MEASURES AND POLICIES FOR REGULATORY COMPLIANCE
PRIVACY POLICY
MALLORCA OUTDOOR SLU must ensure that the personal data of the data subject collected on the website is processed according to the principles related to processing:
- Processed lawfully, fairly, and transparently in relation to the data subject ("lawfulness, fairness, and transparency")
- Collected for specified, explicit, and legitimate purposes, and not processed in a manner incompatible with those purposes ("purpose limitation")
- Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization")
- Accurate and, if necessary, kept up to date, taking reasonable technical and organizational measures to ensure that inaccurate data are erased or rectified in relation to the purposes for which they are processed ("accuracy")
- Kept in a form that permits identification for no longer than necessary for the purposes of processing ("storage limitation")
- Processed in a manner that ensures appropriate security through the use of suitable technical and organizational measures ("integrity and confidentiality")
- Thus, MALLORCA OUTDOOR SLU will be responsible for complying with the above and must be able to demonstrate compliance ("accountability")
Similarly, the processing carried out by the entity will only be lawful if it meets at least one of the following conditions ("lawfulness of processing"):
- The data subject has given consent to the processing of their personal data for one or more specific purposes;
- Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract;
- Processing is necessary for compliance with a legal obligation to which the controller is subject;
- Processing is necessary to protect the vital interests of the data subject or of another natural person;
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly when the data subject is a child. This legitimate interest does not apply to processing carried out by public authorities in the exercise of their official duties. Where processing is based on the data subject's consent, the controller must be able to demonstrate that consent was given.
If consent is given in the context of a written declaration that also concerns other matters, the request for consent must be presented in a manner clearly distinguishable from the other matters, intelligible, easily accessible, and using clear and plain language.
The data subject has the right to withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data subject will be informed of this before giving consent. It shall be as easy to withdraw consent as to give it.
MALLORCA OUTDOOR SLU must include in the forms used to collect personal data the information required to fulfill the duty to inform under Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR).
In this regard, and to comply with applicable data protection regulations, when MALLORCA OUTDOOR SLU obtains personal data directly from a data subject, it must:
- Provide the identity and contact details of the Data Controller and, where applicable, its representative, the contact details of the Data Protection Officer (if any), the purposes of processing, and the legal basis for the processing.
- Specify the legitimate interests of the controller or a third party when processing is necessary for the purposes of those interests, provided such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
- Provide the recipients or categories of recipients of the personal data and, if applicable, the intention of the controller to transfer personal data to a third country or international organization, as well as the existence or absence of an adequacy decision by the Commission.
- Indicate the period for which personal data will be stored or the criteria used to determine that period.
- Inform about the right to request from the Data Controller access to personal data concerning the data subject, their rectification or erasure ("right to be forgotten"), restriction of processing, objection to processing, and data portability.
- Inform about the possibility of withdrawing consent at any time without affecting the lawfulness of processing based on prior consent, and inform the data subject of the right to lodge a complaint with a supervisory authority.
- Specify whether the provision of personal data is a legal or contractual requirement, or necessary to enter into a contract, and whether the data subject is obliged to provide the personal data, as well as the possible consequences of failing to provide such data.
- Inform about the existence of automated decision-making, including profiling, and, at least in such cases, provide information on the logic involved, as well as the significance and expected consequences of such processing for the data subject.
When MALLORCA OUTDOOR SLU does not obtain personal data directly from the data subject, it must provide the information described above, as well as the categories of personal data processed, the source from which they originate, and, if applicable, whether they come from publicly accessible sources. MALLORCA OUTDOOR SLU must include in the forms or documents used to collect personal data, including those on the MALLORCA OUTDOOR SLU website, the information required to comply with Articles 13 and 14 of the GDPR, and, if necessary, record the consent given by the data subject.
To reconcile the greater information requirements to be provided to the data subject whose personal data will be processed, a layered or tiered information model may be used, provided that the information is presented in clear, simple, concise, transparent, intelligible, and easily accessible language.
Article 11 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), regulates the basic information required in a first layer.
Layered information consists of:
- Presentation of Basic Information (1st layer): presenting basic information at a first level, in a summarized form, at the same time and through the same medium as the data collection.
- Reference to Additional Information (2nd layer): presenting detailed and complete information in an appropriate medium, structured, concise, and precise. The way this additional information is presented depends on the characteristics of the medium used to inform and can be provided on paper or electronically.
4.1.1. Basic Information for Website
| Basic Data Protection Information - Online Reservation Management | |
|---|---|
| Controller | MALLORCA OUTDOOR SLU |
| Purpose | Registration and management of online reservations |
| Rights | Access, rectify, and delete data, as well as other rights explained in the additional information. |
| Additional Information | You can consult detailed additional information on Data Protection on our website, under the Privacy Policy section. |
| Basic Data Protection Information - Marketing Actions via Web Form | |
|---|---|
| Controller | MALLORCA OUTDOOR SLU |
| Purpose | Collection, registration, and processing of data to respond to inquiries and/or requests, as well as for advertising and commercial prospecting. |
| Rights | Access, rectify, and delete data, as well as other rights explained in the additional information. |
| Additional Information | You can consult detailed additional information on Data Protection on our website, under the Privacy Policy section. |
| Basic Data Protection Information - Website User Management | |
|---|---|
| Controller | MALLORCA OUTDOOR SLU |
| Purpose | Collection, registration, and processing of user data |
| Rights | Access, rectify, and delete data, as well as other rights explained in the additional information. |
| Additional Information | You can consult detailed additional information on Data Protection on our website, under the Privacy Policy section. |
| Basic Data Protection Information - Cookies Installation | |
|---|---|
| Controller | MALLORCA OUTDOOR SLU |
| Purpose | Management and installation of cookies. |
| Rights | Access, rectify, and delete data, as well as other rights explained in the additional information. |
| Additional Information | You can consult detailed additional information on Data Protection on our website, under the Privacy Policy section. |
| Basic Data Protection Information - Web Form Management | |
|---|---|
| Controller | MALLORCA OUTDOOR SLU |
| Purpose | Respond to inquiries and/or requests. |
| Rights | Access, rectify, and delete data, as well as other rights explained in the additional information. |
| Additional Information | You can consult detailed additional information on Data Protection on our website, under the Privacy Policy section. |
4.1.2. Website Privacy Policy
PRIVACY POLICY OF www.outdooradventuresports.es
Website Owner Information:
| LEGAL NAME | MALLORCA OUTDOOR SLU |
| TAX ID | B44915973 |
| DOMAIN | https://www.outdooradventuresports.es/ |
| POSTAL ADDRESS | JOAN ROSSELLO DE SON FORTEZA 14 BAJO A, 07340 ALARO (ILLES BALEARS) |
| INFO@OUTDOORADVENTURESPORTS.ES | |
| PHONE | 650942362 |
| REGISTRATION / ADDITIONAL DATA |
Data Protection
In accordance with applicable personal data protection regulations, we inform you that your data will be included in the processing system owned by MALLORCA OUTDOOR SLU, with Tax ID B44915973 and registered office at JOAN ROSSELLO DE SON FORTEZA 14 BAJO A, 07340 ALARO (ILLES BALEARS). Below is information about the processing activities carried out:
Purpose: Respond to inquiries and/or requests.
Retention period: As long as consent is maintained.
Legal basis: Consent of the data subject.
Data type:
Basic data: Name and surname, Email address, IP address
| PROCESSES PERFORMED | |
|---|---|
| Online Reservation Management |
Purpose: Registration and management of online reservations. Retention period: Only for the period strictly necessary to fulfill the above purpose. Legal basis: Consent of the data subject. Data type: Basic data: Name and surname, Tax ID, Postal address, Email address, Financial or insurance data Transfers: Data will be communicated, if necessary, to the Tax Agency, Banks, Security Forces, and competent authorities to comply with applicable administrative and security obligations. The legal basis for the transfer is compliance with a law. |
| Marketing Actions via Web Form |
Purpose: Collection, registration, and processing of data to respond to inquiries and/or requests, as well as for advertising and commercial prospecting. Retention period: As long as consent is maintained, unless legal obligations require otherwise. Legal basis: Consent of the data subject. Data type: Basic data: Name and surname, Email address |
| Newsletter |
Purpose: Management of newsletter subscriptions for sending newsletters. Retention period: As long as consent is maintained. Legal basis: Consent of the data subject. Data type: Basic data: Name and surname, Email address |
| Website User Management |
Purpose: Collection, registration, and processing of user data. Retention period: As long as consent is maintained, unless legal obligations require otherwise. Legal basis: Consent of the data subject. Data type: Basic data: Name and surname, Email address |
| Cookies Installation |
Purpose: Management and installation of cookies. Retention period: As long as consent is maintained. Legal basis: Consent of the data subject. Data type: Basic data: Email address, IP address |
| Web Form Management |
Purpose: Respond to inquiries and/or requests. Retention period: As long as consent is maintained. Legal basis: Consent of the data subject. Data type: Basic data: Name and surname, Email address, IP address |
Data Subject Rights
MALLORCA OUTDOOR SLU informs users that they can exercise their rights of access, rectification, restriction, deletion, portability, objection to processing, and the right not to be subject to automated decisions, including profiling, with the Data Controller, as well as withdraw their consent.
- Right of Access: The right to obtain confirmation of whether personal data are being processed, and if so, the specific personal data processed and legal information about the processing (purposes, legal basis, retention period, transfers, source of data, etc.).
- Right of Rectification: The right to have inaccurate or incomplete data corrected. For the website, this only applies to information under the site’s control, e.g., removing comments, images, or web content containing personal data of the user.
- Right to Restrict Processing: The right to limit the purposes of processing originally intended by the controller in certain cases.
- Right to Erasure: The right to delete personal data, except as provided by GDPR (freedom of expression, legal obligations, formulation or defense of claims, etc.).
- Right to Data Portability: The right to receive personal data provided by the user in a structured, commonly used, machine-readable format and transmit it to another controller when processing is based on consent or contract and done automatically.
- Right to Object: The right to object to personal data processing or request it to stop, when processing is based on legitimate interest, public interest, or direct marketing.
- Right Not to Be Subject to Automated Decisions, including Profiling: When processing is not necessary for contract performance, not authorized by EU or Member State law, or not based on consent, the user has the right not to be subject to a decision based solely on automated processing with legal or significant effects.
- Right to Withdraw Consent: For any processing based on consent, the user may withdraw it at any time free of charge.
To exercise these rights, follow these instructions:
- Submit a written request to JOAN ROSSELLO DE SON FORTEZA 14 BAJO A, 07340 ALARO (ILLES BALEARS) (attention: MALLORCA OUTDOOR SLU) or via email to INFO@OUTDOORADVENTURESPORTS.ES.
- The written request must consider the following:
- Provide verifiable identification; if identity is in doubt, further information may be requested (e.g., ID number, ID copy, provided email).
- Requests may be made by a legal or voluntary representative, if properly identified and authorized by the data subject.
- Specify the right(s) you wish to exercise. If not specified, the response will cover all relevant processing. Telephone requests will be redirected to written submission.
- Include postal or email address for notifications.
- Provide supporting documents, if required.
- Use a method that allows proof of submission and receipt of the request.
Finally, you have the right to file a complaint with the Spanish Data Protection Agency if you believe any fact may constitute a breach of applicable data protection regulations.
MALLORCA OUTDOOR SLU commits to adopting necessary technical and organizational measures, in line with the risk level of the processing activities described above, to ensure integrity, confidentiality, and availability of personal data.
Last updated: September 11, 2024