Privacy Policy
PRIVACY POLICY
1. Who is responsible for processing your personal data?
Depending on the establishment or service selected, the controller responsible for processing your personal data will be one of the following entities:
Grupo Empresas Alonso Marí, S.A. (GEAMSA)
Tax Identification Number (CIF): A07404510
Registered office: Calle Aragón, 71, Ground Floor, 07800 Ibiza, Balearic Islands, Spain.
Cala Mandía, S.A.
Tax Identification Number (CIF): A07146277
Registered office: Calle Aragón, 71, Ground Floor, 07800 Ibiza, Balearic Islands, Spain.
Each entity shall act as the data controller in relation to the establishments and services under its management. The identity of the relevant controller will be indicated during the booking process and in the corresponding booking confirmation.
In accordance with the current allocation of the establishments:
Cala Mandía, S.A. is the data controller for Insotel Cala Mandía Resort & Spa.
Grupo Empresas Alonso Marí, S.A. (GEAMSA) is the data controller for the remaining Insotel Group establishments featured on this website.
Where an enquiry or request is not related to a specific establishment, the data controller will be the entity responsible for managing the relevant service or the department to which communication is addressed. This information will be specified in the relevant form or contact channel.
You may contact GEAMSA or Cala Mandía, S.A. by email at rgpd@insotel.com.
2. What personal data do we process and how do we obtain it?
GEAMSA or Cala Mandía, S.A. may process the following categories of personal data, depending on the nature of its relationship with you:
Identification and contact details.
Information relating to your booking, stay, accompanying guests and services purchased.
Billing, payment and booking guarantee details.
Information relating to your preferences, special requests and communications exchanged with GEAMSA or Cala Mandía, S.A.
Technical and browsing data collected through cookies or similar technologies, as described in the Cookie Policy.
As a general rule, your personal data will be provided directly by you through our website, booking engine, contact forms, email, telephone, chatbot or during your stay.
Where you have not provided your personal data directly, it may be obtained from the individual, travel agency, tour operator, company, platform or intermediary that has made or managed the booking on your behalf. In such cases, the data processed will be limited to your identification and contact details, together with information relating to your booking.
Please do not include special category personal data in free-text fields unless it is strictly necessary to deal with a request relating to your stay.
Where it is necessary to process health-related data in order to manage specific accessibility, dietary or assistance requirements, you will be provided with the relevant information and, where required, your explicit consent will be obtained before such data is processed.
3. What do we use your personal data for and what is the legal basis for processing?
Booking, accommodation and provision of contracted services
Your personal data will be processed in order to:
Process, confirm, amend or cancel your booking.
Manage payments, deposits, booking guarantees and any applicable refunds.
Manage your accommodation and the services you have requested.
Respond to requests relating to your stay.
Maintain the necessary communications before, during and after the provision of the services.
The legal basis for this process is the implementation of pre-contractual measures requested by you and the performance of the contract, pursuant to Article 6(1)(b) of the GDPR.
The provision of the data identified as mandatory is necessary to manage your booking and provide the contracted services. If such data is not provided, we may be unable to process your booking or provide the requested services. Articles 13 and 14 of the GDPR require us to inform you of the purposes of processing, the legal bases relied upon and the consequences of failing to provide the data required.
Responding to enquiries and requests
Personal data provided through contact forms, email, telephone, chatbot or any other communication channel will be processed in order to respond to and manage your enquiry, request, incident, complaint or request for information.
The legal basis for this process will be:
The implementation of pre-contractual measures or the performance of a contract, where the enquiry relates to a booking or service.
The legitimate interests of GEAMSA or Cala Mandía, S.A. in responding to communications received and maintaining an appropriate relationship with users, customers and business partners, in all other cases.
Compliance with legal obligations
GEAMSA or Cala Mandía, S.A. will process the personal data necessary to comply with applicable legal obligations, including those relating to taxation, accounting, consumer protection, record-keeping and the communication of information in connection with accommodation services.
The legal basis for this processing is compliance with a legal obligation to which the data controller is subject, pursuant to Article 6(1)(c) of the GDPR.
Accommodation providers are subject to legal obligations requiring them to register and communicate certain guest information to the competent authorities. The data included in the relevant register must be retained for a period of three years following the end of the contracted service.
Marketing communications
GEAMSA or Cala Mandía, S.A. may use the contact details of their customers to send marketing communications relating to the data controller's own tourism products and services that are similar to those previously contracted. This process is based on the controller's legitimate interest in maintaining its relationship with customers and informing them of services related to their previous experience.
Where such communications are sent by email or other equivalent electronic means, they will only be sent where the applicable legal requirements are satisfied. You may object to receiving such communications at any time, easily and free of charge, by using the unsubscribe mechanism included in each communication or by contacting us through the channels set out in this Privacy Policy. Such objection will not affect the management of your booking or the provision of the contracted services.
Where there is no prior contractual relationship, or where the communications do not fall within the legal exemption applicable to existing customers, the processing will be based on your consent. You may withdraw your consent at any time, without affecting the lawfulness of any processing carried out before its withdrawal.
Fraud prevention, security and the establishment, exercise or defence of legal claims
GEAMSA or Cala Mandía, S.A. may process the personal data necessary to prevent fraudulent activities, protect its systems and services, manage incidents, and establish, exercise or defend legal claims.
The legal basis for this processing is the legitimate interest of the data controller in protecting its business, systems, customers and legal rights, without prejudice to any applicable legal obligations.
Website browsing and cookies
This website uses cookies and similar technologies. Strictly necessary technical cookies are used to enable website navigation and provide the services requested by users. Analytical, advertising and personalisation cookies that are not strictly necessary will only be used in accordance with the preferences selected by the user through the cookie preference centre.
For further information, please refer to our Cookie Policy.
4. How long will we retain your personal data?
Personal data relating to bookings, stays and contracted services will be retained for the duration of the contractual relationship. Thereafter, the data will be securely restricted and retained only for the statutory limitation periods applicable to any liabilities arising from that relationship.
Personal data subject to tax, accounting, consumer protection or other legal obligations will be retained for the periods prescribed by the applicable legislation.
Personal data included in mandatory accommodation registers will be retained for the period required by law following the end of the contracted service.
Personal data processed for the purpose of responding to enquiries or requests will be retained for as long as necessary to deal with the relevant enquiry or request and, thereafter, for the applicable limitation periods during which legal claims may arise.
Personal data processed for marketing communications will be retained until you object to such processing. Where you exercise your right to object, GEAMSA or Cala Mandía, S.A. may retain the minimum identification data necessary to ensure that no further marketing communications are sent to you.
Personal data processed through cookies will be retained for the periods specified in the Cookie Policy.
5. Who may your personal data be shared with?
Your personal data may be disclosed or made available to the following recipients where necessary:
The data controller responsible for your booking and the relevant establishment.
Public authorities, law enforcement authorities, administrative bodies, courts and tribunals, and any other competent authorities where required by law or pursuant to a valid legal request.
Financial institutions, payment service providers and other entities involved in processing payments, booking guarantees and refunds.
Travel agencies, tour operators, companies, platforms or intermediaries involved in your booking where necessary to manage, amend or deal with issues relating to the booking.
Professional advisers, insurers, auditors and other third parties where necessary for compliance with legal obligations or for the establishment, exercise or defence of legal claims.
Your personal data may also be accessed by service providers supplying technology services, web hosting, booking engine services, hotel management systems, customer support, communications, security, maintenance, analytics or technical support. These service providers will process your personal data on behalf of the data controller, strictly in accordance with its instructions and under the corresponding data processing agreements.
Your personal data will not be disclosed to other organisations for their own marketing purposes unless there is a valid legal basis for doing so and you have been provided with the relevant information in advance.
6. International data transfers
Certain technology service providers may provide services or process information from countries outside the European Economic Area (EEA).
Where international transfers of personal data take place, they will be carried out using one of the transfer mechanisms recognised under the GDPR, such as an adequacy decision adopted by the European Commission, the European Commission's Standard Contractual Clauses (SCCs), or any other legally recognised safeguards.
You may request further information about the applicable international data transfers and the safeguards implemented by contacting us at rgpd@insotel.com.
7. Automated decision-making and profiling
GEAMSA or Cala Mandía, S.A. do not envisage making decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Where analysis or profiling is carried out for marketing or personalisation purposes, this will be undertaken in accordance with the applicable legal bases and the preferences expressed by the user.
8. What are your rights?
You have the right to:
Access your personal data.
Request the rectification of inaccurate or incomplete personal data.
Request the erasure of your personal data where applicable.
Request the restriction of processing.
Object to the processing of your personal data, particularly where it is processed for direct marketing purposes.
Request the portability of your personal data where applicable.
Withdraw your consent at any time where the processing is based on your consent.
Not be subject to a decision based solely on automated processing where the legal requirements are met.
You may exercise your rights free of charge by submitting a request to:
Customer Services – Data Protection
Calle Aragón, 71, Ground Floor
07800 Ibiza, Balearic Islands, Spain
Email: rgpd@insotel.com
Your request must enable us to identify you and specify the right you wish to exercise. Additional documentation will only be requested where reasonably necessary to verify your identity.
9. Complaints to the supervisory authority
If you believe that the processing of your personal data does not comply with the applicable data protection legislation, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) through its electronic office or at the following address:
Spanish Data Protection Agency (AEPD)
Edificio Cuzco IV
Paseo de la Castellana, 141, 9th Floor
28046 Madrid
Spain
10. Security and confidentiality
GEAMSA or Cala Mandía, S.A. implement appropriate technical and organisational measures proportionate to the level of risk in order to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Any persons involved in the processing of personal data are subject to a duty of confidentiality, which shall continue even after their relationship with the data controller has ended.
11. Children's personal data
Bookings must be made by adults with the legal capacity to enter into contracts.
Personal data relating to children included in a booking or corresponding to underage guests will only be processed where necessary to manage the stay, provide the requested services or comply with applicable legal obligations.
12. Updates to this Privacy Policy
GEAMSA or Cala Mandía, S.A. may update this Privacy Policy from time to time in order to reflect changes in applicable legislation, guidance issued by supervisory authorities, changes to the services provided or modifications to the way personal data is processed.
The current version of this Privacy Policy will always be available on this website.
Last updated: July 2026.