PRIVACY

1. Identification.

1.1. Pancho Tours S.L. (hereinafter, PanchoTours); company registered in the Mercantile Registry of Seville, volume 5469, folio 76, section 8, page SE-91991; with NIF B91974360; registered office at Calle Almirante Lobo 2, 4 left, 41001, Sevilla (Spain); telephone (+34) 664642904; and e-mail info@panchotours.com, is the owner of the website located at the Internet address https://www.panchotours.com/ and of its accounts on social networks (hereinafter, this Website).

1.2. PanchoTours is the owner of the following social networking accounts:

• Facebook.
• Twitter.
• YouTube.
• Instagram.
• LinkedIn.

1.3. The person accessing this Website (hereinafter, the User) assures that he or she is of legal age to grant consent in relation to information society services.

1.4. By accessing this Website, the User expressly accepts all the clauses of its legal information, of this privacy policy, and of its cookies policy, as well as all the particular conditions collected for the use of certain services. If the User does not accept any of the aforementioned clauses, he/she must abstain from accessing this Website.

2. Processing of personal data as responsible.

2.1. Below you will find more information about the different treatments that PanchoTours carries out as the responsible party.

3. Processing of personal data as data processor.

3.1. The User who signs a contract for the provision of services with PanchoTours as data processor authorizes him/her to process the personal data necessary to provide the requested service.

3.2. For the execution of the services derived from the fulfilment of the object of this order, the data controllers will make available to PanchoTours the personal data necessary to provide the requested service.

3.3. This agreement will last as long as the contractual relationship is maintained. Once the contractual relationship has ended, PanchoTours must return the personal data to the person in charge or transmit them to another person designated by the person in charge, and delete any copies in its possession. However, it may keep the data blocked in order to deal with possible administrative or jurisdictional responsibilities.

3.4. PanchoTours and all its staff are obligated to:

• Use the personal data that are the object of processing, or those that you collect for their inclusion, only for the purpose of this order. Under no circumstances may you use the data for your own purposes.
• Process the data in accordance with the instructions of the controller.
• Keep, in writing, a register of all categories of processing activities carried out on behalf of the controller, containing:

• The name and contact details of the manager(s) and of each person responsible on behalf of whom the manager is acting.
• The categories of processing operations carried out on behalf of each controller.
• A general description of the appropriate technical and organisational security measures being applied.
• Not to communicate the data to third parties, unless they have the express authorisation of the data controller, in the legally admissible cases. If the manager wants to subcontract, he or she has to inform the manager and request his or her prior approval.
• Maintain the duty of secrecy with regard to the personal data to which he has had access by virtue of this assignment, even after the end of the contract.
• Ensure that the persons authorised to process personal data undertake, expressly and in writing, to respect confidentiality and to comply with the corresponding security measures, of which they must be duly informed.
• To keep at the disposal of the person in charge the documentation accrediting the fulfilment of the obligation established in the previous section.
• Ensure the necessary training in the protection of personal data of persons authorised to process personal data.
• When the affected person(s) exercise their rights of access, rectification, suppression and opposition, limitation of the processing and portability of data before PanchoTours, this must be communicated by e-mail to the address of the person responsible. The communication must be made immediately and in no case later than the working day following receipt of the request, together, where appropriate, with other information that may be relevant to the resolution of the request.
• Notification of data security breaches: PanchoTours will notify the data controller, without undue delay and through its e-mail address, of any violations of the security of the personal data in its charge of which it is aware, together with all relevant information for the documentation and communication of the incident. The following information shall be provided as a minimum:
• Description of the nature of the personal data security breach, including, where possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned.
• Contact’s person details for more information.
• Description of the possible consequences of the breach of personal data security.
• Description of the measures taken or proposed to remedy the breach of personal data security, including, if applicable, measures taken to mitigate possible negative effects. If and to the extent that it is not possible to provide the information simultaneously, the information shall be provided gradually without undue delay.

• PanchoTours will, at the request of the data controller, communicate such data security breaches to data subjects as soon as possible, when the breach is likely to pose a high risk to the rights and freedoms of natural persons. The communication must be made in clear and simple language and must include the elements indicated in each case by the person responsible, as a minimum:

• The nature of the data breach.
• Details of the contact point of the person responsible or the person in charge where further information can be obtained.
• Describe the possible consequences of a breach of personal data security.
• Describe the measures taken or proposed by the controller to remedy the breach of the security of personal data, including, if appropriate, the measures taken to mitigate possible negative effects.
• To make available to the person in charge all the information necessary to demonstrate compliance with his or her obligations, as well as for the performance of the audits or inspections carried out by the person in charge or another auditor authorized by him or her.
• Implement the necessary technical and organisational security measures to guarantee the confidentiality, integrity, availability and ongoing resilience of the treatment systems and services.
• Return to the data controller the personal data and, if applicable, the media on which they are stored, once the service has been provided.
• The return must involve the total deletion of the existing data in the computer equipment used by PanchoTours. However, PanchoTours may keep a copy, with the data duly blocked, as long as liability may arise from the performance of the service.

3.5. It is the responsibility of the data controller to:

• Provide the person in charge with the necessary information to enable him/her to provide the service.
• Ensure, in advance and throughout the processing, that PanchoTours complies with the General Data Protection Regulations.
• Supervise the treatment.

4. Social networks

4.1. By accessing PanchoTours' accounts on social networks, the User accepts the treatment of his/her personal data by them in accordance with their privacy policies:

• Facebook privacy policy.
• Twitter privacy policy.
• YouTube privacy policy.
• Instagram privacy policy.
• LinkedIn privacy policy.

5. Warranty.

5.1. The User guarantees that the information provided is true, accurate, complete and up to date, and is liable for any damage or injury, direct or indirect, that may be caused as a result of the breach of such obligation.

5.2. In the event that the information provided belongs to a third party, the User guarantees that he/she has informed the third party and obtained his/her authorization to provide his/her personal information to PanchoTours.

6. Rights.

6.1. Right of access: The User shall have the right to obtain confirmation from PanchoTours as to whether or not personal data concerning him are being processed and, in such a case, the right of access to personal data.

6.2. Right of rectification: The User shall have the right to obtain without undue delay from PanchoTours, the rectification of any inaccurate personal data concerning him/her. In view of the purposes of the processing, the User shall have the right to have incomplete personal data supplemented, including by means of an additional declaration.

6.3. Right of suppression: The User shall have the right to obtain without undue delay from PanchoTours the suppression of personal data concerning him/her, which shall be obliged to suppress the personal data without undue delay.

6.4. Right to the limitation of processing: The User shall have the right to obtain from PanchoTours the limitation of data processing.

6.5. Right to data portability: The User shall have the right to receive the personal data concerning him/her, which he or she has provided to PanchoTours, in a structured format, for common use and mechanical reading, and to transmit them to another data controller without being prevented by the data controller to whom they were provided.

6.6. Right of opposition: The User shall have the right to object at any time, for reasons related to his/her particular situation, to the processing of personal data concerning him/her. PanchoTours will cease to process personal data, unless it can prove compelling legitimate reasons for the processing that prevail over the interests, rights and freedoms of the User, or for the formulation, exercise or defence of claims.

6.7. Automated individual decisions, including profiling: The User shall have the right to not be the subject of a decision based solely on automated processing, including profiling, which has legal effects on him or her or significantly affects him or her in a similar way.

6.8. Right to withdraw consent: The User shall have the right to withdraw his/her consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to withdrawal. It will be as easy to withdraw consent as it is to give it.

6.9. Users may exercise their rights before PanchoTours by writing to Calle Almirante Lobo 2, 4 izquierda, 41001, Sevilla (Spain), or by e-mail to info@panchotours.com.

6.10. More information about these rights here.