Privacy Policy

I. PRIVACY AND DATA PROTECTION POLICY

Respecting the provisions of current legislation, Pick a Pic Tour (hereinafter, also the Website) undertakes to adopt the necessary technical and organizational measures, according to the level of security appropriate to the risk of the data collected.

Laws incorporated into this privacy policy

This privacy policy is adapted to current Spanish and European regulations regarding the protection of personal data on the internet. Specifically, it complies with the following rules:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPD-GDD).
• Royal Decree 1720/2007, of December 21, approving the Regulations for the development of Organic Law 15/1999, of December 13, on the Protection of Personal Data (RDLOPD).
• Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the person responsible for processing personal data

The controller responsible for the processing of personal data collected at Pick a Pic Tour is: Valeria Ferrando, with NIF: Y3530350W (hereinafter, Data Controller). The contact details are as follows:

• Address: C/ Pastora Martos 24 1/1 08174, Sant Cugat del Vallès
• Contact Email: hello@pickapictour.com

Personal Data Registry

In compliance with the provisions of the GDPR and the LOPD-GDD, we inform you that the personal data collected by Pick a Pic Tour through the forms on its pages will be incorporated and processed in our file in order to facilitate, expedite, and fulfill the commitments established between Pick a Pic Tour and the User, or to maintain the relationship established in the forms filled out, or to respond to a request or inquiry. Furthermore, in accordance with the GDPR and the LOPD-GDD, a record of processing activities is maintained specifying the processing activities carried out and other circumstances established in the GDPR.

Principles applicable to the processing of personal data

The processing of the User’s personal data shall be subject to the following principles set forth in Article 5 of the GDPR and in Article 4 and following of Organic Law 3/2018:

• Principle of lawfulness, fairness, and transparency: Informed consent will be required at all times for clearly specified purposes.
• Principle of purpose limitation: Data is collected for specific, explicit, and legitimate purposes.
• Principle of data minimization: Only strictly necessary data is collected.
• Principle of accuracy: Data must be accurate and kept up to date.
• Principle of storage limitation: Data is only kept for as long as necessary for its processing.
• Principle of integrity and confidentiality: Security and confidentiality are guaranteed.
• Principle of proactive responsibility: The Controller is responsible for ensuring compliance with these principles.

Categories of personal data

The categories of data processed by Pick a Pic Tour are strictly identifying data. Under no circumstances are special categories of personal data (Art. 9 GDPR) processed.

Legal basis for the processing of personal data

The legal basis is consent. Pick a Pic Tour undertakes to obtain express and verifiable consent for one or more specific purposes. The User has the right to withdraw consent at any time as easily as it was given.

Purposes of processing

Personal data is managed to fulfill commitments between the Website and the User, maintain relationships via forms, or address inquiries. Additionally, data may be used for commercial personalization, operational statistics, and marketing studies to improve Website quality and navigation.

Retention periods

Personal data will be retained for the minimum time necessary, specifically for 18 months, or until the User requests its deletion.

Recipients of personal data

The User’s personal data will not be shared with third parties.

Personal data of minors

Only those over 14 years of age may lawfully consent to data processing. For those under 14, parental or guardian consent is mandatory.

Security and secrecy of personal data

Pick a Pic Tour adopts necessary technical and organizational measures to ensure data security. The Website features an SSL (Secure Socket Layer) certificate, ensuring that data transmission between the server and the User is fully encrypted.

The Data Controller undertakes to notify the User without undue delay of any security breach likely to entail a high risk to the rights and freedoms of natural persons.

Rights derived from data processing

The User may exercise the following rights against the Data Controller:

• Right of access: To obtain confirmation and information about their specific data.
• Right of rectification: To modify inaccurate or incomplete data.
• Right of erasure (“right to be forgotten”): To obtain data deletion when no longer necessary or consent is withdrawn.
• Right to restriction of processing: To limit data use in specific legal cases.
• Right to data portability: To receive data in a structured, machine-readable format.
• Right to object: To stop the processing of their personal data.
• Right not to be subject to automated decisions: Including profiling.

To exercise these rights, send a written communication with the reference “GDPR-www.pickapictour.com”, including a copy of your ID, to: hello@pickapictour.com.

Complaints to the supervisory authority

If the User considers there is an infringement, they have the right to file a claim before the Spanish Data Protection Agency (AEPD) at www.aepd.es.

II. ACCEPTANCE AND CHANGES TO THIS PRIVACY POLICY

Use of the Website implies acceptance of this Privacy Policy. Pick a Pic Tour reserves the right to modify this policy at its discretion or due to legislative changes. Users are encouraged to consult this page periodically.

Last updated to comply with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPD-GDD).