Official Website
Coral Hotels’s Privacy in , Official website
Rights and duties
Official website of Coral Hotels in
PRIVACY POLICY
CORAL HOTELS BRAND
This Privacy Policy applies to the companies operating the hotels and apartments that make up the Coral Hotels trademark: Breogan, S.L.; Explotaciones Turística Compostela, S.A.; Canary Island Paradise, S.L.; Inversiones y Explotaciones Canarias, S.L.; as well as the service provider Breogan Management, S.L.
DATA CONTROLLERS
When a website user makes a booking or carries out any other transaction through this website, or whenever personal information is requested at any of the hotel establishments, such information will be processed by the corresponding entity according to the establishment at which the booking and/or processing takes place:
Breogan, S.L. – B38057006
• Coral Compostela Beach Golf II
• Coral Cotillo Beach
• Coral Los Alisios
• Coral Los Silos
• Coral Suites & Spa
• Coral Teide Mar
• Coral La Quinta
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Explotaciones Turística Compostela, S.A. – A38063251
• Coral Compostela Beach
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Canary Island Paradise, S.L. – B38301339
• Coral Dream
• Coral Ocean View
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Inversiones y Explotaciones Canarias, S.L. – B38051637
• Coral California
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Breogan Management, S.L. – B38393484
• Coral Villas La Quinta
• Resume submission form
INFORMATION ON DATA PROCESSING
The different types of data processing carried out through this website are detailed below, together with additional information regarding the processing activities undertaken by the Data Controllers at their hotel establishments.
A. DATA PROCESSING CARRIED OUT THROUGH THIS WEBSITE
CONTACT
Purpose: To manage enquiries and requests for information submitted by users through the contact form, telephone or email addresses available on this website.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent, provided by specifically accepting this Privacy Policy when submitting the contact form or when contacting us by telephone or email.
Data recipients: Companies forming part of the Coral Hotels brand.
Retention: Data will be retained for the duration of the enquiry and, in any event, until the data subject withdraws their consent. Further information may be requested from the Data Protection Officer (DPO) at lopd@coral-hotels.es.
CHATBOT / VIRTUAL ASSISTANT
Purpose: To manage enquiries and requests for information submitted by users through the virtual assistant (chatbot) available on the website, including the identification and contact details provided (full name and email address) and the content of the conversation, in order to respond to questions concerning services, availability, rates and conditions of stay and, where applicable, to direct the request towards the accommodation booking process.
Users are clearly informed from the beginning of the interaction that they are communicating with an artificial intelligence system and not with a natural person, in compliance with Article 50(1) of the European Union Artificial Intelligence Act (EU AI Act).
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent, provided through the specific acceptance of this Privacy Policy at the beginning of the conversation.
Data recipients: The company providing the chatbot technology (and, where applicable, the underlying AI model), acting as a data processor; and companies forming part of the Coral Hotels brand.
Retention: Data from conversations held with the chatbot will be retained for the period strictly necessary to deal with the enquiry and, where applicable, to provide evidence of the interaction with the user and compliance with the transparency obligation under Article 50(1) of the EU AI Act. Thereafter, the data will be erased or anonymised, unless the conversation results in an actual booking, in which case Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
RESERVATIONS
Purpose: To manage accommodation bookings made by direct customers and intermediaries.
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (accommodation contract).
Data recipients: Competent authorities pursuant to Royal Decree 933/2021; the website booking engine/provider; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
FLIGHT + HOTEL RESERVATIONS
Purpose: To manage accommodation bookings made by direct customers and intermediaries and to manage flight + hotel bookings.
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (flight + hotel accommodation contract).
Data recipients: In the case of accommodation, the competent authorities pursuant to Royal Decree 933/2021; in the case of flight bookings, ONLINE TRAVEL; the website booking engine/provider; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: In the case of accommodation, Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
In the case of data processed for the management of flight bookings, the data will be retained for the legally applicable period in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
ONLINE PRE-CHECK-IN
Purpose: To manage the online pre-check-in process carried out through the link available in the ONLINE PRE-CHECK-IN section: here.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (online pre-check-in). Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
Data recipients: Competent authorities pursuant to Royal Decree 933/2021; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
CLUB CORAL HAPPINESS
Purpose: To manage applications for membership of Club Coral Happiness and the corresponding membership benefits.
Legal basis under the GDPR: Article 6(1)(a): the data subject's explicit consent. Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party (Club Coral Happiness membership agreement).
Data recipients: Companies forming part of the Coral Hotels brand and service providers.
Retention: Data will be retained for the duration of the contractual relationship and, once that relationship has ended, for the period established by applicable law in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
MARKETING COMMUNICATIONS
Purpose: To send marketing communications and newsletters, as well as notifications concerning hotels and apartments, promotions and greetings.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent.
Data recipients: Companies forming part of the Coral Hotels brand; service providers; the online booking platform/provider; and providers of bulk communication services.
Retention: Data will be retained until the data subject requests to unsubscribe from the database.
Further information may be requested from the DPO at lopd@coral-hotels.es.
TRAVEL AGENCIES
Purpose: To manage applications for registration as a Travel Agency.
Legal basis under the GDPR: Article 6(1)(a): the data subject's explicit consent to process the registration application. Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party (Travel Agency registration agreement).
Data recipients: Companies forming part of the Coral Hotels brand and service providers.
Retention: Data will be retained for the duration of the contractual relationship and, once that relationship has ended, for the period established by applicable law in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
COMPANIES
Purpose: To manage applications for registration as a Company.
Legal basis under the GDPR: Article 6(1)(a): the data subject's explicit consent to process the registration application. Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party (Company registration agreement).
Data recipients: Companies forming part of the Coral Hotels brand and service providers.
Retention: Data will be retained for the duration of the contractual relationship and, once that relationship has ended, for the period established by applicable law in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
WI-FI ACCESS
Purpose: To manage access to the Wi-Fi network provided by the hotels and apartments to their guests.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent.
Data recipients: Spanish State Security Forces and Corps; the Wi-Fi network provider; companies forming part of the Coral Hotels brand; and service providers.
Retention: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from such purpose and from the processing of the data.
Further information may be requested from the DPO at lopd@coral-hotels.es.
RÉSUMÉS / UNSOLICITED APPLICATIONS / JOB VACANCIES / INTERNSHIPS
Purpose: To manage applications for employment positions submitted by candidates to companies forming part of the Coral Hotels Group.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent.
Data recipients: Companies forming part of the Coral Hotels brand.
Retention: CVs will be retained for two years from the date on which they are received.
Further information may be requested from the DPO at lopd@coral-hotels.es.
ACTIVITY BOOKINGS
Purpose: To manage requests for bookings of activities available through this website; coordinate availability and schedules with the entity providing the activity; confirm the booking with the customer; provide the information required for participation in the activity; manage incidents or cancellations relating to the booking (in the event of cancellation by the customer, the deposit is non-refundable); and, where applicable, invoice the corresponding management fee.
Legal basis: Article 6(1)(a) GDPR: the data subject's explicit consent for the booking request. Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Data recipients: The entity responsible for providing/managing the activity. Further information may be requested from the DPO at lopd@coral-hotels.es.
Retention: Data will be retained for the legally established period in order to comply with legal obligations and in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
B. ADDITIONAL INFORMATION
GUESTS
(Check-in)
Purpose: To manage the check-in and check-out registration of guests staying at the hotels and apartments.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (accommodation contract). Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
Data recipients: Competent authorities pursuant to Royal Decree 933/2021; the website booking engine/provider; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
VIDEO SURVEILLANCE
Purpose: Surveillance and security of the company's hotels and apartments, as well as monitoring of company personnel in the workplace.
Legal basis: Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.
Data recipients: Spanish State Security Forces and Corps and companies responsible for the maintenance of the security camera systems.
Further information on data protection may be requested from the DPO at lopd@coral-hotels.es.
SUPPLIERS
Purpose: Administrative management of orders, purchases and payments to suppliers.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Law 58/2003, of 17 December, General Tax Law.
Data recipients: Tax authorities; banks and savings banks; statutory auditors; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; service providers; and tax and accounting advisers.
Retention: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from such purpose and from the processing of the data.
Further information may be requested from the DPO at lopd@coral-hotels.es.
INVOICING
Purpose: To manage the Data Controller's invoicing processes.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Law 58/2003, of 17 December, General Tax Law.
Data recipients: Tax authorities; banks and savings banks; statutory auditors; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; service providers; and tax and accounting advisers.
Retention: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from such purpose and from the processing of the data.
Further information may be requested from the DPO at lopd@coral-hotels.es.
SOCIAL MEDIA
We use social media platforms for the purpose of publishing information of interest to our users.
Any personal data that you may provide to Coral Hotels through social media platforms will be processed in accordance with this Privacy Policy.
DATA SUBJECT RIGHTS AND DATA PROTECTION OFFICER
Where appropriate, you may exercise your ARCO-POL rights, namely the rights of access, rectification, erasure and data portability, as well as restriction of or objection to processing, at any time.
To exercise these rights, you may send a written request accompanied by a document proving your identity to our Data Protection Officer at:
Avda. Noelia Afonso, No. 10
Playa de Las Américas
38660 Arona
S/C de Tenerife
Spain
or by email to:
lopd@coral-hotels.es
If you consider that your rights have not been satisfactorily addressed, you may lodge a complaint with the relevant Supervisory Authority, which in Spain is the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), through its website at www.aepd.es.
Further information regarding the processing of personal data may be requested at:
lopd@coral-hotels.es
AMENDMENTS TO THIS PRIVACY POLICY
Coral Hotels may amend this Privacy Policy whenever necessary in accordance with the applicable legislation in force.
All amendments will be published in order to ensure that users are kept duly informed at all times.
Last updated: 10 September 2026
Copyright © CORAL HOTELS. All rights reserved.
CORAL HOTELS BRAND
This Privacy Policy applies to the companies operating the hotels and apartments that make up the Coral Hotels trademark: Breogan, S.L.; Explotaciones Turística Compostela, S.A.; Canary Island Paradise, S.L.; Inversiones y Explotaciones Canarias, S.L.; as well as the service provider Breogan Management, S.L.
DATA CONTROLLERS
When a website user makes a booking or carries out any other transaction through this website, or whenever personal information is requested at any of the hotel establishments, such information will be processed by the corresponding entity according to the establishment at which the booking and/or processing takes place:
Breogan, S.L. – B38057006
• Coral Compostela Beach Golf II
• Coral Cotillo Beach
• Coral Los Alisios
• Coral Los Silos
• Coral Suites & Spa
• Coral Teide Mar
• Coral La Quinta
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Explotaciones Turística Compostela, S.A. – A38063251
• Coral Compostela Beach
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Canary Island Paradise, S.L. – B38301339
• Coral Dream
• Coral Ocean View
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Inversiones y Explotaciones Canarias, S.L. – B38051637
• Coral California
• Contact forms
• Club Coral Happiness form
• Newsletter subscription form
• Company registration form
• Travel agency registration form
• Online pre-check-in
Breogan Management, S.L. – B38393484
• Coral Villas La Quinta
• Resume submission form
INFORMATION ON DATA PROCESSING
The different types of data processing carried out through this website are detailed below, together with additional information regarding the processing activities undertaken by the Data Controllers at their hotel establishments.
A. DATA PROCESSING CARRIED OUT THROUGH THIS WEBSITE
CONTACT
Purpose: To manage enquiries and requests for information submitted by users through the contact form, telephone or email addresses available on this website.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent, provided by specifically accepting this Privacy Policy when submitting the contact form or when contacting us by telephone or email.
Data recipients: Companies forming part of the Coral Hotels brand.
Retention: Data will be retained for the duration of the enquiry and, in any event, until the data subject withdraws their consent. Further information may be requested from the Data Protection Officer (DPO) at lopd@coral-hotels.es.
CHATBOT / VIRTUAL ASSISTANT
Purpose: To manage enquiries and requests for information submitted by users through the virtual assistant (chatbot) available on the website, including the identification and contact details provided (full name and email address) and the content of the conversation, in order to respond to questions concerning services, availability, rates and conditions of stay and, where applicable, to direct the request towards the accommodation booking process.
Users are clearly informed from the beginning of the interaction that they are communicating with an artificial intelligence system and not with a natural person, in compliance with Article 50(1) of the European Union Artificial Intelligence Act (EU AI Act).
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent, provided through the specific acceptance of this Privacy Policy at the beginning of the conversation.
Data recipients: The company providing the chatbot technology (and, where applicable, the underlying AI model), acting as a data processor; and companies forming part of the Coral Hotels brand.
Retention: Data from conversations held with the chatbot will be retained for the period strictly necessary to deal with the enquiry and, where applicable, to provide evidence of the interaction with the user and compliance with the transparency obligation under Article 50(1) of the EU AI Act. Thereafter, the data will be erased or anonymised, unless the conversation results in an actual booking, in which case Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
RESERVATIONS
Purpose: To manage accommodation bookings made by direct customers and intermediaries.
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (accommodation contract).
Data recipients: Competent authorities pursuant to Royal Decree 933/2021; the website booking engine/provider; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
FLIGHT + HOTEL RESERVATIONS
Purpose: To manage accommodation bookings made by direct customers and intermediaries and to manage flight + hotel bookings.
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (flight + hotel accommodation contract).
Data recipients: In the case of accommodation, the competent authorities pursuant to Royal Decree 933/2021; in the case of flight bookings, ONLINE TRAVEL; the website booking engine/provider; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: In the case of accommodation, Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
In the case of data processed for the management of flight bookings, the data will be retained for the legally applicable period in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
ONLINE PRE-CHECK-IN
Purpose: To manage the online pre-check-in process carried out through the link available in the ONLINE PRE-CHECK-IN section: here.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (online pre-check-in). Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
Data recipients: Competent authorities pursuant to Royal Decree 933/2021; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
CLUB CORAL HAPPINESS
Purpose: To manage applications for membership of Club Coral Happiness and the corresponding membership benefits.
Legal basis under the GDPR: Article 6(1)(a): the data subject's explicit consent. Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party (Club Coral Happiness membership agreement).
Data recipients: Companies forming part of the Coral Hotels brand and service providers.
Retention: Data will be retained for the duration of the contractual relationship and, once that relationship has ended, for the period established by applicable law in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
MARKETING COMMUNICATIONS
Purpose: To send marketing communications and newsletters, as well as notifications concerning hotels and apartments, promotions and greetings.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent.
Data recipients: Companies forming part of the Coral Hotels brand; service providers; the online booking platform/provider; and providers of bulk communication services.
Retention: Data will be retained until the data subject requests to unsubscribe from the database.
Further information may be requested from the DPO at lopd@coral-hotels.es.
TRAVEL AGENCIES
Purpose: To manage applications for registration as a Travel Agency.
Legal basis under the GDPR: Article 6(1)(a): the data subject's explicit consent to process the registration application. Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party (Travel Agency registration agreement).
Data recipients: Companies forming part of the Coral Hotels brand and service providers.
Retention: Data will be retained for the duration of the contractual relationship and, once that relationship has ended, for the period established by applicable law in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
COMPANIES
Purpose: To manage applications for registration as a Company.
Legal basis under the GDPR: Article 6(1)(a): the data subject's explicit consent to process the registration application. Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party (Company registration agreement).
Data recipients: Companies forming part of the Coral Hotels brand and service providers.
Retention: Data will be retained for the duration of the contractual relationship and, once that relationship has ended, for the period established by applicable law in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
WI-FI ACCESS
Purpose: To manage access to the Wi-Fi network provided by the hotels and apartments to their guests.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent.
Data recipients: Spanish State Security Forces and Corps; the Wi-Fi network provider; companies forming part of the Coral Hotels brand; and service providers.
Retention: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from such purpose and from the processing of the data.
Further information may be requested from the DPO at lopd@coral-hotels.es.
RÉSUMÉS / UNSOLICITED APPLICATIONS / JOB VACANCIES / INTERNSHIPS
Purpose: To manage applications for employment positions submitted by candidates to companies forming part of the Coral Hotels Group.
Legal basis: Article 6(1)(a) GDPR – the data subject's explicit consent.
Data recipients: Companies forming part of the Coral Hotels brand.
Retention: CVs will be retained for two years from the date on which they are received.
Further information may be requested from the DPO at lopd@coral-hotels.es.
ACTIVITY BOOKINGS
Purpose: To manage requests for bookings of activities available through this website; coordinate availability and schedules with the entity providing the activity; confirm the booking with the customer; provide the information required for participation in the activity; manage incidents or cancellations relating to the booking (in the event of cancellation by the customer, the deposit is non-refundable); and, where applicable, invoice the corresponding management fee.
Legal basis: Article 6(1)(a) GDPR: the data subject's explicit consent for the booking request. Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Data recipients: The entity responsible for providing/managing the activity. Further information may be requested from the DPO at lopd@coral-hotels.es.
Retention: Data will be retained for the legally established period in order to comply with legal obligations and in connection with any potential claims.
Further information may be requested from the DPO at lopd@coral-hotels.es.
B. ADDITIONAL INFORMATION
GUESTS
(Check-in)
Purpose: To manage the check-in and check-out registration of guests staying at the hotels and apartments.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (accommodation contract). Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
Data recipients: Competent authorities pursuant to Royal Decree 933/2021; the website booking engine/provider; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; and service providers.
Retention: Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons carrying out accommodation and motor vehicle rental activities, will apply.
Further information may be requested from the DPO at lopd@coral-hotels.es.
VIDEO SURVEILLANCE
Purpose: Surveillance and security of the company's hotels and apartments, as well as monitoring of company personnel in the workplace.
Legal basis: Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.
Data recipients: Spanish State Security Forces and Corps and companies responsible for the maintenance of the security camera systems.
Further information on data protection may be requested from the DPO at lopd@coral-hotels.es.
SUPPLIERS
Purpose: Administrative management of orders, purchases and payments to suppliers.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Law 58/2003, of 17 December, General Tax Law.
Data recipients: Tax authorities; banks and savings banks; statutory auditors; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; service providers; and tax and accounting advisers.
Retention: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from such purpose and from the processing of the data.
Further information may be requested from the DPO at lopd@coral-hotels.es.
INVOICING
Purpose: To manage the Data Controller's invoicing processes.
Legal basis: Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Law 58/2003, of 17 December, General Tax Law.
Data recipients: Tax authorities; banks and savings banks; statutory auditors; companies forming part of the Coral Hotels brand; companies providing software and hardware services to the Data Controller; service providers; and tax and accounting advisers.
Retention: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from such purpose and from the processing of the data.
Further information may be requested from the DPO at lopd@coral-hotels.es.
SOCIAL MEDIA
We use social media platforms for the purpose of publishing information of interest to our users.
Any personal data that you may provide to Coral Hotels through social media platforms will be processed in accordance with this Privacy Policy.
DATA SUBJECT RIGHTS AND DATA PROTECTION OFFICER
Where appropriate, you may exercise your ARCO-POL rights, namely the rights of access, rectification, erasure and data portability, as well as restriction of or objection to processing, at any time.
To exercise these rights, you may send a written request accompanied by a document proving your identity to our Data Protection Officer at:
Avda. Noelia Afonso, No. 10
Playa de Las Américas
38660 Arona
S/C de Tenerife
Spain
or by email to:
lopd@coral-hotels.es
If you consider that your rights have not been satisfactorily addressed, you may lodge a complaint with the relevant Supervisory Authority, which in Spain is the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), through its website at www.aepd.es.
Further information regarding the processing of personal data may be requested at:
lopd@coral-hotels.es
AMENDMENTS TO THIS PRIVACY POLICY
Coral Hotels may amend this Privacy Policy whenever necessary in accordance with the applicable legislation in force.
All amendments will be published in order to ensure that users are kept duly informed at all times.
Last updated: 10 September 2026
Copyright © CORAL HOTELS. All rights reserved.