Data controller
David Schleif, NIE Y9650514G, trading as Eutimia Travel, Calle Matrona María de Gracia Cases Penadés 2, Blq 3, Esc 3, 1ºB, 03005 Alicante, Spain. Email david@eutimiatravel.com, telephone +34 624 221 080.
No data protection officer has been appointed, as none of the cases in Article 37 of Regulation (EU) 2016/679 applies.
Data we process
Identification and contact data: name and surname, identity document or passport, date of birth, nationality, postal address, telephone, email.
Booking data: destinations, dates, number of travellers, travel preferences, accommodation and transport booked, file reference.
Financial data: billing and payment data. Full card details are processed by the payment provider or gateway, not by Eutimia Travel.
Data relating to minors: where minors travel, their data is provided by the holder of parental authority or guardianship, who warrants being entitled to do so.
Special categories of data: only where the traveller voluntarily provides them because they are necessary for the service, for example food allergies, reduced mobility or medical needs. Processing is based on explicit consent under Article 9(2)(a) GDPR and may be withdrawn at any time, although withdrawal may prevent proper performance of the service.
Browsing data: IP address, device and browser type, pages visited, as described in the cookie policy.
Purposes and legal bases
Purpose Legal basis
Responding to enquiries, information requests and quotations Pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR)
Managing bookings, issuing and performing travel services, including transmission to suppliers Performance of the contract (Art. 6(1)(b) GDPR)
Invoicing, accounting and compliance with tax, commercial and tourism obligations Legal obligation (Art. 6(1)(c) GDPR)
Transmitting traveller data to authorities where border, security or traveller registration rules require it Legal obligation (Art. 6(1)(c) GDPR)
Handling incidents, complaints and the exercise or defence of claims Legitimate interest (Art. 6(1)(f) GDPR)
Sending commercial communications, offers and newsletters by email, WhatsApp or other electronic means Consent (Art. 6(1)(a) GDPR and Art. 21 LSSI). For existing customers, offers of services similar to those purchased, under Art. 21(2) LSSI, with an opt-out in every message
Website usage analysis and audience measurement Consent through the cookie panel (Art. 6(1)(a) GDPR and Art. 22(2) LSSI)
Recipients
Data is disclosed to the suppliers needed to perform the trip: package organisers and tour operators, airlines and transport companies, hotel chains and properties, ground handlers and destination management companies, car rental companies, travel insurers and activity providers. It is also disclosed to the tax and accounting adviser, the guarantor, banks and payment gateways, the provider of the booking platform and website, and to public authorities where legally required.
Processors access data under contracts meeting Article 28 GDPR.
International transfers
Performing a trip to a destination outside the European Economic Area necessarily involves disclosing data to suppliers in third countries that may not offer an equivalent level of protection. These transfers rely on Article 49(1)(b) and 49(1)(c) GDPR, being necessary for the performance of a contract with the data subject or of a contract concluded in the data subject’s interest. Where possible, European Commission adequacy decisions or standard contractual clauses are used.
Retention
Data is kept for the duration of the relationship and thereafter blocked for the applicable limitation periods: four years for tax obligations, six years for commercial records under Article 30 of the Spanish Commercial Code, two years for claims arising from a package travel contract under Article 163 of the consolidated General Law for the Protection of Consumers and Users, and the periods resulting from anti-money-laundering rules where applicable. Data processed on the basis of consent is kept until consent is withdrawn.
Rights
You may exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw any consent given, by writing to david@eutimiatravel.com or to the postal address above, enclosing a copy of a document proving your identity. Withdrawal of consent does not affect the lawfulness of processing carried out beforehand.
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), Calle Jorge Juan 6, 28001 Madrid, www.aepd.es.
Security and accuracy
Eutimia Travel applies appropriate technical and organisational measures under Article 32 GDPR. Users warrant the accuracy of the data provided and undertake to notify any change. Where you provide third-party data, you must have informed those persons of this policy beforehand and obtained their consent.