PRIVACY POLICY OF MAJOR SPORTS CRUISES, S.L.
The purpose of this Privacy Policy is to inform Users about the different processing carried out by this organization and affecting their personal data in accordance with the provisions of the Organic Law 3/2018 of December 5, 2018, on the Protection of Personal Data and guarantee of digital rights and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and any regulations that develop or replace it.
WHO IS THE DATA CONTROLLER?
In terms of data protection, MAJOR SPORT CRUISES SL must be considered Data Controller, in relation to the processing of personal data carried out by this entity.
The following are the contact details of of the Data Controller:
WHAT PERSONAL DATA WE PROCESS?
All information collected by MAJOR SPORT CRUISES SL will be treated fairly, lawfully and transparently.
Likewise, the data requested in each of the processing carried out will consist only of those strictly necessary to carry out the intended purpose and informed in each case.
Furthermore, the data collected will be updated whenever necessary.
In general terms, within the framework of the various processing activities carried out in the organization, the following types of data are collected:
WHERE THE PERSONAL DATA COMES FROM?
As a general rule, personal data is always collected directly from the data subject, however, in certain exceptions, data may be collected through third parties, entities or services other than the data subject.
In this sense, the interested party will be informed of this fact through the information clauses contained in the different information collection channels and within a reasonable period of time or in the first communication made to the interested party.
FOR WHAT PURPOSE WE PROCESS PERSONAL DATA?
In general terms, personal data are processed for the following purposes:
By means of these treatments, profiles of the navigators of our web page are elaborated, in order to make automated decisions based on the logic described in this same privacy policy.
WHAT IS THE LEGITIMACY FOR DATA PROCESSING?
As a general rule, the data subject’s consent is the legal basis for the processing of data in accordance with the purposes described above. This consent is manifested by a declaration or a clear affirmative action, such as ticking a box provided for this purpose, voluntary subscription or by sending data through the forms. This consent may be revoked at any time by contacting the company through its means of contact and, in general, we will request your consent for uses for purposes other than those for which you initially granted it.
Specifically, and for the processing indicated below, the following legitimate bases are used:
TREATMENT(S). Compliance with legal and regulatory obligations: By way of example and not limitation. General Law for the Defense of Consumers and Users, Information Society Services Law, General Tax Law, Corporate Tax Law, Account Auditing Law, Value Added Tax Law, Civil Code, Commercial Code, as well as the existence of a specific law or regulation authorizing or requiring the processing of the data subject’s data, which shall be set forth in the corresponding informative clause.
TRATAMIENT(S). Execution of a contract: for the previous management of a contracted service or product, development of the execution of a contract or subsequent transactions derived from such operations.
TREATMENT (S). Legitimate interest: the processing of data based on the legitimate interest of the data controller, will be established, mainly, for sending communications or commercial events on products or services similar to those contracted. According to article 21.2 of the Law of Services of the Information Society, this treatment will only be valid when, being a customer, has not expressly refused at the time of data collection or in any of the communications we make.
HOW LONG WE KEEP PERSONAL DATA?
In general, personal data is processed for the time necessary to fulfill the purpose for which it was collected, for as long as the service or contractual relationship is maintained, there is a mutual interest and/or for the time provided for in the relevant regulations.
Once the established time criteria have been met, the data will be cancelled. Such cancellation will result in the blocking of the data being kept only at the disposal of the Public Administrations, Judges and Courts, to meet the possible liabilities arising from the treatment, during the period of limitation
WITH WHOM WE SHARE PERSONAL DATA?
To fulfill the purposes described above, personal data may be shared with:
DO WE MAKE INTERNATIONAL DATA TRANSFERS?
We also inform you of the transfer of data outside the European Economic Area to INDICATE, based on the existence of adequate safeguards in accordance with the GDPR and being these guarantees available to anyone who expressly requests them at dataprotection@majorsportscruises.com.
Specifically, the following guarantees are established:
The country or countries to which the data are transferred have been declared adequate level(s) of protection by the European Commission.
There is a legally binding and enforceable instrument between public authorities or agencies.
The transfer is made between group companies to which the data controller belongs and which have approved, by the competent supervisory authority, binding corporate rules in accordance with artIcle 47 of GDPR.
A document of standard contractual data protection clauses adopted by the Commission or a supervisory authority has been signed. (art. 93.2 GDPR).
The controller adheres to a code of conduct approved in accordance with Article 40 of the GDPR, together with binding and enforceable commitments in the third country to implement appropriate safeguards, including those relating to data subject’s rights.
The controller has been certified in accordance with certification mechanisms approved pursuant to article 42 of the GDPR, together with binding and enforceable commitments in the third country to implement appropriate safeguards, including those relating to the rights of data subjects.
The transfer has been authorized by the Spanish Data Protection Agency in accordance with article 42 of the Organic Law 3/2018 of December 5, 2018, on Personal Data Protection and guarantee of digital rights.
The international transfer is subject to one of the exceptions set out in art. 49 of GDPR.
WHAT RIGHTS YOU CAN EXERCISE?
According to European regulations, your rights are as follows:
Right of Access, the right to request information from a data controller as to whether his or her personal data is being processed
Right of Rectification, the right to request the amendment of inaccurate or incomplete data.
Right of Opposition, the right of an individual to object to the processing of his or her personal data or the cessation of such processing.
Right against automated individual decisions, the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects on him or her or significantly affects him or her in a similar way
Right of Limitation, the right to suspend the processing of the user’s personal data in certain cases
Right of Deletion or Forgetting, the right to erasure of the data subject’s personal data
Right of Portability, the right to request the data controller to provide personal data in a structured and clear format to another data controller.
Right to lodge a complaint with the competent supervisory authority if you consider that the processing does not comply with the regulations in force.
HOW TO EXERCISE YOUR RIGHTS?
The applicant may exercise his rights through the following means:
In both cases, if necessary, documentation may be required to prove the identity of the applicant.
In any case, you may request the protection of the Spanish Data Protection Agency through its website.
In this regard, your request will be dealt with as soon as possible and taking into account the deadlines provided for in the regulations on data protection.
WHAT THE CONSEQUENCES OF NOT PROVIDING THE INFORMATION COULD BE?
The data requested in the fields marked with an asterisk, or identified as mandatory, or those provided in the media where the information is provided, are those strictly necessary in relation to the purpose for which they are collected, or for the provision of an optimal service to the person concerned or through a legal obligation imposed on the data controller or a necessary requirement to enter into a contract, being voluntary the inclusion of data in the remaining fields.
If not all data are provided, there is no guarantee that the information and services provided will be completely tailored to your needs.
Therefore, in the event that the required data is not provided or is provided incorrectly or incompletely, we will not be able to attend your request, making it impossible to provide you with the requested information or to carry out the contracting of the services.
In the same way, the user guarantees that the information transmitted in any of the forms is truthful, accurate and corresponds to his own data.
The services of our platforms are not intended for minors, so only the registration of persons over 18 years of age is allowed, otherwise we warn that any liability that may arise as a result of the use of our Platforms will be borne by the parents or guardians of the minor. To avoid the use of our services by minors, we try to verify the age of our users when they formalize their registration by requesting their date of birth.
HOW PROFILING IS PERFORMED?
MAJOR SPORT CRUISES SL may develop a commercial profile based on the information provided by the person concerned and the interactions of this with the content offered in order to send personalized information about our products or services, including by electronic means. The legitimate basis of profiling is the legitimate interest of MAJOR SPORT CRUISES SL to know the profile of the person concerned in their communications and services to provide personalized information and content tailored to their interests and activity. No automated decisions will be made based on this profile. The User may at any time object to the profiling of their information through the channel provided for that purpose.
WHAT SECURITY MEASURES WE HAVE IN PLACE?
The security measures adopted by MAJOR SPORT CRUISES SL are those required, in accordance with the provisions of article 32 of the GDPR.
In this sense, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, have established the appropriate technical and organizational measures to ensure the level of security appropriate to the existing risk.In any case, MAJOR SPORT CRUISES SL has implemented sufficient mechanisms to:
CHANGES TO THIS PRIVACY POLICY
From time to time, this Privacy Policy may be revised in order to update changes in current legislation, update the procedures for collecting and using personal information, the emergence of new services or the exclusion of others. These changes will be effective upon their publication on the web, so it is important that you regularly review this Privacy Policy in order to remain informed about the changes.
