Legal information

Legal Notice

1. Identifying data

In compliance with Article 10 of Law 34/2002 on Information Society and Electronic Commerce Services (LSSI-CE), the following information is provided:

• Company name: Ryan's Coral S.L.
• VAT Number / Tax ID ES B13855739
• Address: C/ Jaume I s/n, 2 – Edificio Odysseus, 07817 Sant Jordi de ses Salines, Ibiza, Spain
• Contact email: info@coralstarhotel.com
• Telephone: (+34) 971 343 250
• Domain: coralstarhotel.com

2. Object and scope

This Legal Notice regulates the use of the website coralstarhotel.com (hereinafter, «the Website»), owned by Ryans Coral S.L. Access to and use of the Website confers the status of user and implies full acceptance of the conditions included in this Legal Notice.

The website features a AI-powered chatbot. Its use is additionally governed by the provisions of the «Information on the use of Artificial Intelligence» section of this document.

3. Access and usage conditions

The user undertakes to use the Website and its content in accordance with the law, morality, and public order, refraining from using them in a manner contrary to this Legal Notice, harmful to the rights of third parties, or which in any way may damage, render useless, or overload the Website or impede its normal use.

In particular, and in relation to the virtual assistant, the user refrains from:

• Entering personal data relating to third parties without their consent, as well as special categories of data (health, religion, sexual orientation, biometric data or other data referred to in Article 9 of the GDPR).
• Enter your bank or credit card details. The wizard does not process payments under any circumstances.
• Using the assistant for unlawful, fraudulent or offensive purposes, or to generate content that contravenes current legislation.
• Use automated tools (bots, scraping or similar) to interact with the assistant on a large scale, or to attempt to extract, replicate or circumvent its instructions and security measures.

Ryans Coral S.L. may modify, without prior notice, the content of the Website, as well as its configuration and presentation.

4. Intellectual and industrial property

All content on the website (texts, images, trademarks, logos, designs, source code, etc.) is the property of Ryans Coral S.L. or third parties who have authorised its use, and is protected by intellectual and industrial property regulations. Reproduction, distribution, or transformation without express authorisation is prohibited.

5. Exclusion of warranties and liability

Ryans Coral S.L. does not guarantee the continuous availability of the Website or the absence of errors in its content, although it will take the necessary measures for their correction. Ryans Coral S.L. is not responsible for damages resulting from the misuse of the Website or the content of linked sites not managed by it.

Regarding the virtual assistant: The responses generated by the artificial intelligence system are for information and guidance purposes only. Despite the control measures in place, these responses may contain inaccuracies or be out of date, and therefore do not constitute a binding offer nor do they replace official information published on the website, the terms and conditions of the booking engine or the booking confirmation sent in writing. In the event of any discrepancy, the information contained in the booking confirmation and the terms and conditions shall always take precedence.

6. Links

The Web may include links to third-party sites. Ryans Coral S.L. does not assume any responsibility for the content, operation, or availability of such sites.

7. Applicable legislation and jurisdiction

These terms and conditions are governed by Spanish law. For the resolution of any dispute, the parties submit to the courts and tribunals of Ibiza, waiving any other jurisdiction to which they might be entitled. This is without prejudice to any mandatory jurisdiction applicable to users who are consumers.

8. Online dispute resolution

In accordance with Regulation (EU) No 524/2013, the following link to the European Union's online dispute resolution platform is made available to the user/consumer: https://ec.europa.eu/consumers/odr/

Privacy Policy

1. Data controller

• Person responsible: Ryan's Coral S.L.
• VAT Number / Tax ID ES B13855739
• Address: C/ Jaume I s/n, 2 – Edificio Odysseus, 07817 Sant Jordi de ses Salines, Ibiza, Spain
• Contact details for data protection enquiries: info@coralstarhotel.com

The appointment of a Data Protection Officer (DPO) is not mandatory, in accordance with Article 37 of the GDPR, given the nature and volume of the processing carried out.

2. Purposes of processing

• Manage room and extra service bookings, and the contractual relationship with the client.
• To manage the collection of payments and the prevention of fraud in relation to payments made via the website.
• Handle enquiries, contact requests and job applications.
• To respond to enquiries submitted via the AI-powered virtual assistant and, where the user voluntarily provides them after accepting this notice, to collect their contact details in order to follow up on their request.
• Record and review conversations held with the virtual assistant in order to monitor service quality, identify and rectify errors, and improve the wizard’s settings.
• Send commercial communications (newsletters, offers) only if the user has given express consent.
• Develop web usage statistics and improve its functionality (analytical cookies, subject to consent).
• To display personalised advertising and measure the performance of advertising campaigns, provided the user has accepted advertising/behavioural cookies.

3. Legal basis

Legal bases for processing

Treatment	Legal basis (Article 6 of the GDPR)
Reservation management and the provision of hotel services	Performance of a contract (Art. 6.1(b))
Payment management and fraud prevention	Performance of a contract and legitimate interests (Articles 6(1)(b) and 6(1)(f))
Enquiries handled via online forms or the virtual assistant	Consent of the data subject or the implementation of pre-contractual measures (Articles 6(1)(a) and 6(1)(b))
Recording and internal review of conversations for quality control and error correction	Legitimate interest of the data controller in ensuring the quality and security of the service (Article 6(1)(f))
Sending marketing communications and newsletters	Consent of the data subject (Article 6(1)(a))
Analytical and advertising cookies	Consent of the data subject (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE)
Invoicing, tourism regulations and citizen security regulations	Compliance with a legal obligation (Art. 6.1.c)

4. Retention period

The data will be retained for as long as the contractual relationship is maintained or until consent is revoked, and subsequently for the legal limitation periods for liability. In particular:

• Booking and billing details: during the term of the relationship and, subsequently, for the applicable periods of tax and commercial statute of limitations.
• CVs received: a maximum of one year, unless otherwise indicated by the data subject.
• Conversations held with the virtual assistant and contact details provided through it: four (4) years from the date of the conversation. This period corresponds to the general limitation period for actions arising from the relationship with the user and the need to prove the consent given and the content of the information provided, in the event of a complaint. Once this period has elapsed, the conversations are deleted or irreversibly anonymised.
• Data entered into the CRM system for the purpose of sending marketing communications: until the user revokes their consent or requests to unsubscribe.

5. Recipients and data processors

The data may be communicated to the following categories of recipients, for the exclusive purpose of managing the reservation, the website and the contracted services. With all providers who process data on behalf of Ryans Coral S.L., the corresponding Data processing agreements in accordance with Article 28 of the GDPR.

Recipients and suppliers

Recipient	Purpose	Condition
Neobookings	Booking engine: online reservation and cookie consent banner management	Data controller
Payment gateway provider	Payment processing and fraud prevention for web-based bookings	Data controller / person responsible, depending on the processing operation
HighLevel Inc. (Go High Level / LeadConnector)	Virtual assistant widget, and platform for recording and managing generated conversations and contacts	Data controller
Anthropic PBC	Language model that generates the virtual assistant's responses	Data processor
Revinate LLC	Hotel CRM. Receive data only from users who have consented to receiving marketing communications	Data controller
Google Ireland Ltd.	Web analytics (Google Analytics, Google Tag Manager) and advertising (Google Ads)	Manager / co-manager, depending on the department
Meta Platforms Ireland Ltd.	Measurement and advertising on Facebook and Instagram (Meta Pixel)	Joint data controller
Sojern Inc.	Advertising and remarketing in the travel sector	Joint data controller
Group companies	Internal administrative management: Ocean & Ryans Management S.L., Eijo S.A., Trenela Investments S.L., White Land Investments S.L., Cesa 2012 S.L., Ryans La Marina S.L., Ryans Lola's S.L.	Legitimate interest (Recital 48 of the GDPR)
Public authorities and law enforcement agencies	Compliance with legal obligations (tourism regulations, guest registration, tax obligations)	Legal obligation

Analytics and advertising providers only receive data if the user has given their prior consent the relevant cookies.

6. International data transfers

The main Web and booking engine servers are hosted in the European Economic Area or in countries that have an adequacy decision from the European Commission, and data processing agreements have been entered into with entities established in the European Economic Area whenever the provider has them in place. However, some of the technology providers used—specifically the conversation management and CRM platform, the language model provider, and the advertising providers—may involve international data transfers, primarily to the United States.

Such transfers are carried out in accordance with Chapter V of the GDPR, applying the following appropriate safeguards:

• Adequacy decisions, in particular the EU-U.S. Data Privacy Framework, regarding the certified suppliers within that framework.
• Standard Contractual Clauses (SCC) approved by the European Commission, supplemented where necessary by additional technical and organisational measures following the relevant data transfer impact assessment.

The user can request information on the applied guarantees and, where applicable, a copy of them, by writing to info@coralstarhotel.com.

7. Rights of data subjects

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated individual decisions, as well as to withdraw your given consent at any time, by writing to C/ Jaume I s/n, 2 – Edificio Odysseus, 07817 Sant Jordi de ses Salines, Ibiza, Spain, or by email to info@coralstarhotel.com, indicating «DATA PROTECTION» in the subject line and attaching a copy of a document proving your identity.

Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Furthermore, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.esit is considered that the treatment does not comply with current regulations.

8. Automated decision-making and profiling

The virtual assistant generates responses automatically, but it does not adopt decisions that produce legal effects on the user or significantly affect them in a similar way within the meaning of Article 22 of the GDPR. Confirmation of a booking, the application of rates and any decision with contractual effects are carried out via the booking engine and, where appropriate, with human intervention.

If the user has accepted advertising cookies, profiling is carried out for marketing purposes, consisting of audience segmentation to display advertising tailored to their interests. The user may object at any time by withdrawing their consent from the cookie settings panel.

9. Safety measures

Ryans Coral S.L. has adopted the technical and organisational measures necessary to guarantee the security and integrity of personal data and to prevent its alteration, loss, processing or unauthorised access, including the encryption of communications, role-based access control and the minimisation of the data processed by the virtual assistant.

10. Updates

This Privacy Policy may be amended to adapt to legislative changes or changes in data processing. Periodic review is recommended.

Information on the use of Artificial Intelligence

In compliance with Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence, and Articles 13 and 22 of the GDPR, the user is informed of the following.

You are interacting with an artificial intelligence system

The website features a automated conversational assistant. The responses you receive are generated by an artificial intelligence system and not by a natural person. This condition is also clearly indicated on the assistant’s interface itself before the conversation begins.

2. Purpose of the assistant

The assistant is designed to answer queries about accommodation, services, facilities, location and general conditions of the establishment, guide the user through the booking process and, when the user requests or expressly accepts, collect their contact details so that the hotel team can follow up. The assistant is available in all the languages in which the website is published.

3. Technology used

The assistant has been configured by Ryans Coral S.L. and is supported by two technology providers acting as data processor and sub-processor: the platform HighLevel Inc. (Go High Level / LeadConnector), which provides the chat interface and conversation logging, and Anthropic PBC, whose language model generates the responses.

4. Data processed via the assistant

• Content of the conversation: the messages the user writes and the generated responses.
• Contact details: name, email address and, where applicable, telephone number, only when the user provides them voluntarily after having been informed of and accepting this information.
• Technical specifications: session ID, date and time, language and the page from which the conversation begins.

Recommendation: Do not enter any unnecessary personal details, third-party details, bank or card details, or sensitive information relating to your health, beliefs or sexual orientation into the chat. The assistant does not require this information under any circumstances, and it must not be used to make payments.

5. Recording, retention and review of conversations

Conversations are recorded in the management platform used by Ryans Coral S.L. and are kept for four (4) years from the date of the conversation, for the reasons indicated in section 4 of the Privacy Policy.

Access to the conversations is Authorised personnel only belonging to Ryans Coral S.L., which can review them in order to monitor service quality, detect errors and improve the assistant's configuration. After this period, the conversations are deleted or irreversibly anonymised.

If the user has explicitly consented to receive commercial communications, their contact details are additionally incorporated into the group's CRM solely for that purpose.

6. Conversations are not used to train artificial intelligence models

The content of the conversations is used exclusively for the purposes described in the preceding section. Ryans Coral S.L. does not use conversations to train artificial intelligence models.

The technology providers involved in the provision of the service act as data processors and are bound by contracts entered into in accordance with Article 28 of the GDPR, which limit the processing of data to the documented instructions of the controller and the provision of the contracted services.

7. System limitations

Generative artificial intelligence systems can produce incomplete, outdated or incorrect responses. The information provided by the assistant is for guidance only and does not constitute a binding offer. The applicable conditions are, in any case, those published on the booking engine and those set out in the booking confirmation.

8. Right to human attention

The user may request at any time to be assisted by a member of the team. To do so, they simply need to indicate this within the conversation itself or contact directly at info@coralstarhotel.com or on the telephone (+34) 971 343 250.

9. Human oversight and excluded practices

The assistant operates under instructions and limits defined by Ryans Coral S.L., is restricted to the scope of hotel information and its responses are subject to periodic review. It is not used for emotion recognition, biometric categorisation, social scoring or any other prohibited or high-risk practice in accordance with Regulation (EU) 2024/1689.

Cookie Policy

What are cookies?

Cookies are small text files that are stored on your device when you visit the Web. They allow, among other things, to remember your preferences, analyse the use of the Web, and, where applicable, display advertising tailored to your interests.

This policy applies equally to other storage and tracking technologies of equivalent purposetracking pixels, tags and browser local storagelocal storage). In particular, this website uses local storage for the operation of the virtual assistant and for the Google advertising identifier (_gcl_ls), subject to the same consent regime as the cookies in its category.

2. Types of cookies used

• Technical and functional cookies (necessary): essential for the operation of the website, security, the booking process, the virtual assistant and the recording of your privacy preferences. They do not require consent.
• Analytical cookies: they allow the measurement and analysis of website usage.
• Marketing / advertising cookies: they are used for advertising, profiling and remarketing, and involve the transfer of data to the third parties identified in the table below.

3. Cookies used on this website

Analytical and marketing cookies They are only installed if you give your consent via the settings panel. Details of the cookies identified as of the date of this review are set out below, including the explicit third party with whom the data is shared.

3.1. Technical and functional cookies (do not require consent)

Cookie or identifier	Duration	Named / shared with	Purpose
neoCookieConsent	1 month	Neobookings	Registration and accreditation of user cookie preferences.
Booking engine cookies	Session / up to 1 year depending on configuration	Neobookings	Online booking process management.
v2_contact_session_* / v2_history_* / v2_session_history_* local storage	Session / persistent	HighLevel (LeadConnector)	Virtual assistant: chat session identification and maintenance of the conversation thread.
lead-connector-* local storage	Persistent	HighLevel (LeadConnector)	Virtual assistant: chat interface preferences and welcome message status.

3.2. Analytical cookies (require consent)

Cookie	Duration	Shared with	Purpose
_ga	1 year	Google Analytics	User discrimination and Web usage statistics.
_ga_NQ8P2TLCXH / _ga_5YYLF1DFMX / _ga_31CDV1HG2E / _ga_55R4E7R0TV	1 year	Google Analytics	Session state maintenance in GA4 properties.
_gid	1 day	Google Analytics	User differentiation.

3.3. Marketing and advertising cookies (require consent)

Cookie	Duration	Shared with	Purpose
_gcl_au / _gcl_aw / _gcl_gs	3 months	Google Ads	Conversion attribution and advertising campaign measurement.
_gcl_ls local storage	Persistent	Google Ads	Conversion attribution.
_fbp	3 months	Meta / Facebook	Campaign performance measurement and personalised advertising (Meta Pixel).
sjrn_ccid	1 year	Sojern	Advertising and remarketing specialised in the travel sector.

This list is reviewed periodically. If new analytics tools, marketing tools or third-party providers are added, the tables will be updated accordingly.

4. Consent Management

When accessing the website, a consent panel is displayed with the options «Accept», «Reject» and «Configure cookies», presented with the same level of visibility. You can modify your decision at any time via the «Cookie settings» link available in the footer, or revoke your consent by writing to the address indicated in section 6.

Additionally, you can configure your browser to block or delete installed cookies, although this may affect the proper provision of some services on the Web.

5. Technical consent architecture

The booking engine itself does not generate any non-essential cookies. All scripts capable of generating non-essential cookies are managed via Google Tag Manager (GTM), where each tag has the necessary consents associated with its activation.

The implemented model follows the standard Google Consent Mode v2. The consent management platform integrated into the web feeds the consent signals that GTM uses to decide whether or not to fire each tag (ad_storage, analytics_storage, ad user data, ad personalisation y storage functionality). Thus, non-essential cookies remain blocked until the user gives their consent.

6. Updates and contact

This Cookies Policy may be updated depending on the services and cookies used. For any queries or to revoke the consent given, you may write to info@coralstarhotel.com indicating «Cookie Policy» in the subject line.