Privacy Policy and Data Protection

VISITTOO, S.L. is the owner of this website through the domain https://www.visittoo.com/.

This data protection policy governs the access and use of the products and services offered by VISITTOO, S.L. through the website and app.

Legislation

This privacy policy is adapted to current Spanish and European regulations on the protection of personal data on the Internet.

Identity of the data controller

The data controller is:

Company name: VISITTOO, S.L.

Tax ID (NIF): B13917760

Address: Carrer del Grau, 7, Local 8

Postal Code - City: 17310 Lloret de Mar

Phone: +34 722 33 98 94

E-mail: administracio@visittoo.com

Data Protection Officer (DPO)

The Data Protection Officer (DPO) is responsible for ensuring compliance with the data protection regulations to which VISITTOO, S.L. is subject. The user may contact the DPO designated by the data controller at: administracio@visittoo.com.

Personal Data Registry

In compliance with the GDPR and the LOPD-GDD, we inform you that personal data collected by VISITTOO, S.L. through the forms on its pages will be incorporated and processed in our files in order to facilitate, expedite and fulfil the commitments established between VISITTOO, S.L. and the user, or to respond to a request or enquiry.

Principles applicable to the processing of personal data

The processing of the user's personal data shall be subject to the following principles set out in Article 5 of the GDPR:

• Principle of lawfulness, fairness and transparency: the user's consent will be required at all times with fully transparent information about the purposes for which personal data is collected.
• Principle of purpose limitation: personal data shall be collected for specified, explicit and legitimate purposes.
• Principle of data minimisation: personal data collected shall be limited to what is strictly necessary.
• Principle of accuracy: personal data must be accurate and always up to date.
• Principle of storage limitation: personal data shall only be kept for as long as necessary for the purposes of processing.
• Principle of integrity and confidentiality: personal data shall be processed in a manner that ensures its security and confidentiality.
• Principle of accountability: the data controller shall be responsible for ensuring compliance with the above principles.

Categories of personal data

The categories of data processed by VISITTOO, S.L. are solely identifying data. In no case are special categories of personal data processed within the meaning of Article 9 of the GDPR.

Legal basis for the processing of personal data

The legal basis for the processing of personal data is consent. VISITTOO, S.L. undertakes to obtain the user's express and verifiable consent for the processing of their personal data for one or more specific purposes.

The user has the right to withdraw their consent at any time. As a general rule, the withdrawal of consent will not affect the use of the website.

Purposes of the processing of personal data

Personal data is collected and managed by VISITTOO, S.L. for the purpose of facilitating, expediting and fulfilling the commitments established between the website and the user, or to respond to a request or enquiry.

Data may also be used for commercial personalisation, operational and statistical purposes, as well as for data extraction, storage and marketing studies to adapt the content offered to the user and to improve the quality and operation of the website.

Personal data retention periods

Personal data will only be retained for the minimum time necessary for the purposes of processing and, in any case, only for a period of 4 years, or until the user requests its deletion.

Recipients of personal data

The user's personal data may be shared with the providers of products and services marketed on the website and app of VISITTOO, S.L.

Personal data of minors

In accordance with Articles 8 of the GDPR and 7 of Organic Law 3/2018, only persons over 14 years of age may give their consent for the lawful processing of their personal data. If the user is under 14 years of age, parental or guardian consent is required.

Confidentiality and security of personal data

VISITTOO, S.L. undertakes to adopt the necessary technical and organisational measures, according to the level of security appropriate to the risk, to ensure the security of personal data and prevent the accidental or unlawful destruction, loss or alteration of personal data.

Personal data shall be treated as confidential by the data controller, who undertakes to ensure that such confidentiality is respected by its employees, associates and any person to whom information is made accessible.

Rights derived from the processing of personal data

The user may exercise the following rights recognised in the GDPR against the data controller:

• Right of access: the right to obtain confirmation as to whether or not personal data is being processed and to obtain information about it.
• Right to rectification: the right to have inaccurate or incomplete personal data corrected.
• Right to erasure ("right to be forgotten"): the right to have personal data erased when it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing: the right to restrict the processing of personal data.
• Right to data portability: the right to receive personal data in a structured, commonly used and machine-readable format.
• Right to object: the right to object to the processing of personal data.

To exercise any of these rights, the user may contact: administracio@visittoo.com.

Complaints to the supervisory authority

If the user considers that there is a problem or breach of current regulations in the way their personal data is being processed, they have the right to effective judicial protection and to lodge a complaint with a supervisory authority. In Spain, the supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es).