Privacy Policy

1. Who We Are and Scope of This Policy

World Spa Hotels ("we", "us", "our") operates a curated online directory of luxury spa and wellness hotels, available at worldspahotels.com (the "Service"). This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, browse hotel listings, subscribe to our newsletter, submit an enquiry, or use the hotel partner portal.

This policy applies to all visitors, travellers, and hotel partners who interact with the Service. It does not apply to the websites or booking engines of the hotels listed in our directory, which are operated by third parties with their own privacy policies.

2. Data Controller

The data controller for the personal data described in this policy is World Spa Hotels, registered in Spain. If you have any questions about this policy or about how we handle your personal data, you can contact us at any time at hello@worldspahotels.com.

3. Data We Collect

We collect personal data in the following categories:

• •Data you provide to us: your name, email address, phone number, country, and the details of any enquiry or message you send us; your email address when you subscribe to our newsletter; and, if you are a hotel partner, the hotel, spa, treatment, room, and business contact details you submit through the partner portal.
• •Data collected automatically: when you visit the website we collect technical data such as your IP address, device and browser type, the pages you view, the referring page, and the dates and times of your visits. This data is collected through cookies and similar technologies, which are described in our Cookie Policy.
• •Account data: if you create an account, we store your registration details, login credentials, and your activity within the Service (such as hotels you have saved or viewed).

4. How We Use Your Data and Our Legal Bases

We process personal data only where we have a valid legal basis under the EU General Data Protection Regulation (GDPR):

• •To provide and manage your account and the features you request (legal basis: performance of a contract).
• •To respond to your enquiries, messages, and partner applications (legal basis: steps prior to entering into a contract, and our legitimate interest in operating and improving the Service).
• •To send you our newsletter, where you have subscribed (legal basis: your consent, which you may withdraw at any time).
• •To understand how the Service is used and to improve its content and performance (legal basis: your consent for analytics cookies, and our legitimate interest in aggregated, non-identifying usage analysis).
• •To ensure the security, integrity, and proper functioning of the Service, and to prevent abuse (legal basis: our legitimate interest).
• •To comply with our legal and regulatory obligations (legal basis: legal obligation).

5. How We Share Your Data

We do not sell, rent, or trade your personal data. We share personal data only in the following circumstances:

• •With hotels: when you submit an enquiry about a specific hotel, the details you provide in the enquiry form are forwarded to that hotel so that it can respond to you.
• •With service providers: trusted providers that host our infrastructure, deliver our email, and provide analytics tools, acting on our instructions as data processors.
• •With authorities: where disclosure is required by law, regulation, or a valid legal process.
• •International transfers: where a provider is located outside the European Economic Area, we transfer data only to countries offering an adequate level of protection or on the basis of the European Commission's Standard Contractual Clauses.

6. How Long We Keep Your Data

We keep personal data only as long as necessary for the purposes described in this policy: account data is retained until you ask us to delete your account; enquiries and messages are retained while your matter is open and for a reasonable period thereafter in case of follow-up; newsletter data is retained until you unsubscribe; and technical usage data is retained for a limited period for analytics purposes. When data is no longer needed, we delete it or anonymise it.

7. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure, including encryption of data in transit and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Under the GDPR and the Spanish Organic Law 3/2018 on Data Protection, you have the following rights:

• •Access — obtain a copy of the personal data we hold about you.
• •Rectification — have inaccurate or incomplete data corrected.
• •Erasure — request deletion of your personal data ("right to be forgotten").
• •Restriction — request that we restrict processing of your data in certain circumstances.
• •Portability — receive your data in a structured, commonly used format.
• •Objection — object to processing based on our legitimate interests.
• •Withdraw consent — withdraw your consent to newsletter or cookie-based processing at any time.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version is always published on this page, together with the date of the last update shown above. Significant changes will be highlighted on our website.

11. Contact Us

To exercise any of your rights, or if you have any question about this policy, email us at hello@worldspahotels.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).