Personal Data Processing Policy at Hospitality MedService
About This Policy
This privacy policy explains how Hospitality MedService (hereinafter — HMS) uses and protects personal information relating to our customers, website users, and other individuals who interact with us. We are committed to protecting your personal data, and it is important that you read this privacy policy together with any other privacy notices we may provide when collecting or processing personal data, so that you fully understand how and why we use your data. This notice supplements other privacy notices and does not override them.
HMS (referred to in this notice as “we”, “us”, or “our”) values your privacy and is committed to providing a safe and trustworthy experience across all interactions, whether making a purchase, managing an account, or using our website.
Our Commitments
We respect your right to privacy and are committed to providing you with a positive experience in all your interactions with us, whether visiting our website, making a booking, or engaging with our brand. We understand that your personal data matters to you, and we want you to have confidence in our data protection practices, which reflect our commitment to handling your information responsibly.
How We Collect Your Personal Data
We collect personal data in various ways, including but not limited to:
⮕ Direct interactions: You may share personal information with us when you fill in forms, contact us by post, phone, or email, or leave reviews about us on other platforms. This includes comments or photos posted on our social media platforms, as well as content in which you have tagged us.
⮕ Automated technologies: When you interact with our website, we may automatically collect technical data about your equipment, browsing actions, and usage patterns. This data is collected using cookies, server logs, and similar technologies.
⮕ Third parties: We may receive personal data about you from various third parties and publicly available sources.
Categories of Personal Data
⮕ Identity data: Includes name, surname, username or similar identifier, title, date of birth, and gender.
⮕ Contact data: Includes email address and telephone numbers.
⮕ Financial data: Includes bank account and payment card details.
⮕ Transaction data: Includes details of payments to and from you, and other details of products and services you have purchased from us.
⮕ Technical data: Includes IP address, browser type and version, time zone settings and location, browser plug-in types and versions, operating system and platform, and other technologies on the devices you use to access this website.
⮕ Profile data: Includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
⮕ Usage data: Includes information about how you use our website, products, and services.
⮕ Marketing and communications data: Includes your preferences for receiving marketing information from us and your communication preferences.
⮕ Call recordings: Includes recordings of calls to our booking centers.
Legal Bases for Processing
We process your personal data on the following legal bases:
⮕ Consent: You have given clear consent to the processing of your personal data for a specific purpose.
⮕ Contract: Processing is necessary for the performance of a contract with you, or because you have asked us to take specific steps prior to entering into a contract.
⮕ Legal obligation: Processing is necessary for compliance with a legal obligation to which we are subject.
⮕ Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, provided that your rights and interests do not override those interests.
Data Processing Activities Register
We process personal data for the following operations with their corresponding legal bases:
Operation: Customer Payments
● Purpose: Processing customer payments in compliance with legal obligations and contractual agreements.
● Legal bases: Legal obligation, Contract
● Data source: Live chat, Customer support
Operation: Customer Master Data Processing
● Purpose: Managing and maintaining accurate customer information for operational needs and contractual obligations.
● Legal bases: Legitimate interests, Contract
● Data source: Internal business operations, Data analysis
Operation: Customer Bookings
● Purpose: Processing and managing customer bookings for various services.
● Legal bases: Contract
● Data source: Direct mail campaigns, Customer preferences
Operation: Paid Media Advertising
● Purpose: Conducting marketing activities through paid media channels (e.g. paid search, social media advertising).
● Legal bases: Legitimate interests
● Data source: Advertising campaigns, Prospective customer engagement
Operation: Customer Live Chat
● Purpose: Providing real-time customer support via chat.
● Legal bases: Legitimate interests
● Data source: Offline marketing campaigns, Customer preferences
Operation: Document Distribution to Customers
● Purpose: Distributing relevant documents to customers.
● Legal bases: Contract
● Data source: Internal business operations, Data analysis
Operation: Direct Mail Brochure Distribution
● Purpose: Sending marketing brochures by post.
● Legal bases: Legitimate interests
● Data source: Marketing campaigns, Prospective customer engagement
Operation: Customer Enquiries (RAQ)
● Purpose: Processing and responding to customer enquiries (Request a Quote).
● Legal bases: Contract
● Data source: Competition entries, Customer engagement
Operation: Customer Surveys
● Purpose: Conducting surveys to collect customer feedback.
● Legal bases: Legitimate interests, Consent
● Data source: Partner relations, Customer engagement
Operation: Customer Reviews
● Purpose: Collecting and displaying customer reviews on our platforms.
● Legal bases: Legitimate interests
● Data source: Customer reviews, Survey responses
Operation: Offline Customer Mailings
● Purpose: Sending marketing materials to customers by post.
● Legal bases: Legitimate interests
● Data source: Advertising campaigns, Prospective customer engagement
Marketing Communications
You may receive marketing communications from us if you have requested information or purchased goods/services from us, unless you have opted out. By consenting to receive marketing communications, you may also receive materials via completed Request a Quote (RAQ) forms or brochure requests.
We may also obtain your contact details from third-party lists where you have consented to your data being passed to us for marketing purposes. This allows us to share information and offers related to our services with you. For direct mail, you may unsubscribe by writing to info@hospitalitymedservice.com.
Correspondence
We process messages and communications relating to bookings, enquiries, or contracts between you, us, and third parties.
⮕ Purpose: Correspondence data is necessary to confirm bookings, respond to enquiries, resolve issues, and fulfil contractual obligations.
⮕ Legal bases: Processing is necessary for the performance of a contract and is based on our legitimate interests in providing effective customer service and managing relationships.
Website Usage Information
We collect personal data when you use our website, including:
⮕ Data collection: Information about your visits and interactions, including IP address, device data, browser type, operating system, and time zone.
⮕ Cookies and web beacons: Data collected using cookies and web beacons to improve user experience and analysis website performance.
⮕ Page interactions: Data on pages visited, services/products viewed, duration of interaction, etc.
⮕ Purpose: This data helps us improve website functionality, personalize the user experience, and optimize marketing efforts.
⮕ Legal bases: Processing is based on legitimate interests in understanding user preferences, improving performance, and delivering relevant content and advertising.
User-Generated Content (UGC)
We may process content you provide in connection with your experience with us, including:
⮕ Reviews, blogs, testimonials, and images: Content submitted to our platforms.
⮕ Marketing use: Use of such content in marketing materials, on our website, in emails, or shared with trade partners.
⮕ Purpose: User-generated content enhances marketing, drives engagement, and provides authentic feedback.
⮕ Legal bases: Processing is based on consent when you submit content, and is necessary for our legitimate interests in promoting services and engaging with our audience.
Third-Party Data Transfers
We may receive personal data about you from third parties, including:
⮕ Leisure, accommodation, and travel service providers: Data received to fulfil bookings and provide comprehensive travel services.
⮕ Social media platforms: We may collect personal data through interactions on social media platforms (e.g. Facebook, Instagram), including engagement with our advertising and campaigns.
Cookies
Cookies are small data files that allow a website to collect and store a range of data on your desktop computer, laptop, or mobile device. Cookies help us provide important features and functionality on our websites, and we use them to improve your experience as a customer. Please refer to our Cookie Policy.
Location of Personal Data
We (and any subcontractor or other organization processing your personal data on our behalf) may transfer, store, and process your personal data within the European Economic Area (“EEA”) and the United States. We may also transfer your personal data outside the EEA and the United States only to companies within our group or to parties with whom we have a contract based on the Standard Contractual Clauses issued by the European Commission. We ensure that your personal data is protected by requiring all our group companies and contractual parties to adhere to the same data protection standards. This ensures that adequate safeguards are in place for such transfers outside the EEA and the United States.
Data Privacy Framework
HMS complies with the Data Privacy Framework (DPF), which ensures the protection and proper management of personal data. We adhere to the principles of transparency, accountability, and user control over personal data.
HMS complies with the EU—U.S. Data Privacy Framework (EU-U.S. DPF). Under certain conditions, individuals may invoke binding arbitration to resolve complaints that have not been resolved through other DPF mechanisms. For more information, please refer to
Annex I of the DPF Principles.
We comply with the DPF Principles with respect to onward transfers of personal information to third parties. Where we transfer personal information to a third party acting as a controller, we will ensure this is done in accordance with the Notice and Choice Principles. For transfers to third parties acting as agents on our behalf, we remain liable under the DPF Principles if the agent processes personal information in a manner inconsistent with the Principles, unless we demonstrate that we are not responsible for the event giving rise to the damage.
If you have questions or complaints regarding our compliance with the DPF Principles, you should first contact us at info@hospitalitymedservice.com.
Children’s Personal Information
Our website is not intended for children as defined by data protection laws, and we cannot always know the age of those using it. If a child has shared personal information without the permission of a parent or guardian, the parent or guardian should contact us. If we become aware that a child’s personal information has been collected without appropriate consent, we will delete the child’s account if one exists.
In some cases, we may need to collect children’s personal information — for example, for bookings, the purchase of travel-related services, or other special situations (e.g. family-oriented features). When we process information about children, we follow strict rules to ensure it is used lawfully, only when necessary, and kept secure.
If you have questions about how we protect children’s personal information, or if you are a parent or guardian wishing to delete or update your child’s information, please contact us.
Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Information on specific retention periods for various aspects of your personal data is available upon request.
Your Rights
Depending on your state of residence and applicable US privacy laws, you may have certain rights regarding your personal data. These rights may include the ability to:
● Access your personal data: Request information about the personal data we collect, use, or disclose.
● Correct your personal data: Request correction of any inaccuracies in your personal information.
● Delete your personal data: Request deletion of certain personal information we have collected about you, subject to certain exceptions.
● Opt-out of the sale or sharing of personal data: In some states, you may have the right to opt out of the sale or sharing of your personal data for targeted advertising.
● Restrict the use of sensitive personal data: Where applicable, restrict our use of certain types of sensitive personal data.
● Portability of your personal data: Request a copy of your personal data in a portable format where required.
● Withdraw consent: Where processing is based on consent, you may withdraw your consent at any time.
Data Security
We prioritize the security of your data through robust measures to prevent unauthorized access, loss, or disclosure:
● Physical security: Secured premises and controlled access to storage locations.
● Encryption and network security: Data encryption, firewalls, and advanced security protocols.
● Access controls: Restricted data access using strong authentication.
● Data minimization: Collecting and storing only the data that is necessary.
● Audits and monitoring: Regular checks for vulnerabilities and compliance.
● Staff training: Ongoing training in data protection practices.
● Incident response: A rapid action plan in the event of a data breach.
● Third-party compliance: Ensured through contractual agreements.
● Privacy by Design: Privacy is built into our systems from the outset.
● Continuous improvement: Regular updates to security measures.
These measures ensure that your personal data is always kept secure and handled responsibly.
Changes to This Privacy Policy
We regularly review our privacy policy. Any changes we make to our privacy policy will be posted on this page and, where appropriate, notified to you by email.
Contact Us
The data controller responsible for processing your personal data is HMS, located at: AV. Doctor Mitjavila 005 3, Edifici Bomosa-Alba, ESPAI81, AD500 Andorra la Vella. You can contact us by email at info@hospitalitymedservice.com.