The definition of data controller is set out in the General Data Protection Regulation, and is as follows:

• Data controller: The natural or legal person, public authority, service or other entity which, alone or in cooperation with others, determines the purposes and means of processing.
• Viajes El Corte Inglés is responsible for processing the personal information of its customers. The Data Protection Officer at the El Corte Inglés Group can be contacted at:delegado.protecciondatos@elcorteingles.es.
• To exercise your rights, write to: protecciondedatosempresas@viajeseci.es. attaching a copy of the requester’s ID document.

• Keeping a file of professional contacts for sending, when authorised, commercial communications and surveys in relation to the services provided by the travel agency and commercial communications of the companies in the El Corte Inglés Group, through all available channels (including electronic means), which may be of interest to your organisation and/or company, through the preparation of a commercial profile based on the information provided and through automated processing.
• Compliance with legal obligations.

The personal information that you provide us is: name and surname, email address, contact telephone number, postcode.

We collect and store limited personal information and anonymous aggregate statistics from all users who visit our websites, whether you actively provide us with such information or are simply browsing our websites. The information we gather includes the Internet Protocol (IP) address of the device you are using, the browser program you are using, your operating system, the date and time of access, the Internet address of the website from which you accessed our websites as well as information about how you use our websites.

We use this information to calculate the loading time of our websites, how they are used, the number of visits to the different sections and the type of information that most attracts visitors. It also helps us to confirm whether the website works correctly and if we detect failures or errors in its operation, to solve them and improve the performance of our websites, with a view to offering a better service to all users.

This information is collected through cookies. For further information, consult the cookie policy that you can find on each of the websites of the companies of the El Corte Inglés Group.

To process your personal information, we follow a legitimate basis for several reasons:

• With your consent, for example, to send personalised offers for the products and services offered by Viajes El CorteInglés and companies in the El Corte Inglés Group.
• Based on a legitimate interest, for example, for security reasons, to improve our services and products through market studies or to handle requests, queries or possible claims that may arise.
• To comply with the different legal obligations.

In some cases, we have to communicate the data you have provided us to third parties to provide the requested service. Such is the case of companies that provide us with other types of services such as information technology (storage and processing of information), security services, audit services, etc.

In all cases, Viajes El Corte Inglés assumes responsibility for the personal information you provide us, and we ask those companies with which we share your personal information to apply the same degree of protection to the information as we do.

Those third parties only have access to the personal information they need to perform these services. They are required to keep your personal information confidential and may not use it in any way other than as requested by us. In all cases, El Corte Inglés Group companies assume responsibility for the personal information you provide us, and we those companies with which we share your personal information to apply the same degree of protection to the information as we do.

If you have given us your consent, the information you provide will be communicated to El Corte Inglés Group companies, to process it for the purposes described above.

However, your personal data will be at the disposal of public administrations and courts if required to investigate any possible liabilities arising from processing.

Viajes El Corte Inglés does not expect to transfer data to foreign countries. The personal data we collect resides in Spain, although it is possible that some group companies operate in other countries and your personal data will be collected in the country in which you reside. We then upload and store said information in our systems. Those third parties with whom we share your personal data may manage or transfer your personal data outside of Spain and the European Union to other countries in which they have facilities. Complying in this case with the requirements established by the Spanish Data Protection Agency and the European Union.

In certain cases, Cloud Computing services are contracted in the USA, resulting in international data transfers being made. In those cases, the appropriate guarantees are adopted to protect your information. You can obtain additional information about these guarantees by writing to delegado.protecciondatos@elcorteingles.es.

We ensure that any transfers of your personal data that we carry out ourselves or that are carried out by third parties with whom we share your personal data, as well as the way in which we manage your personal data, comply with all applicable legislation. In any event, how we transfer, store and manage your personal data will always be governed by this Privacy Policy.

We only store your personal data for as long as we need to use them for the purpose they were collected, and in accordance with the legal basis for processing pursuant to applicable law. We will keep your personal data as long as we have a contractual and/or commercial relationship with you, or as long as you do not exercise your right to erasure, cancellation and/or restriction of data processing.

In those cases, we will keep the information duly blocked, without using it in any way, as long as it may be necessary for the exercise or defence against claims or some type of judicial, legal or contractual responsibility that may arise from its processing, which must be addressed and for which its recovery is necessary.

The data protection regulations allow you to exercise your rights of access, rectification, opposition, deletion, limitation of treatment, portability and to not be subject to individualised decisions before the data controller. These rights are as follows in nature:

• They are free to exercise
• If the requests are manifestly unfounded or excessive (for example, repetitive), the controller may:
  • Charge a fee proportionate to the administrative costs incurred.
  • Refuse to take action.
• Requests must be answered within one month, although, bearing the complexity and number of requests in mind, the term can be extended for a further two months.
• The person data controller is required to inform you about the means for exercising these rights. These means must be accessible and this right cannot be denied for the sole reason that you choose another means.
• If the request is submitted by electronic means, the information will be provided by these means whenever possible, unless the data subject requests otherwise.
• If the data controller does not process the request, they shall provide information, within no more than one month, of the reasons for their non-action and the possibility of claiming before a Control Authority.
• You can exercise your rights directly or through your legal representative.
• The data processor may respond to your request on behalf of the data controller when both have established so in the contract or legal instrument that binds them.

RIGHT OF ACCESS

The right of access entitles you to contact the data controller to find out whether your personal data is being processed.

RIGHT OF RECTIFICATION

The right of rectification entitles you to correct your personal data that is inaccurate without undue delay from the data controller.

Bearing in mind the purposes of processing, you have the right to have incomplete personal data completed, including by means of an additional statement.

Your request must indicate the data to which you refer and the correction that needs to be made. Furthermore, when necessary, you must accompany your request with the documentation that justifies the inaccuracy or incompleteness of your data.

RIGHT OF OPPOSITION

The right of opposition, as its name suggests, means that you can oppose the data controller in the following cases:

• When they are subject to processing based on a mission of public interest or legitimate interest, including profiling.
• When the processing is for the purpose of direct marketing, including this profiling.

RIGHT OF DELETION

The right of deletion may be exercised before the data controller, requesting the deletion of your personal data in any of the following circumstances:

• If your personal data is no longer necessary in relation to the purposes for which it was originally collected or otherwise processed.
• If the processing of your personal data was based on the consent you gave to the data controller, and you withdraw it, provided that the aforementioned processing is not based on another legitimising cause.
• The processing by the controller was based on the legitimate interest or in the fulfilment of a mission of public interest and other reasons have not prevailed to legitimise the processing of your data.
• For your personal data to be subject to direct marketing, including profiling related to said marketing.
• If your personal data have been processed unlawfully.

However, this right is not unlimited, meaning that it may not be possible to proceed with the deletion when the processing is required for purposes of exercising freedom of expression and information, for the fulfilment of a legal obligation, for the fulfilment of a mission carried out in the public interest or in the exercise of public powers vested in the controller, for reasons of public interest, in the field of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the preparation, exercise or defence of claims.

The data processor will be required to block the data when it proceeds with its rectification or deletion.

The blocking of data consists of its identification and reservation, adopting technical and organisational measures to prevent its processing, including its visualisation, except for the provision of the data to the judges and courts, the public prosecutor's office or the competent public administrations, in particular the data protection authorities, for the requirement of possible liability resulting from the processing and only for the limitation period thereof.

Once this period has elapsed, the data must be destroyed.

RIGHT TO RESTRICT PROCESSING

This new right consists of limiting the processing of your data by the data controller, although there are two parts to its exercise:

You may request the suspension of your data processing

• When you dispute the accuracy of your personal data, during a period that allows the controller to verify this.
• When you have objected to the processing of your personal data that the controller performed based on legitimate interest or public interest mission, while the controller verifies whether these reasons prevail over your data.

Asking the data processor to store your data:

• When the processing is illegal and you have opposed the deletion of your data and instead ask for its use to be limited.
• When the data controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the preparation, exercise or defence of claims.

RIGHT TO PORTABILITY

The purpose of this new right is to further strengthen the control of your personal data, so that when processing is automated, you receive your personal data in a structured, commonly used, machine-readable and interoperable format, and can transmit them to another person responsible for the processing, provided that the processing is legitimised on the basis of consent or as part of the execution of a contract. However, this right, by its very nature, cannot be applied when the treatment is necessary for the fulfilment of a mission of public interest or in the exercise of public powers conferred on the controller.

You can exercise your rights before Viajes El Corte Inglés by using the following means:

• By means of a written, signed request to Viajes El Corte Inglés, at Avda. de Cantabria, 51, 28042 – Madrid (Data Protection), attaching a photocopy of the requester's ID. If you have already provided your email address(es), it will be essential for you to provide it/them.
• Sending the completed and signed form along with a photocopy and/or scanned copy of the requester's ID to the following email address: protecciondedatosempresas@viajeseci.es

You may file a claim with the Spanish Data Protection Agency, especially when you are not satisfied with our response to a request to exercise your rights. For more details, consult www.agpd.es

We are committed to protecting your personal data. We use the appropriate technical and organisational means to protect your personal data and privacy and we review said means periodically. We protect your personal data by using a combination of security controls, both physical and computer- or logic-based, including access controls that restrict and administer how your personal information is processed, administered and managed. We also ensure that our employees are duly trained to protect your personal data. Our procedures dictate that we may ask you for proof of identity before sharing your personal information with you.

We will review and update the data protection information when there are changes in the legislation or in any of the procedures for the processing of your personal information, indicating the date of the last update, content and date. This data protection information was revised and updated for the last time in October 2022.