Legal Notice
Legal information
Legal Notice
1. Identifying data
In compliance with Article 10 of Law 34/2002 on Information Society and Electronic Commerce Services (LSSI-CE), the following information is provided:
- Company name: Ocean & Ryans Management S.L.
- VAT Number / Tax ID B25616145
- Address: Carrer de Jaume I s/n, Odysseus Building, 07817 Sant Jordi, Ibiza, Spain
- Contact email: marketing@od-hotels.com
- Telephone: +34 971 591 214
- Domain: od-hotels.com
2. Object and scope
This Legal Notice governs the use of the website od-hotels.com (hereinafter «the Website»), which is owned by Ocean & Ryans Management S.L. Access to and use of the Website confers the status of user and implies full acceptance of the terms and conditions set out in this Legal Notice.
The website features a AI-powered chatbot. Its use is additionally governed by the provisions of the «Information on the use of Artificial Intelligence» section of this document.
3. Access and usage conditions
The user undertakes to use the Website and its content in accordance with the law, morality, and public order, refraining from using them in a manner contrary to this Legal Notice, harmful to the rights of third parties, or which in any way may damage, render useless, or overload the Website or impede its normal use.
In particular, and in relation to the virtual assistant, the user refrains from:
- Entering personal data relating to third parties without their consent, as well as special categories of data (health, religion, sexual orientation, biometric data or other data referred to in Article 9 of the GDPR).
- Enter your bank or credit card details. The wizard does not process payments under any circumstances.
- Using the assistant for unlawful, fraudulent or offensive purposes, or to generate content that contravenes current legislation.
- Use automated tools (bots, scraping or similar) to interact with the assistant on a large scale, or to attempt to extract, replicate or circumvent its instructions and security measures.
Ocean & Ryans Management S.L. may modify the content of the Website, as well as its configuration and presentation, without prior notice.
4. Intellectual and industrial property
All content on the Website (texts, images, brands, logos, designs, source code, etc.) is the property of Ocean & Ryans Management S.L. or third parties who have authorised its use, and is protected by intellectual and industrial property regulations. Reproduction, distribution or transformation without express authorisation is prohibited.
5. Exclusion of warranties and liability
Ocean & Ryans Management S.L. does not guarantee the continuous availability of the Website or the absence of errors in its content, although it will take the necessary steps for their correction. Ocean & Ryans Management S.L. is not responsible for damages resulting from the misuse of the Website or the content of linked sites not managed by it.
Regarding the virtual assistant: The responses generated by the artificial intelligence system are for information and guidance purposes only. Despite the control measures in place, these responses may contain inaccuracies or be out of date, and therefore do not constitute a binding offer nor do they replace official information published on the website, the terms and conditions of the booking engine or the booking confirmation sent in writing. In the event of any discrepancy, the information contained in the booking confirmation and the terms and conditions shall always take precedence.
6. Links
The Web may include links to third-party sites. Ocean & Ryans Management S.L. accepts no responsibility for the content, operation, or availability of such sites.
7. Applicable legislation and jurisdiction
These terms and conditions are governed by Spanish law. For the resolution of any dispute, the parties submit to the courts and tribunals of Ibiza, waiving any other jurisdiction to which they might be entitled. This is without prejudice to any mandatory jurisdiction applicable to users who are consumers.
8. Online dispute resolution
In accordance with Regulation (EU) No 524/2013, the following link to the European Union's online dispute resolution platform is made available to the user/consumer: https://ec.europa.eu/consumers/odr/
Privacy Policy
1. Data controller
- Person responsible: Ocean & Ryans Management S.L.
- VAT Number / Tax ID B25616145
- Address: Carrer de Jaume I s/n, Odysseus Building, 07817 Sant Jordi, Ibiza, Spain
- Contact details for data protection enquiries: marketing@od-hotels.com
The appointment of a Data Protection Officer (DPO) is not mandatory, in accordance with Article 37 of the GDPR, given the nature and volume of the processing carried out.
2. Purposes of processing
- Manage room and extra service bookings, and the contractual relationship with the client.
- To manage the collection of payments and the prevention of fraud in relation to payments made via the website.
- Handle enquiries, contact requests and job applications.
- To respond to enquiries submitted via the AI-powered virtual assistant and, where the user voluntarily provides them after accepting this notice, to collect their contact details in order to follow up on their request.
- Record and review conversations held with the virtual assistant in order to monitor service quality, identify and rectify errors, and improve the wizard’s settings.
- Send commercial communications (newsletters, offers) only if the user has given express consent.
- To compile website usage statistics, analyse browsing behaviour in aggregate form and personalise the presentation of content and rates, thereby improving the website’s performance (analytical and personalisation cookies, subject to consent).
- To display personalised advertising and measure the performance of advertising campaigns, provided the user has accepted advertising/behavioural cookies.
3. Legal basis
| Treatment | Legal basis (Article 6 of the GDPR) |
|---|---|
| Reservation management and the provision of hotel services | Performance of a contract (Art. 6.1(b)) |
| Payment management and fraud prevention | Performance of a contract and legitimate interests (Articles 6(1)(b) and 6(1)(f)) |
| Enquiries handled via online forms or the virtual assistant | Consent of the data subject or the implementation of pre-contractual measures (Articles 6(1)(a) and 6(1)(b)) |
| Recording and internal review of conversations for quality control and error correction | Legitimate interest of the data controller in ensuring the quality and security of the service (Article 6(1)(f)) |
| Sending marketing communications and newsletters | Consent of the data subject (Article 6(1)(a)) |
| Analytics, personalisation and advertising cookies | Consent of the data subject (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE) |
| Invoicing, tourism regulations and citizen security regulations | Compliance with a legal obligation (Art. 6.1.c) |
4. Retention period
The data will be retained for as long as the contractual relationship is maintained or until consent is revoked, and subsequently for the legal limitation periods for liability. In particular:
- Booking and billing details: during the term of the relationship and, subsequently, for the applicable periods of tax and commercial statute of limitations.
- CVs received: a maximum of one year, unless otherwise indicated by the data subject.
- Conversations held with the virtual assistant and contact details provided through it: four (4) years from the date of the conversation. This period corresponds to the general limitation period for actions arising from the relationship with the user and the need to prove the consent given and the content of the information provided, in the event of a complaint. Once this period has elapsed, the conversations are deleted or irreversibly anonymised.
- Data entered into the CRM system for the purpose of sending marketing communications: until the user revokes their consent or requests to unsubscribe.
5. Recipients and data processors
The data may be disclosed to the following categories of recipients, for the sole purpose of managing the booking, the website and the services contracted. The relevant agreements are entered into with all suppliers who process data on behalf of Ocean & Ryans Management S.L. Data processing agreements in accordance with Article 28 of the GDPR.
| Recipient | Purpose | Condition |
|---|---|---|
| Neobookings | Booking engine: online reservation and cookie consent banner management | Data controller |
| Stripe Payments Europe, Ltd. | Payment processing and fraud prevention | Data controller / person responsible, depending on the processing operation |
| HiJiffy | Conversational assistant currently integrated into the website | Data controller |
| HighLevel Inc. (Go High Level) | Platform for recording and managing the conversations and contacts generated by the virtual assistant | Data controller |
| Revinate LLC | Hotel CRM. Receive data only from users who have consented to receiving marketing communications | Data controller |
| The Hotels Network, S.L. | Content personalisation, price comparison and analysis of booking behaviour | Data controller |
| Google Ireland Ltd. | Web analytics (Google Analytics, Google Tag Manager) and advertising (Google Ads) | Manager / co-manager, depending on the department |
| Meta Platforms Ireland Ltd. | Measurement and advertising on Facebook and Instagram (Meta Pixel) | Joint data controller |
| Microsoft Ireland Operations Ltd. | Behavioural analytics (Microsoft Clarity) and advertising (Microsoft Ads) | Manager / co-manager, depending on the department |
| Sojern Inc. | Advertising and remarketing in the travel sector | Joint data controller |
| Cloudflare, Inc. | Security, automated traffic mitigation and content delivery | Data controller |
| Group companies | Internal administrative management: Eijo S.A., Trenela Investments S.L., White Land Investments S.L., Cesa 2012 S.L., Ryans La Marina S.L., Ryans Lola’s S.L., Ryans Coral S.L. | Legitimate interest (Recital 48 of the GDPR) |
| Public authorities and law enforcement agencies | Compliance with legal obligations (tourism regulations, guest registration, tax obligations) | Legal obligation |
Analytics, personalisation and advertising providers only receive data if the user has given their prior consent the relevant cookies.
6. International data transfers
The main Web and booking engine servers are hosted in the European Economic Area or in countries that have an adequacy decision from the European Commission, and data processing agreements have been concluded with entities established in the European Economic Area whenever the provider has them in place. However, some of the technological providers used —specifically analytics and advertising providers and, where applicable, the parent companies of conversation management and CRM platforms— may involve international data transfers, primarily to the United States.
Such transfers are carried out in accordance with Chapter V of the GDPR, applying the following appropriate safeguards:
- Adequacy decisions, in particular the EU-U.S. Data Privacy Framework, regarding the certified suppliers within that framework.
- Standard Contractual Clauses (SCC) approved by the European Commission, supplemented where necessary by additional technical and organisational measures following the relevant data transfer impact assessment.
The user can request information on the applied guarantees and, where applicable, a copy of them, by writing to marketing@od-hotels.com.
7. Rights of data subjects
You may exercise your rights of access, rectification, erasure, objection, restriction of processing, data portability and the right not to be subject to automated individual decision-making, as well as withdraw your consent at any time, by writing to C/ Jaume I s/n, Edificio Odysseus, 07817 Sant Jordi, Ibiza, Spain, or by email to marketing@od-hotels.com, indicating «DATA PROTECTION» in the subject line and attaching a copy of a document proving your identity.
Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Furthermore, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.esit is considered that the treatment does not comply with current regulations.
8. Automated decision-making and profiling
The virtual assistant generates responses automatically, but it does not adopt decisions that produce legal effects on the user or significantly affect them in a similar way within the meaning of Article 22 of the GDPR. Confirmation of a booking, the application of rates and any decision with contractual effects are carried out via the booking engine and, where appropriate, with human intervention.
If the user has accepted personalisation and advertising cookies, profiling is carried out for marketing and offer personalisation purposes, consisting of audience segmentation and the adaptation of content and messages based on browsing behaviour. The user may object at any time by withdrawing their consent from the cookie settings panel.
9. Safety measures
Ocean & Ryans Management S.L. has adopted the technical and organisational measures necessary to guarantee the security and integrity of personal data and to prevent its alteration, loss, processing or unauthorised access, including the encryption of communications, role-based access control and the minimisation of the data processed by the virtual assistant.
10. Updates
This Privacy Policy may be amended to adapt to legislative changes or changes in data processing. Periodic review is recommended.
Information on the use of Artificial Intelligence
In compliance with Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence, and Articles 13 and 22 of the GDPR, the user is informed of the following.
You are interacting with an artificial intelligence system
The website features a automated conversational assistant. The responses you receive are generated by an artificial intelligence system and not by a natural person. This condition is also clearly indicated on the assistant’s interface itself before the conversation begins.
2. Purpose of the assistant
The assistant is designed to resolve queries regarding accommodation, services, facilities, location and general conditions of the establishments, guide the user through the booking process and, when requested or expressly accepted by the user, collect their contact details so that the hotel team can follow up. The assistant is available in all languages in which the website is published.
3. Data processed via the wizard
- Content of the conversation: the messages the user writes and the generated responses.
- Contact details: name, email address and, where applicable, telephone number, only when the user provides them voluntarily after having been informed of and accepting this information.
- Technical specifications: session ID, date and time, language and the page from which the conversation begins.
Recommendation: Do not enter any unnecessary personal details, third-party details, bank or card details, or sensitive information relating to your health, beliefs or sexual orientation into the chat. The assistant does not require this information under any circumstances, and it must not be used to make payments.
4. Recording, retention and review of conversations
Conversations are recorded on the management platform used by Ocean & Ryans Management S.L. and are retained for four (4) years from the date of the conversation, for the reasons indicated in section 4 of the Privacy Policy.
Access to the conversations is restricted to authorised staff in the marketing department from Ocean & Ryans Management S.L., which may review them in order to monitor service quality, detect errors and improve the assistant's configuration. Once this period has elapsed, the conversations are deleted or irreversibly anonymised.
If the user has explicitly consented to receive commercial communications, their contact details are additionally incorporated into the group's CRM solely for that purpose.
5. Conversations are not used to train artificial intelligence models
The content of the conversations is used exclusively for the purposes described in the preceding section. Ocean & Ryans Management S.L. does not use conversations to train artificial intelligence models.
The technology providers involved in the provision of the service act as data processors and are bound by contracts entered into in accordance with Article 28 of the GDPR, which limit the processing of data to the documented instructions of the controller and the provision of the contracted services.
If in future a treatment with this purpose were to be envisaged, the user's express, specific and separate consent would be requested beforehand, and this information would be updated.
6. System limitations
Generative artificial intelligence systems can produce incomplete, outdated or incorrect responses. The information provided by the assistant is for guidance only and does not constitute a binding offer. The applicable conditions are, in any case, those published on the booking engine and those set out in the booking confirmation.
7. Right to human attention
The user may request at any time to be assisted by a member of the team. To do so, they simply need to indicate this within the conversation itself or contact directly at marketing@od-hotels.com or by telephone on +34 971 591 214.
8. Human oversight and excluded practices
The assistant operates under instructions and limits defined by Ocean & Ryans Management S.L., is restricted to the scope of hotel information, and its responses are subject to periodic review. It is not used for emotion recognition, biometric categorisation, social scoring or any other prohibited or high-risk practice in accordance with Regulation (EU) 2024/1689.
Cookie Policy
What are cookies?
Cookies are small text files that are stored on your device when you visit the Web. They allow, among other things, to remember your preferences, analyse the use of the Web, and, where applicable, display advertising tailored to your interests.
This policy applies equally to other storage and tracking technologies of equivalent purposetracking pixels, tags and browser local storagelocal storage). In particular, this website uses local storage for Microsoft Ads advertising identifiers (_uetsid, _uetvid), from Google (_gcl_ls) and from The Hotels Network (thn_id), subject to the same consent regime as cookies in their category.
2. Types of cookies used
- Technical and functional cookies (necessary): essential for the website to function, security, the booking process and the recording of your privacy preferences. They do not require consent.
- Analytical and personalisation cookies: they allow the measurement and analysis of website usage and the adaptation of the presentation of content and tariffs.
- Marketing / advertising cookies: they are used for advertising, profiling and remarketing, and involve the transfer of data to the third parties identified in the table below.
3. Cookies used on this website
Analytical, personalisation and marketing cookies They are only installed if you give your consent via the settings panel. Details of the cookies identified as of the date of this review are set out below, including the explicit third party with whom the data is shared.
| Cookie | Duration | Named / shared with | Purpose |
|---|---|---|---|
| PHPSESSID | Session | Holder | User session management. Essential. |
| XSRF-TOKEN | Session | Holder | Security: request forgery attack prevention. Essential. |
| neoCookieConsent | 1 month | Neobookings | Registration and accreditation of user cookie preferences. |
| OrigenAds | 1 month | Holder | Identification of the visit origin for correct booking attribution. |
| __stripe_mid | 1 year | Stripe | Fraud prevention in the payment process. |
| _cfuvid / _cf_bm | Session / 30 min | Cloudflare | Security and automated traffic (bot) mitigation. |
| wg_*_hj_web / wg_*_hj_ut / wg_*_hj_hm_mx | Session / up to 1 year depending on configuration | HiJiffy | Virtual assistant: maintenance of the conversation thread and widget preferences. |
| Booking engine cookies | Session / up to 1 year depending on configuration | Neobookings | Online booking process management. |
| Cookie | Duration | Shared with | Purpose |
|---|---|---|---|
| _ga | 1 year | Google Analytics | User differentiation and web usage statistics. |
| _ga_31CDV1HG2E / _ga_55R4E7R0TV / _ga_5YYLF1DFMX | 1 year | Google Analytics | Maintenance of session state in GA4 properties. |
| _gid | 1 day | Google Analytics | User differentiation. |
| _clck | 1 year | Microsoft Clarity | Persistent identifier for behavioural navigation analysis. |
| _clsk | 1 day | Microsoft Clarity | Grouping of page views within the same session. |
| thn_id local storage | Persistent | The Hotels Network | Visitor identification for content personalisation and price comparison. |
| Cookie | Duration | Shared with | Purpose |
|---|---|---|---|
| _fbp | 3 months | Meta / Facebook | Campaign performance measurement and personalised advertising (Meta Pixel). |
| _gcl_au / _gcl_aw / _gcl_gs | 3 months | Google Ads | Conversion attribution and advertising campaign measurement. |
| _uetsid (cookies and local storage) | 1 day | Microsoft Advertising | Conversion tracking and remarketing. |
| _uetvid (cookies and local storage) | 1 year | Microsoft Advertising | Visitor identification between sessions for remarketing. |
| sjrn_ccid | 1 year | Sojern | Advertising and remarketing specialised in the travel sector. |
| sbjs_current / sbjs_current_add / sbjs_first / sbjs_first_add / sbjs_migrations / sbjs_session / sbjs_udata | Session | Holder (Sourcebuster) | Traffic source attribution and campaign performance analysis. Data is not shared with third parties. |
This list is reviewed periodically. If new analytics tools, marketing tools or third-party suppliers are added, the tables will be updated accordingly.
4. Consent Management
When accessing the website, a consent panel is displayed with the options «Accept», «Reject» and «Configure cookies», presented with the same level of visibility. You can modify your decision at any time via the «Cookie settings» link available in the footer, or revoke your consent by writing to the address indicated in section 6.
Additionally, you can configure your browser to block or delete installed cookies, although this may affect the proper provision of some services on the Web.
5. Technical architecture of consent
The booking engine does not itself generate any non-essential cookies. All scripts capable of generating non-essential cookies are managed through Google Tag Manager (GTM)., where each tag has the necessary consents associated for its activation.
The implemented model follows the standard Google Consent Mode v2. The consent management platform integrated into the web feeds the consent signals that GTM uses to decide whether or not to fire each tag (ad_storage, analytics_storage, ad user data, ad personalisation y storage functionality). Thus, non-essential cookies remain blocked until the user gives their consent.
6. Updates and contact
This Cookies Policy may be updated depending on the services and cookies used. For any queries or to revoke the consent given, you may write to marketing@od-hotels.com indicating «Cookie Policy» in the subject line.