1. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

• Company Name:
• Trading Name: Torquellagrandstay
• Registered Address:
• Website: torquellagrandstay.com
• Privacy Contact Email: info@torquellagrandstay.com
• Data Protection Officer (DPO): The Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer at info@torquellagrandstay.com.

2. Scope and Applicability

This Privacy Policy applies to all individuals who:

• Visit our website at torquellagrandstay.com;
• Make or enquire about reservations for hotel accommodation;
• Access or use our casino facilities, services, or loyalty programmes;
• Contact us via email, telephone, or any other communication channel;
• Subscribe to our newsletters or marketing communications;
• Participate in promotions, competitions, or events organised by us;
• Apply for employment or other business relationships with us.

This policy does not apply to third-party websites, applications, or services that may be linked from our website. We encourage you to review the privacy policies of any third-party sites you visit.

3. Personal Data We Collect

We collect various categories of personal data depending on your interaction with us. "Personal data" means any information that identifies or can reasonably identify you as an individual. The categories of personal data we may collect include:

3.1 Identity and Contact Information

• Full name (first name, last name, title);
• Date of birth and age verification data;
• Gender (where voluntarily provided);
• Nationality and country of residence;
• Postal address (home or billing address);
• Email address;
• Telephone and mobile phone numbers;
• Government-issued identification documents (passport, driver's licence, national identity card) — required for check-in and regulatory compliance;
• Signature (where required for agreements or registration forms).

3.2 Reservation and Stay Information

• Booking reference numbers and reservation history;
• Check-in and check-out dates and times;
• Room type, preferences, and special requests;
• Number of guests and accompanying persons;
• Loyalty programme membership number and tier status;
• Vehicle registration details (if using car parking facilities).

3.3 Financial and Payment Information

• Payment card details (card type, last four digits, expiry date — full card numbers are not stored by us);
• Billing address associated with payment method;
• Transaction history, invoices, and receipts;
• Bank account information (where applicable for refunds or direct debit arrangements);
• Credit limit or deposit authorisation information.

3.4 Casino and Gaming Information

• Casino membership or player account details;
• Gaming activity records including games played, wagering amounts, and session durations;
• Self-exclusion requests and responsible gambling records;
• Anti-money laundering (AML) and Know Your Customer (KYC) documentation;
• Source of funds declarations where required by law;
• Winnings and losses records for regulatory purposes.

3.5 Technical and Usage Data

• IP address and approximate geolocation data;
• Browser type, version, and operating system;
• Device identifiers and hardware information;
• Pages visited, time spent on pages, and clickstream data;
• Referring URLs and search terms used;
• Cookie identifiers and similar tracking technologies (see our Cookie Policy for further details);
• Session logs and access timestamps.

3.6 Communications and Marketing Data

• Email and message correspondence with our team;
• Feedback, reviews, survey responses, and complaints;
• Marketing preferences and communication opt-in/opt-out status;
• Participation records in promotions, competitions, or events.

3.7 Special Categories of Personal Data

In limited circumstances, we may collect and process special categories of personal data as defined under Article 9 of the GDPR. These may include:

• Health data: Information about dietary requirements, allergies, mobility needs, or medical conditions disclosed by guests to enable us to provide appropriate accommodation or dining services;
• Biometric data: Where applicable, facial recognition or fingerprint data used for access control or identity verification in compliance with applicable law;
• Data relating to criminal convictions: In connection with responsible gambling obligations, anti-money laundering requirements, or security screening as required by applicable legislation.

We process special category data only where we have a specific legal basis to do so, such as your explicit consent, the establishment or defence of legal claims, or compliance with a legal obligation. You are never required to provide health information to us; however, failure to do so may limit our ability to accommodate specific requirements.

3.8 Data Collected From Third Parties

We may also receive personal data about you from third-party sources, including:

• Online travel agencies and booking platforms (e.g., Booking.com, Expedia, Hotels.com);
• Travel agents and tour operators making bookings on your behalf;
• Corporate or group booking contacts;
• Credit reference and fraud prevention agencies;
• Regulatory bodies and law enforcement authorities (where required by law);
• Social media platforms (where you interact with our social media pages or use social login features);
• Our loyalty programme partners.

4. Legal Basis for Processing Your Personal Data

We are required under Article 6 of the GDPR to identify a lawful basis for each purpose for which we process your personal data. We rely on the following legal bases:

4.1 Performance of a Contract (Article 6(1)(b) GDPR)

We process your personal data where it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This includes:

• Processing your hotel reservation, managing your stay, and providing accommodation services;
• Processing payments and issuing invoices and receipts;
• Managing your casino membership account and gaming activities;
• Providing concierge, dining, and ancillary services you have requested;
• Responding to pre-contractual enquiries about our services.

4.2 Compliance With a Legal Obligation (Article 6(1)(c) GDPR)

We process personal data where necessary to comply with legal and regulatory obligations to which we are subject, including:

• Anti-money laundering (AML) and counter-terrorism financing (CTF) obligations;
• Know Your Customer (KYC) identification and verification requirements;
• Responsible gambling obligations, including self-exclusion registers and age verification;
• Gaming and casino regulatory reporting requirements;
• Tax and accounting obligations;
• Health, safety, and security obligations;
• Compliance with court orders, law enforcement requests, or regulatory investigations.

4.3 Legitimate Interests (Article 6(1)(f) GDPR)

We process personal data where it is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and interests. Our legitimate interests include:

• Ensuring the security and integrity of our premises, systems, and assets (including CCTV monitoring in public and gaming areas);
• Preventing and detecting fraud, theft, and other criminal activity;
• Improving and personalising our services and website functionality;
• Analysing website usage data and trends to enhance user experience;
• Sending direct marketing communications about similar services where you are an existing customer (subject to your right to opt out at any time);
• Managing and resolving complaints, disputes, and legal claims;
• Conducting internal audits, business analysis, and planning;
• Maintaining records for business continuity purposes.

We carry out a balancing test when relying on legitimate interests to ensure that our interests do not override your fundamental rights and freedoms. You may request information about this balancing test by contacting us.

4.4 Consent (Article 6(1)(a) GDPR)

Where we rely on your consent as the legal basis for processing, we will ask for your clear, specific, and freely given consent at the time of data collection. We rely on consent for:

• Sending you marketing communications, newsletters, and promotional offers where you are not an existing customer;
• Placing non-essential cookies and similar tracking technologies on your device (see our Cookie Policy);
• Processing sensitive health or dietary data beyond what is strictly necessary for service delivery;
• Participating in optional loyalty programmes, personalisation features, or research surveys.

You have the right to withdraw your consent at any time by contacting us at info@torquellagrandstay.com or using the unsubscribe link in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.5 Vital Interests (Article 6(1)(d) GDPR)

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of you or another natural person — for example, in a medical emergency on our premises.

4.6 Public Task (Article 6(1)(e) GDPR)

We may process personal data where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, including compliance with gaming regulatory requirements that serve a public function.

4.7 Legal Basis for Special Category Data (Article 9 GDPR)

Where we process special categories of personal data, we rely on one or more of the following additional conditions under Article 9(2) GDPR:

• Explicit consent (Article 9(2)(a)): Where you have given explicit consent for a specific purpose;
• Vital interests (Article 9(2)(c)): Where processing is necessary to protect your life or the life of another person;
• Legal claims (Article 9(2)(f)): Where processing is necessary for the establishment, exercise, or defence of legal claims;
• Legal obligation (Article 9(2)(b)): Where processing is required to meet obligations and exercise specific rights in the field of employment and social security law.

5. How We Use Your Personal Data

We use the personal data we collect for the following specific purposes:

5.1 Providing Hotel and Accommodation Services

• Processing, confirming, and managing your room reservations;
• Facilitating check-in and check-out procedures;
• Accommodating special requests, preferences, and accessibility needs;
• Providing in-room services, concierge, dining, and spa services;
• Communicating pre-arrival, in-stay, and post-departure information.

5.2 Casino and Gaming Operations

• Registering and managing your casino membership or player account;
• Processing gaming transactions and maintaining accurate gaming records;
• Conducting mandatory identity verification and age verification;
• Administering responsible gambling programmes, including self-exclusion and intervention;
• Complying with anti-money laundering legislation and regulatory reporting obligations;
• Ensuring the integrity and security of gaming operations.

5.3 Payment Processing and Financial Administration

• Processing payments for accommodation, gaming, dining, and other services;
• Issuing invoices, receipts, and financial statements;
• Managing refunds, chargebacks, and billing disputes;
• Complying with tax, accounting, and financial regulatory obligations.

5.4 Safety, Security, and Fraud Prevention

• Operating CCTV surveillance systems throughout our premises for the safety of guests and staff;
• Detecting, preventing, and investigating fraud, theft, and other criminal conduct;
• Maintaining access control systems and security records;
• Co-operating with law enforcement authorities and regulatory bodies where required;
• Protecting the rights and property of and our guests.

5.5 Customer Service and Communications

• Responding to your enquiries, requests, and correspondence;
• Managing feedback, complaints, and guest satisfaction matters;
• Providing customer support before, during, and after your stay;
• Sending transactional communications such as booking confirmations and payment receipts.

5.6 Marketing and Promotions

• Sending you personalised offers, promotions, and newsletters (subject to your marketing preferences and applicable legal basis);
• Administering competitions, prize draws, and special events;
• Managing our loyalty programme and providing member benefits;
• Conducting targeted online advertising through cookies and similar technologies (with your consent where required).

5.7 Website and Technology Management

• Operating, maintaining, and improving our website and digital platforms;
• Analysing website traffic, usage patterns, and user behaviour;
• Conducting A/B testing and website performance optimisation;
• Ensuring the security of our IT systems and preventing cyberattacks.

5.8 Business Administration and Legal Compliance

• Meeting our legal, regulatory, and contractual obligations;
• Conducting internal audits, risk assessments, and compliance reviews;
• Managing business operations, workforce planning, and corporate governance;
• Establishing, exercising, or defending legal claims;
• Facilitating business restructuring, mergers, or acquisitions.

6. Sharing Your Personal Data

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients where necessary and in accordance with applicable data protection law:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers who process personal data on our behalf and under our instructions as data processors. These include:

• Payment processors: To handle secure payment transactions and fraud prevention;
• IT and technology providers: Including cloud hosting, website management, reservation systems, and cybersecurity services;
• Booking and distribution platforms: Online travel agencies and channel managers that facilitate reservations;
• Marketing and communications agencies: For email marketing, advertising, and customer relationship management;
• Analytics providers: Including web analytics and data insight services;
• Catering and event management companies: Where external service providers operate within our premises;
• Security and CCTV monitoring providers;
• Legal, accounting, and professional advisory firms.

All data processors are required to enter into data processing agreements with us and to process your data only in accordance with our documented instructions and applicable data protection law.

6.2 Regulatory and Law Enforcement Authorities

We may be required to disclose your personal data to regulatory bodies, government agencies, or law enforcement authorities where we are obliged to do so by law. This includes:

• Gaming regulators and licensing authorities;
• Financial intelligence and anti-money laundering agencies;
• Tax authorities;
• Police and other law enforcement agencies;
• Courts and tribunals, in response to valid legal orders.

6.3 Business Partners and Group Companies

We may share personal data with affiliated companies within our corporate group for the purposes of centralised administration, joint promotions, and group-level compliance functions, always subject to appropriate data protection safeguards.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, your personal data may be transferred to the relevant third party as part of that transaction. We will notify you if your data is to be used in a materially different manner as a result of such a transfer.

6.5 Other Third Parties With Your Consent

With your explicit consent, we may share your personal data with other third parties, such as our loyalty programme partners or third-party service providers whose offers or services you have requested.

6.6 International Transfers of Personal Data

As an internationally operating business, some of our service providers and partners may be located outside the European Economic Area (EEA) or other jurisdictions with equivalent data protection standards. Where we transfer personal data to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards in accordance with Chapter V of the GDPR, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Binding Corporate Rules (BCRs) where applicable;
• Adequacy decisions issued by the European Commission;
• Other transfer mechanisms permitted under the GDPR.

You may request a copy of the safeguards we have implemented for international data transfers by contacting us at info@torquellagrandstay.com.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and reporting requirements. The specific retention periods we apply depend on the category of data and the purpose of processing:

• Hotel reservation and guest records
  • Retention Period: 7 years from date of stay
  • Justification: Legal and tax obligations; limitation periods for contractual claims
• Payment and financial transaction records
  • Retention Period: 7 years from transaction date
  • Justification: Tax, accounting, and financial regulatory obligations
• Casino membership and gaming records
  • Retention Period: 7 years from last gaming activity
  • Justification: Gaming regulatory requirements; AML/KYC obligations
• Anti-money laundering and KYC documentation
  • Retention Period: 5–7 years from end of business relationship
  • Justification: AML regulatory requirements
• Responsible gambling and self-exclusion records
  • Retention Period: Duration of exclusion plus 7 years
  • Justification: Regulatory compliance and duty of care obligations
• Marketing preferences and consent records
  • Retention Period: 3 years from last interaction or withdrawal of consent
  • Justification: Demonstration of lawful marketing basis
• Website usage and analytics data (anonymised)
  • Retention Period: Up to 26 months
  • Justification: Legitimate interests in website improvement
• CCTV footage
  • Retention Period: 30 days (unless required for investigation)
  • Justification: Security and safety; overwritten after retention period
• Customer service correspondence
  • Retention Period: 3 years from resolution of query
  • Justification: Legitimate interests; limitation periods for claims
• Complaint and dispute records
  • Retention Period: 7 years from closure
  • Justification: Legal claims; regulatory requirements
• Job application records (unsuccessful)
  • Retention Period: 6–12 months from decision
  • Justification: Defence of potential employment claims

After the applicable retention period has expired, we will securely delete or anonymise your personal data in accordance with our data destruction procedures. Where anonymisation is not practicable, we will restrict access to and further processing of that data until deletion is possible.

In some circumstances, we may retain your data for longer periods where required by law or where necessary for the establishment, exercise, or defence of legal claims.

8. Your Data Protection Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data under the GDPR. We will respond to all valid requests within one calendar month of receipt. In complex cases, this period may be extended by a further two months, of which we will inform you.

8.1 Right of Access (Article 15 GDPR)

You have the right to request a copy of the personal data we hold about you, together with information about how we use it, who we share it with, and how long we retain it. This is commonly known as a Subject Access Request (SAR). We will provide this information free of charge, unless the request is manifestly unfounded or excessive.

8.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate personal data we hold about you, or to have incomplete personal data completed. Please help us to keep your records accurate by informing us of any changes to your personal information.

8.3 Right to Erasure / "Right to Be Forgotten" (Article 17 GDPR)

You have the right to request that we delete your personal data in certain circumstances, including where:

• The data is no longer necessary for the purpose for which it was collected;
• You withdraw consent and there is no other legal basis for processing;
• You object to processing based on legitimate interests and there are no overriding grounds;
• The data has been unlawfully processed;
• The data must be erased to comply with a legal obligation.

Please note that this right is not absolute. We may be required or entitled to retain certain data notwithstanding your request — for example, where retention is required by law or where the data is necessary for the establishment, exercise, or defence of legal claims.

8.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data, or where processing is unlawful but you prefer restriction to erasure. Where processing is restricted, we may still store your data but will not otherwise process it without your consent, except for certain limited purposes.

8.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted directly to another controller where technically feasible.

8.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data:

• On grounds relating to your particular situation, where processing is based on legitimate interests (Article 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims;
• For direct marketing purposes, including profiling related to direct marketing. You have an absolute right to object to this type of processing, and we will cease immediately upon receipt of your objection.

8.7 Rights in Relation to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you. Where we engage in such processing, we will inform you and provide an opportunity to request human intervention, to express your point of view, and to contest the decision.

8.8 Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time without detriment. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to the withdrawal.

8.9 How to Exercise Your Rights

To exercise any of the above rights, please submit a written request to us by email at info@torquellagrandstay.com, clearly stating the right you wish to exercise and providing sufficient information to allow us to identify you. We may need to verify your identity before processing your request.

We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act on the request.

8.10 Right to Lodge a Complaint With a Supervisory Authority (Article 77 GDPR)

If you believe that our processing of your personal data violates the GDPR or applicable data protection law, you have the right to lodge a complaint with the competent data protection supervisory authority. In the European Union, this is typically the supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. A list of EU supervisory authorities is available on the European Data Protection Board website at edpb.europa.eu.

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority and encourage you to contact us in the first instance.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse website performance, and deliver personalised content and advertising. Cookies are small text files placed on your device when you visit our website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the website to function correctly. These cannot be disabled.
• Performance and Analytics Cookies: Help us understand how visitors interact with our website by collecting anonymous usage statistics.
• Functional Cookies: Enable enhanced features and personalisation, such as remembering your preferences and language settings.
• Targeting and Advertising Cookies: Used to deliver relevant advertising and track the effectiveness of marketing campaigns. These require your consent.

You can manage your cookie preferences at any time by adjusting your browser settings or using the cookie preference centre available on our website. Please note that disabling certain cookies may affect the functionality of our website.

For full details about the cookies we use, their purposes, and how to manage them, please refer to our separate Cookie Policy, available on our website.

10. Children's Privacy

Our casino services are strictly limited to individuals who are 18 years of age or older (or such higher age as may be required by applicable law). We do not knowingly collect personal data from children under the age of 18 in connection with casino services. Our hotel services may accommodate families with children; however, we do not knowingly collect personal data directly from children under the age of 16 without verifiable parental or guardian consent.

If you believe that we have inadvertently collected personal data from a child without appropriate consent, please contact us immediately at info@torquellagrandstay.com so that we can take appropriate action to delete that data.

11. Data Security

We are committed to ensuring the security of your personal data. We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include, but are not limited to:

• Encryption of data in transit using SSL/TLS protocols;
• Encryption of sensitive data at rest;
• Access controls and role-based permissions to limit data access to authorised personnel;
• Regular security assessments, penetration testing, and vulnerability management;
• Staff training on data protection and information security;
• Secure disposal and destruction of physical and digital records;
• Business continuity and disaster recovery plans;
• Data breach detection, notification, and response procedures.

While we take all reasonable precautions to safeguard your personal data, no method of data transmission over the internet or electronic storage is entirely secure. We cannot guarantee the absolute security of your data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform you directly without undue delay.

12. Third-Party Websites and Links

Our website may contain links to third-party websites, social media platforms, booking engines, or other online services that are not operated or controlled by us. This Privacy Policy applies only to torquellagrandstay.com and our own processing activities. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policy of any third-party site you visit before providing any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or regulatory guidance. We will publish the updated Privacy Policy on our website with a revised "Last updated" date at the top of the document. Where changes are material, we will take reasonable steps to notify you — for example, by posting a prominent notice on our website or by sending you an email notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services after any changes to this policy constitutes your acknowledgement of those changes.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please do not hesitate to contact us. We are happy to assist you.

• Data Controller:
• Trading As: Torquellagrandstay
• Data Protection Officer: The Data Protection Officer
• Postal Address:
• Email Address: info@torquellagrandstay.com
• Website: torquellagrandstay.com

When contacting us about a data protection matter, please include your full name, contact details, and a clear description of your request or concern so that we can respond to you promptly and efficiently. We will acknowledge receipt of your request within five business days and aim to resolve all requests within one calendar month.

We are committed to working with you to resolve any concerns about your personal data. If you are not satisfied with our response, you retain the right to lodge a complaint with the appropriate supervisory authority, as described in Section 8.10 of this Privacy Policy.