Privacy and Data Protection Policy

Respecting the provisions of current legislation, ICYESA CORNELLA S.A. (hereinafter, also Website) undertakes to adopt the necessary technical and organizational measures, according to the level of security appropriate to the risk of the data collected.

Laws incorporated into this privacy policy This privacy policy is adapted to current Spanish and European regulations regarding the protection of personal data on the internet. Specifically, it respects the following rules:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (GDPR).

• Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPD-GDD).

• Royal Decree 1720/2007, of December 21, approving the Regulations for the development of Organic Law 15/1999 (RDLOPD).

• Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the data controller The person responsible for the processing of personal data collected at ICYESA CORNELLA S.A. is: ICYESA CORNELLA, S.A., provided with NIF A08504631, registered in the Mercantile Registry of Barcelona, Sheet 37389, Folio 72, Volume 3534, Book 2889, Section 2, Entry 1. (hereinafter, “data controller”).

Contact details:

• Address: Calle Gran Via de les Corts Catalanes, 967 – BJ, 08018 Barcelona (Spain)

• Telephone: +34 933 034 150

• Email: bookings@onixhotels.com

Purpose of the processing of personal data Personal data is collected and managed by ONIX HOTELS to:

• Manage bookings, requests for information, and customer service.

• Facilitate compliance with contractual obligations derived from bookings.

• Send commercial communications (only with consent).

• Analyze and optimize the web browsing experience.

Legal basis for the processing

• Execution of a contract or provision of service (booking).

• Consent of the data subject.

• Legitimate interest in improving services and security.

Retention periods Personal data will be kept for the time necessary to fulfill the purpose of the processing or as long as active consent exists. Subsequently, they will be kept blocked during the legally required periods.

Recipients of the data Data will not be transferred to third parties, except under legal obligation or to providers necessary for the correct provision of the service (e.g., Witbooking, Google, Meta), who act as data processors in accordance with the GDPR.

User rights The user may exercise the rights of access, rectification, erasure, restriction, portability, and objection by sending an email to bookings@onixhotels.com with the subject “Data Protection,” or in writing to the controller’s address. You may also file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security and confidentiality ICYESA CORNELLA S.A. adopts appropriate technical and organizational measures to guarantee the security of personal data, prevent its alteration, loss, or unauthorized access, and ensure its confidentiality. The website has an SSL certificate that guarantees the secure transmission of data.

Minors Only those over 14 years of age may grant consent for the processing of their personal data. In the case of children under 14 years of age, the consent of parents or guardians will be required.