SECTION 4: BETWEEN ROCKS AND WATERS, TRADITION, FLAVORS AND THERMAL BATHS

Basic information on Data Protection

Responsible

The Genuine Travel Experiences SL.

Objective

Online service provision.

Web user management.

Commercial communications related to our services.

Legitimation

Consentimiento expreso e interés legítimo.

Recipients

No se ceden datos a terceros, salvo obligación legal.

User Rights

Access, rectification, deletion and portability of your data, limitation, and opposition to its processing, as well as not being subject to decisions based solely on the automated processing of your data.

At The Genuine Travel Experience S.L., we work to offer you the best possible experience through our products and services. In some cases, it is necessary to collect information to achieve this. We care about your privacy and believe we should be transparent about it.

For this reason, and for the purposes of the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 of 2016 (hereinafter, “GDPR”) regarding the protection of natural persons with regard to data processing personal data and the free circulation of these data, and Law 34/2002, of July 11, on Information Society Services and electronic commerce (hereinafter, “LSSI”), The Genuine Travel Experience S.L. informs the user that, as data controller, it will incorporate the personal data provided by users into an automated file.

Our commitment begins by explaining the following to you:

• Your data is collected so that the user experience improves, considering your interests and needs.
• We are transparent about the data we collect about you and why we do it.
• Our intention is to offer you the best possible experience. Therefore, when we are going to use your personal information, we will always do so in compliance with the regulations and, when necessary, we will request your consent.
• We understand that your data belongs to you. Therefore, if you decide not to authorize us to process them, you can ask us to stop processing them.
• Our priority is to guarantee your security and process your data in accordance with European regulations.

If you want more information about the processing of your data, consult the different sections of the privacy policy below:

Who is responsible for the processing of your personal data?

Identity:                        The Genuine Travel Experience SL

Registered office:       calle  Mariá  Cubì, nº 10 – 7º-1ª 08006 Barcelona (Spain)

C.I.F. nº:                       B70643259

Email: support@thegenuinetravel.com

The Genuine Travel Experience SL has designated a contact person as the internal GDPR manager within your organization. If you wish to make a query regarding the processing of your personal data, you can contact him by email:    support@thegenuinetravel.com

What personal data do we collect?

The personal data that the user may provide:

-       Name and surname

-       Phone number

-       CIF/NIF

-       Business name

-       Bank data

-       Address and Zip

-       Email.

-       Location.

-       IP address, date and time in which you accessed our services, internet browser you use and data about the device’s operating system.

Comments about the service to be hired and needs.

In some cases, it is mandatory to complete the registration form to access and enjoy certain services offered on the website, in this case to be able to be a user of it; Therefore, failure to provide the requested personal data or failure to accept this data protection policy means it will be impossible to subscribe and/or register for our services..

Why and for what purpose do we process your data?

At The Genuine Travel Experience SL we process the information provided to us by interested parties for the following purposes:

• Manage and carry out the service contracted by the user, its billing and collection.

• Customer data may be used to carry out market studies (statistical reports), which allow expanding and improving the products or services of The Genuine Travel Experience SL. In any case, no personal data will be included in the statistical reports prepared.

• Manage the sending of the information requested from us, as well as any other query you may have that is not subject to the conditions of the website or the contracting of the service.

• Develop commercial actions and carry out the maintenance and management of the relationship with the user, as well as the management of the services offered through the website and information tasks and subsequent follow-up.

• In some cases it will be necessary to provide information to Authorities or third companies for audit reasons, as well as handle personal data from invoices, contracts and documents to respond to claims from clients or Public Administrations.

We inform you that the personal data obtained, because of your registration as a user, will form part of the Record of Activities and Processing operations where The Genuine Travel Experience SL. is the owner, which will be updated periodically in accordance with the provisions of the RGPD.

What is the legitimacy for the processing of your data?

The processing of your data may be based on the following legal bases:

• Consent to contract online services from the website through the contact form and therefore for the execution of a contract at the request of the interested party. (Art.6.1 b) GDPR. For the execution of the provision of the corresponding service, the delivery of the data is necessary since, otherwise, the requested services cannot be offered.

• Processing of customer data to carry out statistical reports (market studies) based on the legitimate interest of the company, which is considered prevalent, to the extent that no more data will be processed than those provided by users with the sole purpose of being able to improve with respect to the services offered by the entity. Additionally, the statistical reports will not contain personal data of the users, being anonymized.

• To be able to respond to your request or query and follow up after contracting the service. Providing the data is voluntary, although, if you do not do so, the request, query or claim cannot be responded to. Therefore, the communication of your personal data for these purposes is a necessary requirement so that we can respond to the requests made in this way.

• The prospective offer of products and services to clients is based on the satisfaction of the legitimate business interest consisting of being able to offer our clients the contracting of products or services and thus achieve their loyalty. In any case, the authorization to process your data for this purpose is voluntary and your refusal would only have the consequence of the fact that you would not receive commercial offers for our products or services. However, we remind you that you have the right to object to this processing of your data, and you may do so by any of the means described in this Policy.

• Legitimate interest in the processing of our clients’ data in direct marketing actions and express consent of the interested party for everything related to automatic assessments and profiling.

• Compliance with legal obligations for fraud prevention, communication with public authorities and claims from third parties.

How long do we keep your data?

The processing of data for the purposes described will continue for the time strictly necessary to comply with the commercial relationship with the client, as well as for compliance with the legal obligations arising from the processing of the data.

To which recipients are your data communicated?

In some cases, only when necessary, The Genuine Travel Experience SL will provide user data to third parties. However, data will never be sold to third parties. The external service providers with whom The Genuine Travel Experience SL works may use the data to provide the corresponding services, however, they will not use said information for their own purposes or for transfer to third parties.

The Genuine Travel Experience SL seeks to guarantee the security of personal data when sent outside the company and ensures that third-party service providers respect confidentiality and have appropriate measures to protect personal data. These third parties have the obligation to guarantee that the information is treated in accordance with data privacy regulations and in accordance with the provisions of Art.28 RGPD and Art.32.

In some cases, the law may require the disclosure of personal data to public bodies or other parties, only what is strictly necessary for compliance with such legal obligations.

The personal data obtained may also be shared with other companies in the group.

The Genuine Travel Experience SL as Data Processor, we have to inform that the owner of the personal data used and stored by the client within the framework of the services offered by the Website, are the property of the client acting as the sole person responsible for the data. . In this way, The Genuine Travel Experience SL acts as the person in charge of hosting this data. Therefore, it informs that it will not access or use this data, unless it is strictly necessary within the framework of the execution of the services and within the established technical and security limitations.

Therefore, The Genuine Travel Experience SL as a service provider will not resell this data or use it for personal purposes (such as data mining, profiling or direct marketing).

In what cases can The Genuine Travel Experience SL be forced to access the data stored and used by the client within the framework of the services?

The Genuine Travel Experience SL. You will only access this data under two circumstances:

• To guarantee the correct execution of the services and improve customer service when the latter contacts The Genuine Travel Experience SL support. In this case, access to customer data will be regulated by specific permissions and specific control and security measures.

• To comply with legal obligations within the framework of judicial and/or administrative requirements. These requirements are strictly regulated.

Access within the framework of The Genuine Travel Experience SL support:

When the client contacts The Genuine Travel Experience SL support, depending on the reason for the query, they can access two categories of data. On the one hand, with the aim of better responding to the client’s request, The Genuine Travel Experience SL support will access the information provided by the client when creating their The Genuine Travel Experience SL account (name, surname, telephone number, email ...).

On the other hand, exclusively at the express request of the client and subject to the technical limitations of each service, The Genuine Travel Experience SL support can access the data stored by the client in its services with the aim of identifying the origin of a problem and, where appropriate, solve it.

Access within the framework of the request of a judicial or administrative authority:

To comply with current regulations, The Genuine Travel Experience SL is obliged to respond to requests from judicial or administrative authorities. These data access requests are governed by a strict legal framework, so The Genuine Travel Experience SL only authorizes them once it has verified their validity and foundation. Furthermore, if the request or the Law does not prevent it, The Genuine Travel Experience SL undertakes to inform the client of said request as soon as possible. Applications from a third country will only be processed when they are based on an international agreement, such as a judicial cooperation treaty in force between the requesting country and the European Union or a Member State.

Where is your data stored?

Generally, data is stored within the EU. The data that is sent to third parties that do not belong to the EU, we will ensure that they guarantee a sufficient level of protection, by having Binding Corporate Rules (BCR). You can consult the list of these countries on the European Commission website. Thanks to the guarantees offered by The Genuine Travel Experience SL regarding data transfer, the client can comply with its regulatory obligations. Article 45 of the GDPR, which specifies cases of "transfers based on an adequacy decision", establishes that a transfer of personal data may take place to a third country or international organization when the Commission has decided that the third country, a territory or one or more specific sectors of that third country, or the international organization concerned, guarantee an adequate level of protection. Such transfer will not require any specific authorization.

Call recording

Calls may be recorded to process your requests or respond to your queries, as well as to evaluate and improve the responses offered by our agents and analyze the decisions made based on said responses.

Your data will be processed on the basis of the legitimate interest of the entity, this being prevalent due to the need to have instruments to be able to assess and improve the quality of the responses we offer and the decisions you make based on them. Also to increase security and have a means of accreditation of the services or products requested and those offered by us, being necessary to record the calls.

The recording will be kept for a minimum period of 12 months, and in any case until your request has been processed or your query has been answered. In the event that new data is collected by telephone as a result of a claim, contract, change of product or service, etc. The recording will be kept as proof of the data collection as long as some type of legal responsibility arising from the relationship maintained may arise. The information relating to the evaluation of the decisions made by users based on the answers provided is maintained for a period of 12 months.

Processing of personal contact data for commercial calls

Sometimes, The Genuine Travel Experience SL processes professional contact data that it obtains from the Internet to contact interested parties by telephone and try to close a commercial meeting with them or offer them services or products.

Taking into account the above, said treatment is based on the provisions of Art. 6.1.f) of the RGPD (legitimate interest), given that, in any case, the following premises are met:

a) The processing refers only to the data necessary for the professional location of the interested party.

b) The purpose of the treatment is to maintain relationships of any kind with the legal entity in which the affected person provides their services.

The same presumption operates for the processing of data relating to individual entrepreneurs and liberal professionals, when it refers to them only in that capacity and is not processed to establish a relationship with them as natural persons. In any case, interested parties may object to their processing at any of the contact addresses of The Genuine Travel Experience SL, as it is not mandatory for the entity to carry out such processing. The data will be kept for the indicated purpose indefinitely, unless the interested party objects, in which case, it will be deleted.

What rights do you have and how can you exercise them?

You can direct your communications and exercise your rights by making a request to the following email: support@thegenuinetravel.com

Under the provisions of the RGPD you can request:

• Right of access: you can request information about the personal data that we have about you.

• Right to rectification: you can communicate any change in your personal data.

• Right to deletion and to be forgotten: you can request deletion after blocking personal data.

• Right to limit processing: implies the restriction of the processing of personal data.

• Right to object: you can withdraw your consent to the processing of the data, opposing further processing.

• Right to portability: in some cases, you can request a copy of personal data in a structured, commonly used, and machine-readable format for transmission to another controller.

• Right not to be subject to individualized decisions: you can request that decisions not be made that are based solely on automated processing, including profiling, that produce legal effects or significantly affect the interested party.

In some cases, the request may be rejected if you request that data necessary to comply with legal obligations be deleted.

Likewise, if you have any complaint about the processing of your data, you can submit a claim to the data protection authority: www.aepd.es.

Who is responsible for the accuracy and veracity of the data provided?

The user is solely responsible for the veracity and correctness of the data included, exonerating The Genuine Travel Experience SL of any responsibility in this regard. Users guarantee and are responsible, in any case, for the accuracy, validity and authenticity of the personal data provided, and undertake to keep it duly updated. The user agrees to provide complete and correct information in the registration or subscription form. The Genuine Travel Experience SL reserves the right to terminate the contracted services that have been concluded with users, in the event that the data provided is false, incomplete, inaccurate or not updated.

The Genuine Travel Experience SL is not responsible for the veracity of information that is not its own creation and for which another source is indicated, and therefore does not assume any responsibility for hypothetical damages that may arise from the use of said information.

The Genuine Travel Experience SL reserves the right to update, modify or delete the information contained on its web pages, and may even limit or not allow access to said information. The Genuine Travel Experience SL is exonerated from liability for any damage or harm that the user may suffer as a result of errors, defects or omissions in the information provided by The Genuine Travel Experience SL provided that it comes from sources other than the same.

What security measures do we apply to protect your personal data?

The Genuine Travel Experience SL has adopted the security levels of protection of Personal Data legally required, and seeks to install other means and additional technical measures at its disposal to avoid loss, misuse, alteration, unauthorized access and theft of the data. Personal Data provided to The Genuine Travel Experience SL The Genuine Travel Experience SL is not responsible for hypothetical damages or losses that may arise from interferences, omissions, interruptions, computer viruses, telephone breakdowns or disconnections in the operational functioning of this electronic system, caused by for reasons beyond the control of The Genuine Travel Experience SL. of delays or blockages in the use of this electronic system caused by deficiencies or overloads of telephone lines or overloads in the Data Processing Center, in the Internet system or in other electronic systems, as well as damages that may be caused by third parties people through illegitimate interference beyond the control of The Genuine Travel Experience SL However, the user must be aware that security measures on the Internet are not impregnable, given that no online service can guarantee absolute security.

Links to other websites

On the website www.thegenuinetravelexperience.com, there may be links to other web pages. By clicking on one of these links and accessing an external website, the visit will be subject to the privacy policy of said website, leaving The Genuine Travel Experience SL. disassociated from any type of responsibility regarding its privacy policy. It will only be liable for those redirections or links under the domain and ownership of the The Genuine Travel Experience SL group of companies.

Can the privacy policy be modified?

We may modify the Privacy Policy from time to time. Visit this page regularly to know the current situation. We will indicate the dates of the last revisions of this Privacy Policy at the bottom of that page; all revisions will take effect upon publication.