data is stored within the EU. For data that is sent to third parties outside the EU, we will ensure that they offer a sufficient level of protection, either because they have Binding Corporate Rules (BCR) or because they have adhered to the “Privacy Shield” or the agreement that is in force at the time.

What rights do you have and how can you exercise them?

You can address your communications and exercise your rights by sending a request to the following e-mail address

Under the provisions of the GDPR, you can request:

  • Right of access: you may request information about the personal data we have about you.
  • Right of rectification: you can communicate any change in your personal data.
  • Right of deletion and oblivion: you can request the deletion after blocking of personal data.
  • Right to limit processing: this means restricting the processing of personal data.
  • Right of opposition: you can withdraw your consent to the processing of your data, opposing further processing.
  • Right to portability: in some cases, you may request a copy of the personal data in a structured, commonly used, and machine-readable format for transmission to another controller.
  • Right not to be subject to individualized decisions: you may request not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect the data subject.

In some cases, the request may be refused if you request the deletion of data necessary for compliance with legal obligations.

Also, if you have a complaint about the processing of data you can file a complaint with the data protection authority.

Who is responsible for the accuracy and veracity of the data provided?

The user is solely responsible for the veracity and accuracy of the data included, exonerating BALNEARI PRATS from any liability in this regard. Users guarantee and are responsible, in any case, for the accuracy, validity and authenticity of the personal data provided, and undertake to keep them duly updated. The user agrees to provide complete and correct information in the registration or subscription form. BALNEARI PRATS reserves the right to terminate the services contracted with users in the event that the information provided is false, incomplete, inaccurate or not up to date.

BALNEARI PRATS is not responsible for the veracity of the information that is not of its elaboration and of which another source is indicated, so it does not assume any responsibility for hypothetical damages that could originate from the use of such information.

BALNEARI PRATS reserves the right to update, modify, or delete the information contained in its web pages, and may even limit or deny access to such information. BALNEARI PRATS is exonerated from liability for any damage or harm that the user may suffer as a result of errors, defects, or omissions in the information provided by BALNEARI PRATS, provided that it comes from sources outside the company.

Likewise, the user certifies that he/she is over 14 years of age and that he/she has the necessary legal capacity to consent to the processing of his/her personal data.

How do we handle the personal data of minors?

In principle, our products or services are not specifically addressed to minors. However, in the event that any of them are directed to minors under fourteen years of age, in accordance with Article 8 of the RGPD and Article 7 of the LO 3/2018, of December 5 (LOPDGDD), BALNEARI PRATS will require the valid, free, unequivocal, specific and informed consent of their legal guardians to process the personal data of minors. In this case, the DNI or other form of identification of the person giving consent will be required.

In the case of persons over fourteen years of age, data may be processed with the consent of the user, except in those cases in which the law requires the assistance of the holders of parental authority or guardianship.

What security measures do we apply to protect your personal data?

BALNEARI PRATS has adopted the legally required levels of security for the protection of Personal Data, and endeavors to install those additional technical means and measures within its power to prevent the loss, misuse, alteration, unauthorized access, and theft of Personal Data provided to BALNEARI PRATS.

BALNEARI PRATS shall not be liable for hypothetical damages that may arise from interferences, omissions, interruptions, computer viruses, telephone breakdowns, or disconnections in the operation of this electronic system, caused by reasons beyond the control of BALNEARI PRATS; delays or blockages in the use of this electronic system caused by deficiencies or overloading of telephone lines or overloading of the Data Processing Centre, the Internet system or other electronic systems, as well as damage that may be caused by third parties through illegitimate interference beyond the control of BALNEARI PRATS. Nevertheless, the user must be aware that Internet security measures are not impregnable.

Links to other websites

The website may contain links to other websites. By clicking on one of these links and accessing an external website, the visit will be subject to the privacy policy of that website, and BALNEARI PRATS shall not be held responsible for its privacy policy.

How do we use cookies?

The BALNEARI PRATS website and social networks use cookies to optimize and personalize your browsing experience. Cookies are physical information files that are hosted on the user’s own terminal, the information collected through cookies is used to facilitate user navigation through the portal and optimize the browsing experience. The data collected through cookies can be shared with the creators of the same, but in no case, the information obtained by them will be associated with personal data or data that can identify the user.

However, if the user does not want cookies to be installed on your hard drive, you can configure your browser to prevent the installation of these files. For more information see our Cookie Policy

Can the privacy policy be modified?

This privacy policy may be modified, we recommend that you review it periodically.z