1.Data controller
In compliance with Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), the user is informed that the controller responsible for the processing of their personal data is:
- Company name
- Aloraturiaventur, S.L.
- Tax ID (CIF)
- B93425239
- Registered address
- Calle Alegría, 4, 29500 Álora, Málaga, España
- Phone
- +34 951 20 47 83
- Website
- www.aloratur.com
- Registration number
- 1/2015/16682
- NACE code
- 7912 – Actividades de los operadores turísticos
Registration details: Registered with the Commercial Registry of Málaga, on 1 September 2015, Volume 5433, Book 4340, Folio 190, Section 8, Sheet MA-129898, 1st Entry.
Hereinafter, Áloratur, Aloraturiaventur, S.L., we or the controller.
This Privacy Policy explains how we collect, use, store, disclose and protect the personal data obtained through our website, booking processes, communications and the provision of our tourism services.
2.What personal data may we process?
The data we process will depend on the relationship you have with Áloratur and on the service requested or contracted.
We may process the following categories:
Identification data
Name and surname(s).
When necessary for the contracting or provision of certain services, other identification data or documentation may be processed to verify age, identity, nationality or access requirements.
Contact data
Email address.
Phone number.
Postal address, when necessary.
Data related to bookings and tourism services
Activity or service contracted.
Date of the activity.
Number of participants.
Language.
Meeting or pick-up point.
Information necessary to manage the contracted service.
References, locators or booking codes.
Requests, preferences or incidents communicated by the client.
Financial and transactional data
Information relating to the booking amount, payment status, refunds, invoicing and operations related to the contracting.
When payment is made through external payment service providers, Áloratur does not need to access the complete bank card data, which will be processed by the corresponding payment provider in accordance with its own terms and security obligations.
Communications data
Information provided through:
- Website forms.
- Email.
- Phone.
- WhatsApp.
- Customer service.
- Booking platforms.
- Partner agencies.
- Chat or digital assistants enabled on the website.
We may retain the content of such communications when necessary to handle an inquiry, manage a booking, resolve an incident, evidence instructions or defend rights and claims.
Technical and browsing data
IP address.
Device type.
Browser.
Operating system.
Information on browsing and interaction with the website.
Identifiers derived from cookies and similar technologies when the user has authorized their use.
Detailed information on these technologies is available in our Cookie Policy.
3.Special categories of data
As a general rule, Áloratur does not request special categories of personal data such as racial or ethnic origin, political opinions, religion, trade union membership, genetic data, biometric data or information relating to sex life or sexual orientation.
However, due to the nature of certain tourism activities, the client may voluntarily provide us with information relating to:
- Food allergies or intolerances.
- Mobility or accessibility.
- Physical conditions relevant to the activity.
- Other health-related information whose disclosure is necessary to adapt or safely provide the service.
This data will only be processed when necessary and where a valid legal basis exists, applying the reinforced safeguards provided for under data protection regulations.
We do not request medical information from the user that is not necessary to manage or adapt the service.
4.How do we obtain your data?
We may obtain your personal data directly from the data subject when they:
- Make a booking on our website.
- Request information.
- Use a form.
- Contact us by email.
- Contact us by phone.
- Contact us via WhatsApp.
- Contact us through our customer service systems.
- Interact with chat systems or digital assistants enabled on our channels.
- Request an invoice.
- Submit a complaint or incident.
We may also receive data from third parties when the user has contracted our services through:
- Travel agencies.
- Tour operators.
- Activity marketing and booking platforms.
- Partner agencies.
- Other legitimate distributors of our services.
In such cases, we will only receive the data necessary to manage the booking and correctly provide the contracted service.
Likewise, certain technical data may be obtained automatically through cookies and similar technologies, in accordance with our Cookie Policy.
5.For what purposes do we process your data and what is the legal basis?
Handling requests for information and inquiries
We use your data to handle requests received through forms, phone, email, WhatsApp or other service channels.
The legal basis will be the application of pre-contractual measures requested by the data subject or, depending on the nature of the inquiry, our legitimate interest in adequately handling the requests received.
Managing bookings and providing our services
We process your data to:
- Create and manage bookings.
- Confirm activities.
- Organize groups.
- Manage meeting and pick-up points.
- Assign services and guides.
- Manage transport.
- Provide information necessary to take part in an activity.
- Communicate schedule changes, weather conditions, incidents or service modifications.
- Manage cancellations, modifications and refunds.
- Provide assistance before, during and after the activity.
The legal basis is the performance of the contract or the application of pre-contractual measures requested by the client.
Managing payments, invoicing and administrative obligations
Data may be processed to manage payments, refunds, invoices and to comply with tax, accounting, commercial and administrative obligations.
The legal basis will be the performance of the contract and compliance with legal obligations.
Customer service and management of incidents and complaints
We may use information related to bookings and communications to resolve queries, incidents, complaints and requests.
The legal basis will be the performance of the contract, compliance with legal obligations and, where applicable, our legitimate interest in properly managing our services and defending our rights.
Communications necessary in relation to a booking
We may communicate with the client by email, phone, SMS, WhatsApp or other means provided by the data subject when necessary to manage the contracted service.
These communications may include:
- Booking confirmations.
- Schedules.
- Meeting points.
- Operational changes.
- Weather notices.
- Necessary documentation.
- Incidents.
- Essential information for the proper provision of the activity.
When these communications are necessary to provide the contracted service, their legal basis will be the performance of the contract.
Commercial communications
We may send commercial information about our own products, services, experiences or offers:
- When the user has given their consent, or
- when a prior contractual relationship exists and the legally established requirements for informing about similar own products or services previously contracted are met.
The user may object to or unsubscribe from these communications at any time, easily and free of charge.
We will not use operational messages necessary for a booking as a means to send advertising unrelated to the purpose of that communication.
Compliance with legal obligations and defense of rights
We may retain or process certain data when necessary to comply with legal obligations, respond to requirements from public bodies, authorities, courts and tribunals, or formulate, exercise or defend claims.
6.WhatsApp
Áloratur may use WhatsApp as a communication channel with clients.
When necessary for the proper performance of a booking, we may use the number provided by the client to communicate information relating to the contracted service.
Among other matters, we may provide information on:
- Confirmations.
- Schedules.
- Meeting points.
- Last-minute changes.
- Incidents.
- Operational information.
- Assistance during an excursion.
When the communication is necessary to manage a booking or provide a service requested by the client, the processing will be based on the performance of the contractual relationship.
Commercial communications by WhatsApp will be handled separately and will only be sent when the corresponding legal basis exists.
WhatsApp is a service provided by a third party and has its own terms and privacy policies.
7.Commercial communications and advertising
When the user expressly authorizes the sending of commercial communications, we may send information about Áloratur's activities, products, services, promotions and news.
Likewise, when a prior contractual relationship exists, we may send commercial information about own products or services similar to those contracted, always within the limits established by applicable legislation.
All electronic commercial communications will offer a simple and free mechanism to object to future communications.
The user may request at any time to stop receiving commercial communications by writing to:
Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal.
8.To whom may we disclose your data?
As a general rule, we will not sell or transfer your personal data to third parties for commercial purposes.
Access to the data may be granted to those providers we need in order to carry out our activity and provide the contracted services.
Among others, the following may be involved:
- Web hosting and IT service providers.
- Booking system providers.
- Email providers.
- Messaging and communications service providers.
- Payment gateway and payment system providers.
- Technology platforms.
- Customer service providers.
- Analytics providers, provided the corresponding legal basis exists.
- Accounting, tax, legal and financial advisors.
- Insurance companies.
- Carriers, guides, collaborators and tourism providers when necessary to perform the service.
- Agencies, booking platforms and distributors when involved in the booking.
- Providers of digital tools, automation or technological assistance used to manage our services.
These providers will process the data in accordance with the applicable contractual and legal obligations.
We may also disclose information to public administrations, authorities, law enforcement bodies, judges and courts when there is a legal obligation or a legitimate requirement to do so.
9.International data transfers
Some of our technology providers may be established outside the European Economic Area or use infrastructure located in third countries.
When this involves an international transfer of personal data, Áloratur will endeavor to carry it out through one of the mechanisms provided for under the GDPR, such as:
- An adequacy decision of the European Commission.
- Standard Contractual Clauses approved by the European Commission.
- Binding corporate rules.
- Other appropriate safeguards provided for by law.
When necessary, the user may request additional information about the applicable safeguards by writing to:
11.How long will we retain your data?
Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected.
It may subsequently be kept duly blocked for the periods necessary to address legal obligations and any liabilities arising from the processing.
As a general rule:
Data related to bookings and contracts
Retained for as long as the provision of the service is necessary and subsequently for the periods established by commercial, tax and other applicable legislation.
Invoicing and accounting documentation data
Retained for the periods required by tax, accounting and commercial regulations.
Inquiries without contracting
Retained for the time reasonably necessary to address the request and, subsequently, for the period necessary to address possible liabilities.
Commercial communications
Data will be retained until the data subject withdraws their consent, requests to unsubscribe or exercises their right to object, without prejudice to our ability to retain the minimum information necessary to evidence such request and prevent further communications.
Data obtained through cookies
Retained for the periods indicated in our Cookie Policy.
12.Minors
Minors under the age of 14 must not provide their personal data directly through our forms or digital channels without the authorization of their parents or legal guardians, when such authorization is required.
When the processing is based on consent and the data subject is under 14 years of age, the consent of the holder of parental authority or guardianship will be required, in accordance with Spanish regulations.
This data protection rule is independent from the minimum ages established to take part in certain tourism activities, which will be specifically indicated for each product.
If we detect that data of a minor has been collected in breach of these requirements, we will take reasonable measures to delete or regularize it.
13.Rights of data subjects
The user may exercise the rights recognized under data protection regulations.
In particular, they may request:
Right of access
To know whether we are processing your data and obtain information about such processing.
Right of rectification
To request the correction of inaccurate or incomplete data.
Right of erasure
To request the deletion of your data when the legally established requirements are met.
Right to restriction of processing
To request that we restrict the processing of your data in the cases provided for by law.
Right to object
To object to certain processing carried out on the basis of legitimate interest or for direct marketing purposes.
Right to data portability
To receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller.
Withdrawal of consent
When the processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out previously.
To exercise these rights, you may write to:
or send a written request to:
Aloraturiaventur, S.L. Calle Alegría, 4 29500 Álora Málaga, España
The request must allow us to properly identify the data subject and determine which right they wish to exercise.
We may only request additional information to verify identity when there are reasonable doubts about the identity of the person making the request.
We will respond to requests within the time limits established by applicable regulations.
14.Right to lodge a complaint with the Spanish Data Protection Agency
If you believe that the processing of your personal data violates applicable regulations or that we have not properly addressed the exercise of your rights, you have the right to lodge a complaint with the:
Spanish Data Protection Agency (AEPD) www.aepd.es
However, we would appreciate it if, before lodging a complaint, you allowed us to try to resolve any issue by contacting us at:
15.Automated decisions and profiling
Áloratur does not, as a general rule, make decisions based solely on automated processing that produce legal effects on the user or significantly affect them in a similar way.
Technological tools may be used to automate certain operational, commercial, customer service or analytical tasks, but this will not necessarily imply the adoption of automated decisions with the effects described above.
Should processing of this nature be carried out in the future, the information required by applicable regulations will be provided beforehand.
16.Information security
Aloraturiaventur, S.L. adopts appropriate technical and organizational measures to protect personal data against:
- Loss.
- Destruction.
- Alteration.
- Unauthorized access.
- Disclosure.
- Improper use.
Access to the data will be limited to those persons and providers who need to know it to carry out their duties and will be subject to the corresponding confidentiality obligations.
In the event of a personal data breach, the procedures established under the GDPR will apply and, when legally required, the supervisory authority and the affected individuals will be notified.
17.Accuracy of data
The user guarantees that the personal data provided is true, accurate, complete and up to date.
When providing personal data corresponding to other people — for example, companions included in a booking — the user must ensure they are authorized to disclose it and to inform such individuals when necessary.
The user will be responsible for communicating any relevant change to their data.
18.Mandatory data
When certain data is indicated as mandatory, it will be necessary to process the corresponding request, booking or service.
Refusal to provide it may prevent us from managing the contracting or properly providing the requested service.
We will not request more data than is reasonably necessary for the corresponding purposes.
19.Amendment of the Privacy Policy
Aloraturiaventur, S.L. may update this Privacy Policy when necessary to adapt it to:
- Legislative or case-law changes.
- New criteria issued by data protection authorities.
- Changes in our services.
- Incorporation of new technologies or providers.
- Changes in the way we process personal data.
The version in force will be the one published at any given time at www.aloratur.com.
When the changes are material and necessary under applicable regulations, we will inform the user through appropriate means.