/ amàre hotels

Privacy Policy and Remote Contracting

Your privacy matters to us

At FUERTEGROUP, S.L., hereinafter referred to as AMARE HOTELS, as the responsible entity for this website, we want to provide you with the highest legal guarantees regarding your privacy and explain as clearly and transparently as possible everything related to the processing of personal information on this website. This privacy policy was last updated on 29/09/2026 (AMARE HOTELS reserves the right to modify this policy to adapt it to legislative developments or industry practices, informing you of any changes and their date).

This Privacy Policy is intended as an additional layer of information beyond that requested through other means and is valid for personal data obtained on the Website. It does not apply to information collected by third parties on other websites, even if these are linked to the Website.

AMARE HOTELS has adapted this website to comply with the requirements of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and also complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons (GDPR), as well as Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSICE).

For matters relating to Amàre Cancún, the applicable Mexican legislation is observed, namely the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

Who is responsible for your data?

Company name: FUERTEGROUP, S.L. (AMARE HOTELS), jointly responsible for processing, together with the hotel where you are staying. In the flight + hotel section there is an independent data controller.
CIF/NIF: B-92120237
Registered in the Malaga Commercial Register in Volume 2500, Book 1413, folio 132, Section 8, Sheet MA-40981
Email: [email protected]
Phone: +34 917 941 284
Data Protection Officer: [email protected]
Registered address: Severo Ochoa, 28, 9º A, 29603 Marbella (Málaga).

And the hotel where you are staying, whose details can be found in the Legal Notice on this website.

How did we obtain your data?

The personal data processed at AMARE HOTELS are never particularly sensitive, except to cover special needs of accommodated customers. In addition to the data processed as part of our business operations, such as data from customers, suppliers, and staff, we also process data obtained from:

Contact form: Name, Email, phone number, and message.
Reservation form: Name, Email, phone number, reservation dates, credit card details, and connection data.
Flight + hotel: Independent and successive data controller.
Friends Club: Membership number.
Honors (Hilton) Amare Cancún: Membership number.

For what purpose do we process your personal data?

At AMARE HOTELS, we process the information provided by interested parties for the following purposes:

Contact. To get in touch with you to respond to your message, using the email address or other contact means provided, including instant messaging if you consent.
To manage the hotel accommodation service, payment, and related informative, administrative, accounting, and tax management.
Other purposes for which we process your personal data include:
To provide personalized contractual accommodation services at the hotel where you stay and at the central office of Fuertegroup, as well as any other requests you make (golf, events, spa, transfer, etc.). Personal data will be processed for billing purposes and, if necessary, for appropriate collection management. Also, for conducting quality surveys and courtesy communications (e.g., birthdays or special events with gifts).
To manage special needs and intolerances with your consent.
To comply with various legal obligations, including communication to law enforcement agencies (daily traveler registration).
To ensure the security of the facilities and communicate with competent public authorities in case of detecting a possible infraction. For employees, data may also be used for labor control and logistics management.
To send you information and advertising about group services related to accommodation, leisure, dining, and real estate, by any means (mail, SMS, phone, letter, etc.) with your consent. You can revoke your consent at any time by sending an email to [email protected].
For the Friends Club, for loyalty purposes, to analyze and monitor your stays, personalize services according to your preferences, and send you information and advertising about group services related to accommodation, leisure, dining, and real estate.
For customers who have confirmed their reservation, data will be processed for customer knowledge and preference surveys, including health data to adequately meet your accommodation and catering needs.
To promote the group’s accommodation and leisure services on the company’s digital platforms (social networks, website, etc.), including the publication of images of hotels and their activities with your consent or anonymously.
To manage the hotel’s free Wi-Fi system, data may only be used in case of detecting a possible infraction or if required by competent public authorities.
To ensure compliance with the terms of use and applicable laws. This may include the development of tools and algorithms that help this website ensure the confidentiality of the personal data it collects.
To support and improve the services offered by this website.
We also collect non-identifying data obtained through some cookies that are downloaded to the user’s computer when browsing this website, as detailed in the cookie policy.

AMARE HOTELS does not sell, rent, or transfer personal data that can identify the user to third parties without prior consent. As a user or customer, you are solely responsible for the accuracy and correctness of the data you provide, exonerating AMARE HOTELS from any responsibility in this regard. The user guarantees and is responsible for the accuracy, validity, and authenticity of the personal data provided, committing to keep them properly updated.

Acceptance and consent: The User declares to have been informed about the conditions regarding personal data protection, accepting and consenting to the processing of such data by AMARE HOTELS in the manner and for the purposes indicated in this privacy policy.

How long will we keep your data?

If you are a customer of AMARE HOTELS, your data will be kept for the duration of the contractual relationship. Once the contract is completed, AMARE HOTELS will keep your personal data blocked for the legally required prescription periods.

If the data were provided through our contact forms or the contact email, they will be kept until the reason for their collection ends.

If the data is based on consent, it will be retained until the consent is revoked.

Data related to legal obligations will be kept for the legally established periods.

In any case, we will retain your data to comply with applicable legal requirements, prevent unlawful actions, resolve disputes, and for other actions permitted by law. Once your data is no longer needed, we will delete and/or block it in accordance with our data retention and deletion policy and the legal prescription periods according to current regulations. After these periods, we will destroy your data.

What is the legal basis for processing your data?

The legal basis for processing your data as a user who contacts us through our forms is your consent. The same applies to the Friends Club loyalty system. The legal basis for sending commercial communications is consent. If you are a customer, the legal basis for processing your data is our contractual relationship. Communication to public authorities is performed under legal obligation. Video surveillance is based on the fulfillment of a public interest mission. Revocability: The consent given can be revoked at any time by communicating it to AMARE HOTELS as established in this Policy for the exercise of rights. Revocation will not have retroactive effects.

Browsing

When browsing the website, non-identifiable data may be collected, which may include IP addresses, approximate geographic location, a record of how our services and sites are used, and other data that cannot be used to identify the user. Non-identifiable data also includes browsing habits through third-party services detailed in the Cookies section. We use this information to analyze trends, administer the site, track user movements around the site, and gather demographic information about our user base as a whole.

Data confidentiality and security

AMARE HOTELS is committed to using and processing the personal data of users, respecting their confidentiality and using them according to the purpose for which they were collected, as well as complying with its obligation to safeguard them and adapt all measures to prevent their alteration, loss, processing, or unauthorized access, in accordance with the current data protection regulations. It is not possible to guarantee absolute invulnerability of the Internet and, therefore, the violation of data through fraudulent access by third parties, but we have taken the appropriate measures to prevent it as much as possible.

Confidentiality of processing: AMARE HOTELS will ensure that any person authorized by our company to process Customer, candidate, subscriber, or User Data (including its staff, collaborators, and providers) will be under an appropriate confidentiality obligation (whether contractual or legal).

Response to a security incident: In the event of a Security Incident with a scope or impact contemplated by regulations, AMARE HOTELS must notify the Customer or User without undue delay and must provide timely information related to the Security Incident and/or the measures taken.

Who will your data be communicated to?

To our external service providers for website management or to meet your external service requests, and generally for the purpose of performing these functions on behalf of AMARE HOTELS. And to the competent public authorities to comply with legal obligations. The AMARE HOTELS website may provide access to other websites, including official profiles of AMARE HOTELS on social networks or flight+hotel reservations, informing you that by clicking on such links, you will be redirected to a page for which AMARE HOTELS is not responsible. You should be aware that the owners of these external websites to AMARE HOTELS may collect, use, or transfer your Personal Data under different conditions and terms, recommending that when you contact one of these Websites, you inform yourself about their privacy policy, general terms of use, or the use they may make of their cookies as we cannot control how these Websites use the personal information you disclose. AMARE HOTELS informs you that it will carry out processing assignments to third parties in accordance with the GDPR, requiring the processor to comply with all data protection guarantees. All utilities offered by third parties are strictly necessary for the development of our services and have been selected based on compliance with the rights we preserve on this website. We inform you that your personal data may be communicated to recipients located in countries outside the European Economic Area; however, in these cases, our provider will be subject to agreements that comply with European and Spanish legislation. Specifically, services from:

Analytics services (Google Analytics): a web analytics service provided by Google, Inc., a Delaware company whose main office is located at 1600 Amphitheatre Parkway, Mountain View (California), CA 94043, United States (“Google”). Google Analytics uses “cookies,” which are text files placed on your computer, to help AMARE HOTELS analyze how users use the website: user preferences, demographic characteristics, or traffic patterns. The information generated by the cookie about your use of www.amarehotels.com (including your IP address) will be transmitted to and stored by Google on servers in the United States. More information in the Cookies section. To develop our web activity, AMARE HOTELS uses the following providers under their respective privacy conditions.
Hosting: Ibermática, DataRush, or Raiola Networks, depending on the group’s website.
Web platform: org. It processes data for the purpose of providing its website support services. You can consult its privacy policy at: https://wordpress.org/

There are other companies that provide direct services to AMARE HOTELS (consulting, IT, legal, data protection, etc.) that may have access to the personal information necessary to perform their service functions as data processors, but they may not use it for other purposes and must always comply with applicable data protection legislation.

What are your rights when you provide us with your data?

You can exercise your rights granted by the GDPR free of charge before AMARE HOTELS, namely, your rights of access, rectification, deletion, opposition, portability, and limitation by any means that allows you to prove the sending and receiving of your request. The request must be addressed to AMARE HOTELS, through the details included in the “Data Controller” section or to the email account [email protected], indicating the reference “Data Protection”. The request must include: Name, surname(s), and proof of identity, the specific request being made, and an address for notifications. You can file a complaint with the supervisory authority, in this case, the Spanish Data Protection Agency (www.aepd.es), if you believe that the processing of personal data concerning you violates the Regulation.

What are the conditions of remote contracting?

What specific provisions apply to Amàre Cancún Curio by Hilton under Mexican personal data protection legislation?

PURPOSE, SCOPE AND PRECEDENCE

This Appendix applies to personal data collected in connection with Amàre Cancún and takes precedence over the main body of this Policy in the event of any conflict, contradiction or difference concerning processing carried out in Mexico. The provisions of the main body of this Policy concerning data retention, recipients and processors, third-party websites, cookies and Google Analytics, hosting, WordPress, security, confidentiality and distance contracting apply in Mexico, subject to the clarifications set out in this Appendix.

IDENTITY AND ADDRESS OF THE DATA CONTROLLERS

The data controllers responsible for collecting and processing personal data are FUERTEGROUP, S.L. (Amàre Hotels), whose registered address is Avenida Severo Ochoa 28, 9º A, 29603 Marbella, Málaga, Spain, and PUENTE CALINDA, S. DE R.L. DE C.V., whose registered address is Boulevard Kukulcán Km 4.5, Manzana 34, lote 3.C, Sección C, Colonia Zona Hotelera, Cancún, Quintana Roo, postcode 77500, Mexico. Both act as joint controllers with equal responsibility. Full identification and contact details are available in the Legal Notice.

For bookings made through Hilton channels, participation in Hilton Honors loyalty programmes, quality surveys, marketing communications or complaints submitted directly to Hilton, HILTON WORLDWIDE HOLDINGS INC. will be the data controller for those purposes, and its privacy notice will apply. This is available at https://www.hilton.com/es/p/global-privacy-statement/.

This Appendix applies to all other processing of personal data carried out by the Data Controllers in Mexico concerning guests, visitors and users, including their representatives and contact persons. For job applicants and staff, the privacy policy is available on the “Política de Privacidad – RH Fuerte Group” webpage. For suppliers and service providers, the privacy policy is set out in the pre-contractual relationship with the hotel and in the service agreements.

III. PERSONAL DATA TO BE PROCESSED, INCLUDING THE IDENTIFICATION OF SENSITIVE DATA

Guests, visitors and users.

Full name, contact details (email address and telephone number), CURP, passport number, date of birth, age, nationality and address.
Sensitive personal data: health information provided by the individual to whom the personal data relates (the “Data Subject”) concerning special dietary requirements, allergies or intolerances. Processing this information requires express consent.
Financial or asset-related data, including the number, expiry date and security code of the credit or debit card used to pay for and invoice services provided at the hotel. Processing this information requires express consent.
Images captured by CCTV cameras and access control records.

PURPOSES OF PERSONAL DATA PROCESSING

In Mexico, the Data Controllers process personal data for the following purposes, according to the category of Data Subject. Primary purposes are necessary for the relevant legal relationship, while secondary purposes are subject to consent where required.

Primary purposes.

Guests, visitors and users.

The same purposes indicated above in relation to accommodation, additional services, payment management, accounting, special requirements, CCTV and Wi-Fi services.
Compliance with legal obligations, including recording guests’ identity details and providing information through the Plataforma Única de Identidad.

Secondary purposes by category.

Guests, visitors and users.

Supporting and improving website services and analysing non-identifying data through cookies.

OPTIONS AND MEANS FOR LIMITING THE USE OR DISCLOSURE OF PERSONAL DATA

The mechanisms set out in this section apply equally to guests, visitors and users. To limit the use or disclosure of the personal data provided, or to withdraw consent given to the Data Controllers, the Data Subject must submit a request by email to [email protected].

MECHANISMS, MEANS AND PROCEDURES FOR EXERCISING THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION (“ARCO RIGHTS”)

The mechanisms set out in this section apply equally to guests, visitors and users, including their representatives and contact persons where these are natural persons. Under Articles 21, 27, 28, 29, 30, 31, 32, 33 and 34 of the Law (LFPDPPP), the Data Subject may exercise their rights of access, rectification, cancellation and objection (“ARCO rights”) free of charge. Requests will be handled by FUERTEGROUP, S.L. and PUENTE CALINDA, S. DE R.L. DE C.V., via [email protected] or [email protected] and/or at the hotel address indicated above.

The request must be sent to either of these email addresses with “Protección de Datos” as the reference and must include the Data Subject’s name and address or another means of receiving notifications, documents proving the Data Subject’s identity or, where applicable, their representative’s authority and identity, a clear and precise description of the personal data in relation to which an ARCO right is to be exercised, unless the request concerns the right of access, a description of the ARCO right to be exercised or of the Data Subject’s request, and any other information or document that may help locate the personal data.

The responsible party will notify the Data Subject of its decision within a maximum of twenty days from receipt of the request. If the request is granted, the relevant measures will be implemented within fifteen days of the date on which the response is communicated. These periods may be extended once, for an equal period, where the circumstances justify it.

To exercise the right of access, the identity of the Data Subject or their legal representative must first be verified. To exercise the right of rectification, the Data Subject must also specify the changes requested, explain the reasons for them and provide supporting documentation.

VII. MEANS OF COLLECTING PERSONAL DATA

Guests, visitors and users.

In person: when the Data Subject visits or registers at the hotel premises, uses its services or participates in events.
Directly: when the Data Subject provides their data through the contact form, email, telephone, social media, messaging services, Wi-Fi or other channels made available by the Data Controllers.
Indirectly: when data is provided by travel agencies, booking platforms, event organisers, publicly accessible sources or another source permitted by law. If services are booked through an intermediary, that intermediary will act as an independent data controller, and the Data Subject must consult its privacy notice.

VIII. TRANSFERS OF PERSONAL DATA

The transfers and disclosures described in the section “To whom will your data be disclosed?” apply in Mexico to processing subject to this Appendix, including those made to competent public authorities, external providers and Google Inc. through Google Analytics. Recipients may be located in Mexico, Spain, the United States of America or other countries where the providers used to operate the website or provide the requested services are based. The Data Controllers may grant access to data to processors acting on their behalf and in accordance with their instructions, including providers of website management and support, hosting, IT services, legal advice, data protection, analytics and other necessary services. These processors may only process data to provide the contracted services and may not use it for their own purposes or for purposes other than those specified by the Data Controllers.

Guests, visitors and users.

Transfers may be made to competent public authorities, external providers and other recipients necessary to provide the services covered by this Appendix, as well as to Google Inc. through Google Analytics, in accordance with their respective policies and applicable legislation.

Transfers made in the circumstances set out in Article 37 of the Law will not require consent. These include transfers necessary to comply with legal obligations or requests from competent authorities, provide contracted services, safeguard a public interest or the interests of the Data Subject, or exercise and defend rights. Transfers to intermediaries acting as independent data controllers will be governed by their own privacy notices.

CHANGES TO THE PRIVACY NOTICE

If this Policy or this Appendix is amended, the Data Controllers will notify the Data Subject of the changes in print, electronically, through the Amàre Hotels website or by any other means.

COMPETENT AUTHORITY IN MEXICO

In addition to the Spanish Data Protection Agency, the Data Subject may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno, the competent authority for the protection of personal data held by private parties, to submit any complaints or reports provided for under applicable legislation.

ACCEPTANCE AND CONSENT

The Data Subject acknowledges having read this Appendix and understands that processing their personal data is necessary to establish and maintain the relationship with the Data Controllers. The Data Subject also authorises the processing and use of their personal data in accordance with this Policy and this Appendix throughout the legal relationship with the Data Controllers and subsequently under the terms of applicable legislation, where processing is necessary for the continuation of their activities and fulfilment of their corporate purpose. Processing sensitive personal data and financial or asset-related data, as well as transfers requiring consent under the Law, is subject to the Data Subject’s express consent as set out below.

Privacy Policy and Remote Contracting

Susanne Rose