Identification and Contact Details of the Data Controller

Siresa Salmantina, S.L., with registered office at Calle Serrano 41, 4th floor, 28001, Madrid (Spain), and N.I.F B-62079553 (hereinafter, the “Company”), is the data controller of the personal data processed for the purposes indicated below. This clause informs you about the use the Company will make of your personal data and about the rights you have under the General Data Protection Regulation (“GDPR”).

If you have any questions regarding the processing of your personal data, please contact the Company’s Data Protection Officer at: privacy@resa.es.

General Information: Description of the Information Contained in the Privacy Policy

In this privacy policy, you will find a table with detailed information about the processing carried out by the Company, in compliance with our transparency obligations. This table provides specific information regarding each processing purpose. Notwithstanding the above, you are informed that, in relation to all processing identified in the table below:

The Company may disclose your data to public authorities, judges, or courts when necessary to comply with legal obligations or orders from competent administrative or judicial bodies. This includes disclosures to such authorities in compliance with relevant procedural legislation or laws for the prevention, detection, investigation, and prosecution of crimes (such as the Organic Law of the Judiciary; the Civil Procedure Law; the Criminal Procedure Law; the Common Administrative Procedure Law; or Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation, and prosecution of criminal offenses and the execution of criminal sanctions).
Your data will be processed only for the period that is essentially necessary to achieve the applicable processing purpose (pure processing period). After this period, your data:
- will remain blocked for the attention of judicial, administrative, or tax claims, and for the attention of data protection rights you may exercise, during the periods applicable under the relevant legislation. The table below includes detailed information on the pure processing and blocking periods applicable for each specific purpose;
- may be retained in compliance with legal retention obligations as indicated in the table below (application of tax regulations or provisions of the commercial code in cases where payments are made by you).
You may exercise your data protection rights (access, rectification, erasure, restriction of processing, objection, or portability) and revoke your consent as appropriate in each case, by contacting the Company at the contact address indicated at the top of the policy. You are also informed that you may file a complaint with the Spanish Data Protection Agency (https://www.aepd.es/) if you believe that your rights have not been properly respected by the Company.
Although the Company generally obtains the data processed directly from the data subject, in certain cases, the data may be provided by third parties identified below:
- Residencias de Estudiantes, S.L. (“RESA”) may provide data of potential residents and group representatives when it receives information requests or applications through the channels enabled for this purpose. In these cases, the personal data collected will be, as appropriate: identification and contact data, city of interest, and academic year of interest.
- Group representatives may provide the data of potential residents or residents. In these cases, the personal data collected will be, as appropriate, identification and contact data.
- Universities, in the context of processing reservation requests for potential residents who are scholarship recipients from their university, may provide the data of the residents, in which case the personal data collected will be, as appropriate: identification and contact data.
- Organizers of university fairs and universities, in the context of organizing university events and using digital platforms for access to university residences, may provide data of potential residents. In these cases, the personal data collected will be, as appropriate: identification and contact data.
- Potential residents and residents, in the context of processing reservation requests and/or managing the contractual relationship, may provide data of their emergency contacts. In these cases, the personal data collected will be, as appropriate: identification data, contact data, and relationship to the resident.

Notwithstanding the above, in the context of your relationship with the Company, if you provide data of a third party to the Company, you undertake to provide this information clause to such data subjects.

In any case, we inform you that you may request more detailed information regarding the processing of your personal data carried out by the Company by contacting the Company at the email address indicated at the top of the policy

Información Additional information on the purposes of processing, applicable legal bases, data recipients, data processors, international transfers and retention periods

3.1 If you have contacted the Company or given your consent for commercial communications

Purpose of processing	Legal basis	Recipients	Processors	International Transfers	Pure conservation period	Blocking period
Management of requests for information through the Company's contact points, including: WhatsApp, telephone email, or web forms.	The Company's legitimate interest in responding to requests for information from both potential residents and representatives of groups (Art. 6.1.f GDPR).	In addition to the transfers of data to third parties indicated above, the data of group representatives will be transferred to the company Residencias de Estudiantes, S.L. (“RESA”) for the purpose of providing commercial attention to group booking representatives, on the legal basis of the Company's legitimate interest in the development of the group's commercial activities (Art. 6.1.f GDPR).	Service providers in the information technology, “contact center”, and legal and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the European Economic Area (“EEA”) to the United States are planned, based on Standard Contractual Clauses (“SCCs”).	Your data will be kept for the period during which the request for information or the corresponding procedure is being processed. If, as a result of the consultation, the interested party ends up contracting with the Company, the corresponding retention periods will apply as indicated in the applicable privacy policies.	Once the pure retention period has ended, your data will be retained for a period of three years, corresponding to the statute of limitations for actions arising from data protection regulations. This is without prejudice to any additional periods that may apply for the fulfilment of legal obligations, as informed in this policy.
Sending of own commercial communications by electronic means.	Consent of the data subject (Art. 6.1.a GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the EEA to the United States are envisaged, based on CCTs.	Your data will be kept for two years from your last interaction with the Company or until you withdraw your consent.	Once the pure retention period has expired, your data will be retained for 3 years for the purpose of complying with personal data protection obligations. This is without prejudice to any periods that may apply for the fulfilment of legal obligations as set out in this policy.
Management of claims, complaints and other requests.	The Company's legitimate interest in responding to complaints or requests received (Art. 6.1.f GDPR). In the event that the management of complaints or claims arises from compliance with Consumer and User regulations, the processing will be carried out on the basis of compliance with a legal obligation (Art. 6.1.c GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for the duration of the claim, complaint or request for information.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Retention of personal data when the Company has payment or collection obligations in compliance with legal obligations.	Compliance with legal obligations (Art. 6.1.c GDPR) to retain information as provided for in: • Article 30 of the Commercial Code. Article 26 of the Corporation Tax Act (“LIS”).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the areas of information technology and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for • a period of up to 6 years from the last entry made in the books (Art. 30 of the Commercial Code on the retention of information relating to business activity). a period of up to 10 years (Art. 26 LIS) from the end of the period established for filing the corporate tax return for the corresponding fiscal year in compliance with the legal retention obligations indicated above.	N/A: not applicable

3.2 If you have made a formal request to reserve accommodation.

Purpose of processing	Legal basis	Recipients	Processors	International Transfers	Pure conservation period	Blocking period
Management of requests for information through the Company's contact points, including: WhatsApp, telephone, email, or web forms.	The Company's legitimate interest in responding to requests for information from both potential residents and representatives of groups (Art. 6.1.f GDPR).	In addition to the transfers of data to third parties indicated above, the data of group representatives will be transferred to Resa Residencias de Estudiantes, S.L. (“RESA”) for the purpose of providing commercial attention to group booking representatives, on the legal basis of the Company's legitimate interest in the development of the group's commercial activities (Art. 6.1.f GDPR).	Service providers in the information technology, “contact center”, and legal and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the European Economic Area (`EEA¨) to the United States are envisaged, based on Standard Contractual Clauses (`SCCs´).	Your data will be kept for the period during which the request for information or the corresponding procedure is being processed. If, as a result of the enquiry, the interested party ends up contracting with the Company, the corresponding retention periods will apply as indicated in the applicable privacy policies.	Once the pure retention period has expired, your data will be retained for 3 years for the limitation period of actions derived from data protection regulations. This is without prejudice to any periods that may apply for compliance with legal obligations reported in this policy.
Formalisation of the application process for the reservation and selection of long-stay or medium-stay residents.	Execution of contractual measures (reservation payment) and pre-contractual measures (completion of the selection process) (Art. 6.1.b GDPR). For the processing of specially protected data of potential residents (disabilities), the consent of the data subject is required (Art. 9.2.a GDPR). For the processing of data of guardians and/or emergency contacts, the Company's legitimate interest in managing the selection process (Art. 6.1.f GDPR).	In addition to the data transfers indicated above, your data will be transferred to: • Universities for the purpose of confirming that a scholarship holder has made a reservation at one of the Company's residences, on the legal basis of the Company's legitimate interest in developing its commercial relationship with the university awarding the scholarship (Art. 6.1.f GDPR). • Signaturit for the purpose of enabling the signature process during the residence booking application process on the basis of the performance of the contractual relationship with the data subject (Art. 6.1.b GDPR).	Service providers in the fields of information technology, technology consulting, contact centres, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept during the evaluation process of potential residents until their admission or rejection. If, as a result of the consultation, the interested party ends up contracting with the Company, the corresponding retention periods will apply as indicated in the applicable privacy policies.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Management of claims, complaints and other requests.	Legitimate interest of the Company in responding to complaints or requests received (Art. 6.1.f GDPR). In the event that the management of complaints or claims arises from compliance with Consumer and User regulations, the processing will be carried out on the basis of compliance with a legal obligation (Art. 6.1.c GDPR	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged	Your data will be kept for the duration of the claim, complaint or request for information.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Sending of own commercial communications by electronic means.	Consent of the data subject (Art. 6.1.a GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the EEA to the United States are planned, based on CCTs.	Our data will be kept for 2 years from your last interaction with the Company or until you withdraw your consent.	Once the pure retention period has expired, your data will be retained for 3 years for the purpose of complying with personal data protection obligations. This is without prejudice to any periods that may apply for the fulfilment of legal obligations as set out in this policy.
Retention of personal data when the Company has payment or collection obligations in compliance with legal obligations.	Compliance with legal obligations (Art. 6.1.c GDPR) to retain information as provided for in: Article 30 of the Commercial Code. Article 26 of the Corporation Tax Act (“LIS”).	No transfers to third parties are anticipated other than those indicated above.	Service providers in the areas of information technology and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for: • a period of up to 6 years from the last entry made in the books (Art. 30 of the Commercial Code on the retention of information relating to business activity). • a period of up to 10 years (Art. 26 LIS) from the end of the period established for filing the corporate tax return for the corresponding fiscal year in compliance with the legal retention obligations indicated above.	N/A: not applicable

3.3 If you have booked an accommodation

Purpose of processing	Legal basis	Recipients	Processors	International Transfers	Pure conservation period	Blocking period
Management of requests for information through the Company's contact points, including: WhatsApp, telephone email, or web forms.	The Company's legitimate interest in responding to requests for information from both potential residents and representatives of groups (Art. 6.1.f GDPR).	In addition to the transfers of data to third parties indicated above, the data of group representatives will be transferred to the company Resa - Residencias de Estudiantes, S.L. (“RESA”) for the purpose of providing commercial attention to group booking representatives, on the legal basis of the Company's legitimate interest in the development of the group's commercial activities (Art. 6.1.f GDPR).	Service providers in the information technology, “contact center”, and legal and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the European Economic Area (EEA) to the United States are envisaged, based on Standard Contractual Clauses (SCCs).	Your data will be kept for the period during which the request for information or the corresponding procedure is being processed. If, as a result of the enquiry, the interested party ends up contracting with the Company, the corresponding retention periods will apply as indicated in the applicable privacy policies.	Once the pure retention period has expired, your data will be retained for 3 years for the limitation period of actions arising from data protection regulations. This is without prejudice to any periods that may apply for compliance with legal obligations reported in this policy.
Formalisation of the application process for the reservation and selection of long-stay or medium-stay residents.	Execution of contractual measures (reservation payment) and pre-contractual measures (completion of the selection process) (Art. 6.1.b GDPR). For the processing of specially protected data of potential residents (disabilities), the consent of the data subject is required (Art. 9.2.a GDPR). For the processing of data of guardians and/or emergency contacts, the Company's legitimate interest in managing the selection process (Art. 6.1.f GDPR).	In addition to the data transfers indicated above, your data will be transferred to: • Universities for the purpose of confirming that a scholarship holder has made a reservation at one of the Company's residences, on the legal basis of the Company's legitimate interest in developing its commercial relationship with the university awarding the scholarship (Art. 6.1.f GDPR). • Signaturit for the purpose of enabling the signature process during the residence booking application process on the basis of the performance of the contractual relationship with the data subject (Art. 6.1.b GDPR).	Service providers in the fields of information technology, technology consulting, contact centres, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged	Your data will be kept during the evaluation process of potential residents until their admission or rejection. If, as a result of the consultation, the interested party ends up contracting with the Company, the corresponding retention periods will apply as indicated in the applicable privacy policies.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy
Management of contractual relationships with long-stay and medium-stay residents (individuals and groups).	Execution of the contractual relationship (Art. 6.1.b GDPR) consisting of the accommodation of the resident. For the processing of specially protected data of residents (disabilities and allergies), the consent of the data subject is required (Art. 9.2.a GDPR). For the processing of data of family members or guardians of minor residents, the Company's legitimate interest in completing the contractual relationship with the resident (Art. 6.1.f GDPR). For the processing of residents' emergency contact details, the Company's legitimate interest in responding to emergency situations (Art. 6.1.f GDPR). For the recovery of outstanding payments from residents, the Company's legitimate interest in ensuring payment is made (Art. 6.1.f GDPR).	In addition to the transfers of data to third parties indicated above, your data will be transferred to Signaturit for the purpose of enabling the signature process during the residence booking request process on the basis of the execution of the contractual relationship with the data subject (Art. 6.1.b GDPR).	Service providers in the fields of information technology, technology consulting, concierge services, catering, parcel delivery solutions, and accounting, legal, and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the EEA to the United States are envisaged, based on CCTs.	Your data will be kept for the duration of your stay and subsequently for 2 months after its end for the closure of inventories, balances and the conclusion of the relationship with the resident.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
ResaHub management (events, prize draws, Eat Well, wellbeing, etc.)	Execution of the contractual relationship (Art. 6.1.b GDPR). For the processing of specially protected data of residents (disabilities and allergies), consent is required (Art. 9.2.a GDPR).	In addition to the transfers of data to third parties indicated above, your data will be transferred to the Spanish Youth Hostel Network (‘REAJ’) for the purpose of obtaining a hostel membership card for the resident on the basis of the need to carry out the transfer for the execution of the contractual relationship relating to membership of ResaHub (Art. 6.1.b GDPR).	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the EEA to the United States are envisaged, based on CCTs.	Your data will be retained for the duration of your membership of ResaHub (which corresponds to your stay at the residence).	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.esta política.
Video surveillance for disciplinary purposes for residents.	Performance of the contractual relationship (Art. 6.1.b GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the European Economic Area are envisaged.	Your data will be kept: for 1 month from the date of collection when it does not reflect the commission of illegal acts. until its management and resolution when it reflects the commission of illegal acts.	Once the retention period has expired: if the images do not show any illegal activity, they will not be subject to the blocking period. if the images show illegal activity, they will be duly blocked for a period of 5 years, which is the limitation period for possible civil claims. All of the above is without prejudice to any deadlines that may apply for compliance with legal obligations as set out in this policy
Video surveillance for security purposes.	The Company's legitimate interest in maintaining the security of its facilities and ensuring their proper functioning (Art. 6.1.f GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged	Your data will be kept: for 1 month from the date of collection when it does not reflect the commission of illegal acts. until its management and resolution when it reflects the commission of illegal acts.	Once the retention period has expired: • if the images do not show any illegal activity, they will not be subject to the blocking period. • if the images show illegal activity, they will be duly blocked for a period of 5 years, which is the limitation period for possible civil claims. All of the above is without prejudice to any deadlines that may apply for compliance with legal obligations as set out in this policy.
Recording of images of residents (capture and publication on social media and/or other media, as applicable).	Consent of the data subject (Art. 6.1.a GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the areas of information technology, social media/digital communications management, and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for as long as necessary for the purpose of dissemination.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Management of claims, complaints, and other requests.	The Company's legitimate interest in responding to complaints or requests received (Art. 6.1.f GDPR). In the event that the management of complaints or claims arises from compliance with Consumer and User regulations, the processing will be carried out on the basis of compliance with a legal obligation (Art. 6.1.c GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for the duration of the claim, complaint or request for information..	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Sending commercial communications specific to each residence via electronic means.	Legitimate interest of the Company (Art. 6.1.f GDPR) in sending such communications in accordance with the provisions of Article 21 of Law 34/2002, of 11 July, on information society services and electronic commerce.	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the EEA to the United States are envisaged, based on CCTs.	Your data will be kept for the duration of the contractual relationship with the Company.	Once the pure retention period has expired, your data will be retained for 3 years for the purpose of complying with personal data protection obligations. This is without prejudice to any periods that may apply for the fulfilment of legal obligations as set out in this policy.
Conducting analyses on customer data (business analytics)	The Company's legitimate interest in carrying out these business analytics processes (Art. 6.1.f GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of data analytics/business analytics, information technology, and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for the period necessary to obtain the specific analysis; once the analysis has been carried out, only aggregated statistical data that does not allow for the direct or indirect identification of individuals will be kept. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.	N/A: not applicable
Retention of personal data when the Company has payment or collection obligations in compliance with legal obligations.	Compliance with legal obligations (Art. 6.1.c GDPR) to retain information as provided for in: • Article 30 of the Commercial Code. • Article 26 of the Corporation Tax Act (“LIS”).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the areas of information technology and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for: a period of up to 6 years from the last entry made in the books (Art. 30 of the Commercial Code on the retention of information relating to business activity). a period of up to 10 years (Art. 26 LIS) from the end of the period established for filing the corporation tax return for the corresponding fiscal year in compliance with the legal retention obligations indicated above.	N/A: not applicable

3.4 If you are an overnight visitor.

Purpose of processing	Legal basis	Recipients	Processors	International Transfers	Pure conservation period	Blocking period
Management of contractual relations with visitors.	Performance of the contractual relationship (Art. 6.1.b GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, concierge services, and accounting, legal, and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	International transfers outside the European Economic Area (‘EEA’) to the United States are envisaged, based on Standard Contractual Clauses.	Your data will be kept for the duration of your stay, including 2 months after its end for inventory closure, balance settlement and conclusion of the relationship..	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Maintenance of the passenger register.	Compliance with a legal obligation (Art. 6.1.c GDPR): RD 933/2021, of 26 October.	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for the duration of the visitor's stay at the residence. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.	N/A: not applicable
Management of claims, complaints and other requests.	The Company's legitimate interest in responding to complaints or requests received (Art. 6.1.f GDPR). In the event that the management of complaints or claims arises from compliance with Consumer and User regulations, the processing will be carried out on the basis of compliance with a legal obligation (Art. 6.1.c GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for the duration of the claim, complaint or request for information.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Video surveillance for disciplinary purposes.	Performance of the contractual relationship (Art. 6.1.b GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the European Economic Area are envisaged.	Your data will be kept: for 1 month from the date of collection when it does not reflect the commission of illegal acts. until its management and resolution when it reflects the commission of illegal acts.	Once the retention period has expired: • if the images do not show any illegal activity, they will not be subject to the blocking period. • if the images show illegal activity, they will be duly blocked for a period of 5 years, which is the limitation period for possible civil claims. All of the above is without prejudice to any deadlines that may apply for compliance with legal obligations as set out in this policy.
Video surveillance for security purposes.	The Company's legitimate interest in maintaining the security of its facilities and ensuring their proper functioning (Art. 6.1.f GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept: for 1 month from the date of collection when it does not reflect the commission of illegal acts. until its management and resolution when it reflects the commission of illegal acts.	Once the retention period has expired: if the images do not show any illegal activity, they will not be subject to the blocking period. if the images show illegal activity, they will be duly blocked for a period of 5 years, which is the limitation period for possible civil claims. All of the above is without prejudice to any deadlines that may apply for compliance with legal obligations as set out in this policy.
Recording of images of residents (capture and publication on social media and/or other media, as appropriate).	Consent of the data subject (Art. 6.1.a GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the areas of information technology, social media/digital communications management, and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for as long as necessary for the purpose of dissemination.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Retention of personal data when the Company has payment or collection obligations or obligations related to passenger registration in compliance with legal obligations.	Compliance with legal obligations (Art. 6.1.c GDPR) regarding the retention of information provided for in: Article 30 of the Commercial Code. Article 26 of the Corporation Tax Act. Article 5 of Royal Decree 933/2021, of 26 October.	No transfers to third parties are envisaged other than those indicated above.	Service providers in the areas of information technology and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged.	Your data will be kept for: a period of up to 6 years from the last entry made in the books (Art. 30 of the Commercial Code on the retention of information relating to business activity). a period of up to 10 years (Art. 26 LIS) from the end of the period established for filing the corporation tax return for the corresponding fiscal year in compliance with the legal retention obligations indicated above. a period of up to 3 years (Art. 5 RD 933/2021 on the retention of passenger registration data).	N/A: not applicable

3.5 If you access our premises subject to video surveillance.

Purpose of processing	Legal basis	Recipients	Processors	International Transfers	Pure conservation period	Blocking period
Video surveillance for security purposes.	The Company's legitimate interest in maintaining the security of its facilities and ensuring their proper functioning (Art. 6.1.f GDPR).	No transfers to third parties are envisaged other than those indicated above..	Service providers in the information technology, legal advice and regulatory compliance sectors of the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the European Economic Area (“EEA”) are expected to take place.	Your data will be kept: for 1 month from the date of collection when it does not reflect the commission of illegal acts. until its management and resolution when it reflects the commission of illegal acts.	Once the retention period has expired: if the images do not show any illegal activity, they will not be subject to the blocking period. if the images show illegal activity, they will be duly blocked for a period of 5 years, which is the limitation period for possible civil claims. All of the above is without prejudice to any deadlines that may apply for compliance with legal obligations as set out in this policy.
Management of claims, complaints, and other requests.	The Company's legitimate interest in maintaining the security of its facilities and ensuring their proper functioning (Art. 6.1.f GDPR). In the event that the management of complaints or claims arises from compliance with Consumer and User regulations, the processing will be carried out on the basis of compliance with a legal obligation (Art. 6.1.c GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the fields of information technology, technology consulting, and legal and regulatory compliance advice to the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged	Your data will be kept for the duration of the claim, complaint or request for information.	Once the pure retention period has expired, your data will be retained for 5 years, which is the limitation period for possible civil claims. This is without prejudice to any periods that may apply for compliance with legal obligations as set out in this policy.
Retention of personal data when the Company has payment or collection obligations in compliance with legal obligations.	The Company's legitimate interest in responding to complaints or requests received (Art. 6.1.f GDPR). In the event that the management of complaints or claims arises from compliance with Consumer and User regulations, the processing will be carried out on the basis of compliance with a legal obligation (Art. 6.1.c GDPR).	No transfers to third parties are envisaged other than those indicated above.	Service providers in the areas of information technology and legal and regulatory compliance for the Company may have access to your personal data, acting as data processors for the Company.	No international transfers of personal data outside the EEA are envisaged	Your data will be kept for a period of up to 6 years from the last entry made in the books (Art. 30 of the Commercial Code on the retention of information relating to business activity). a period of up to 10 years (Art. 26 LIS) from the end of the period established for filing the corporate tax return for the corresponding fiscal year in compliance with the legal retention obligations indicated above.	N/A: not applicable