PRIVACY POLICY – SANDOS HOTELS & RESORTS – programa MÁS

This Privacy Policy details the information regarding the processing of your personal data during the registration and booking process via our online platform. 

In compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and the Data Protection Act 2018, we inform you that your personal data will be processed by SANDOS HOTELES & RESORTS. The purpose is to manage your registration and participation in the MÁS Loyalty Programme, as well as to send you personalised commercial communications regarding offers, promotions, and news related to our hotel services, subject to your consent. 

1. DATA CONTROLLER 

For any communication regarding the protection of your personal data, you may contact the entity responsible for its processing using the following details: 

For the purposes of this Privacy Policy, please note that 'Epi Gestión, S.L. with NIF B81890006' is the Sandos Group company established to provide customer service for the commercial needs arising from the group's other businesses and activities, such as marketing, Call Centre, administrative services, and hotel operations. 

Contact Email: callcenter.eur@sandos.com

Contact Telephone: +34 (960) 479446

Data Protection Officer (DPO): privacidad@sandos.es

2. PURPOSES OF PERSONAL DATA PROCESSING 

Your personal data will be used for the following legitimate purposes, always within the applicable legal framework: 

Purpose - Description 

• User Registration Management: Creation and maintenance of your personal account within our programa MÁS.

• Customer Service: Handling enquiries, requests, and incident management. 

• Commercial Communications: Sending offers, promotions, and information about our programa MÁS (only with express consent). 

• Customer Loyalty: Management of the Sandos loyalty scheme. 

• Service Improvement: Statistical analysis and improvement of the user experience. 

• Legal Compliance: Meeting applicable legal and regulatory obligations. 

Categories of Data Processed 

• Identification data: First name, surname, email address, telephone number. 

• Contact data: Email, telephone. 

• Profile data: Stay preferences, booking history, accumulated points, loyalty level. 

• Technical data: IP address, cookies, device used (when accessing via the website). 

3. LEGAL BASIS FOR PROCESSING

Each processing activity of your personal data is justified by a legal basis, in accordance with the General Data Protection Regulation (GDPR):

• Performance of a contract: Management of your registration, bookings, and contracted services. 

• Consent of the data subject: Sending commercial and marketing communications. 

• Legitimate interest: Improvement of our services, fraud prevention, and security. 

• Compliance with legal obligations: Meeting legal, tax, and regulatory requirements.

4. RECIPIENTS OF THE DATA 

Your personal data may be shared with the following recipients when necessary for the provision of the service:

• Service Providers: Companies providing essential services for management. This includes technological service providers (hosting, CRM, email marketing platforms) acting as data processors under contract pursuant to Art. 28 GDPR. 

• Group Entities: Other companies within the Sandos Group for centralised management and service coordination purposes. 

• Public Authorities: When required by legal, tax, judicial, or administrative obligation. 

No international data transfers outside the European Economic Area (EEA), except those necessary for the management of international bookings, which will be carried out with adequate safeguards.

5. DATA RETENTION

We will retain your personal data for as long as:

• You maintain an active relationship with us. 

• It is necessary for the purposes for which they were collected. 

• It is required by legal obligations. 

The data will be duly blocked when no longer necessary, remaining solely at the disposal of authorities during the legally established periods. 

6. USER RIGHTS

As the owner of your personal data, legislation grants you a series of rights that you may exercise at any time:

• Access: Obtain confirmation of whether we are processing your personal data and access it. 

• Rectification: Request the correction of inaccurate or incomplete data. 

• Erasure ('Right to be Forgotten'): Request the deletion of your data when they are no longer necessary for the purposes collected. 

• Objection: Object to the processing of your data in certain circumstances, especially for direct marketing. 

• Restriction of Processing: Request that we limit the processing of your data in specific cases. 

• Data Portability: Receive your data in a structured format and transmit them to another controller. 

• Withdrawal of Consent: Revoke consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal. 

To exercise these rights, please send a written request to the controller's address or to the following email: privacidad@sandos.es, accompanied by a valid identification document.

7. SECURITY MEASURES

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with the state of the art and the nature of the stored data. This includes data encryption, access controls, and periodic evaluation procedures.

8. ADDITIONAL INFORMATION

• Cookies and similar technologies: Our website uses cookies to improve the user experience. You can manage your preferences in our Cookies Policy. You can configure or reject cookies via the Cookie Settings available in the footer of https://www.sandos.es/politica-cookies. 

• Minors' data: We do not collect data from individuals under 18 years of age without parental consent. If we detect such a situation, we will delete the information immediately. 

• Third-party links: Our site may contain links to third-party websites with independent privacy policies. 

9. CHANGES TO THE PRIVACY POLICY

We reserve the right to modify this policy to adapt it to new legislation or case law. Any changes will be published on this website.

10. SUPERVISORY AUTHORITY

If you consider that your rights have been breached, you may file a complaint with the data protection authority in your place of residence:

• For residents in Spain: Spanish Data Protection Agency (AEPD) (www.aepd.es) 

• For residents in Mexico: National Institute for Transparency (INAI) (www.inai.org.mx) 

Last updated: January 2026

Contact to exercise rights: privacidad@sandos.es

Additional information at: https://www.sandos.es/politica-privacidad , https://www.sandos.es/aviso-legal , https://www.sandos.es/terminos-condiciones , y, https://www.sandos.es/politica-cookies

If you have any doubt about your booking please contact with call center callcenter.eur@sandos.com or (+44)203.807.4491.