4.1. PRIVACY POLICY

MALLORCA CULTURAL TOURS SL must ensure that the data subject’s personal data collected on the website are processed in accordance with the principles relating to processing:

Treated in a lawful, fair and transparent manner in relation to the interested party (“lawfulness, fairness and transparency”).

Collected for specific, explicit and legitimate purposes, and cannot be treated in a

incompatible with such purposes (“purpose limitation”).

Adequate, relevant and limited to what is necessary in relation to the purposes for which they are

treated (“data minimization”).

Accurate and, if necessary, updated, taking reasonable technical and organizational measures to ensure that they are deleted or rectified when they are inaccurate with respect to the purposes for which they are processed (“accuracy”).

Maintained in a manner that permits identification for no longer than necessary to

the purposes of the processing (“limitation of the storage period”).

Treated in such a way as to ensure adequate security through the application of

appropriate technical or organizational measures (“integrity and confidentiality”).

Thus, MALLORCA CULTURAL TOURS SL will be responsible for compliance with the above provisions and must be able to subsequently prove this («proactive responsibility»).

Likewise, the treatment carried out by the entity will only be lawful if it complies with at least one of the

following conditions (“lawfulness of processing”):

the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes;

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

processing is necessary for compliance with a legal obligation to which the controller is subject;

processing is necessary to protect the vital interests of the data subject or of another natural person;

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Such legitimate basis shall not apply to processing carried out by public authorities in the exercise of their duties. Where processing is based on the data subject’s consent, the

The controller must be able to demonstrate that the controller consented to the processing of his or her personal data.

If the data subject’s consent is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, and using clear and plain language.

The data subject has the right to withdraw their consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent prior to its withdrawal. Before giving their consent, the data subject will be informed. Withdrawing consent will be as easy as giving it.

MALLORCA CULTURAL TOURS SL must include in the forms used for the collection of personal data, the information to comply with the duty to inform contained in articles 13 and

14 of the General Data Protection Regulation (hereinafter GDPR).

In this regard, and in order to comply with the applicable and current regulations regarding data protection, when MALLORCA CULTURAL TOURS SL obtains personal data directly from an interested party, it will:

1. Provide the identity and contact details of the Data Controller and, where applicable, their representative, the contact details of the Data Protection Officer, where applicable, and the purposes for which the personal data is processed, as well as the legal basis for the processing.

1. Specify the legitimate interests pursued by the controller or a third party when processing is necessary for the purposes of those interests. Provided that they are not overridden by the interests or fundamental rights and freedoms of the data subject.

1. Provide the recipients or categories of recipients of the personal data and, where applicable, the controller’s intention to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission.

1. Indicate the period during which the personal data will be retained or the criteria used to determine the retention period.

1. Informing you of the existence of the right to request from the Data Controller access to personal data relating to the interested party, its rectification or deletion («right to be forgotten»), restriction of its processing or the right to object to its processing, as well as the right to data portability.

1. We will inform you of the possibility of withdrawing consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. We will also inform you of the possibility of filing a complaint with a Supervisory Authority.

1. Specify whether the provision of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data and inform them of the possible consequences of not providing such data.

1. Informing the data subject about the existence of automated decision-making, including profiling, and, at least in those cases, informing the data subject about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

If MALLORCA CULTURAL TOURS SL does not obtain the data subject’s personal data, it must provide the data subject with the information described in the previous section. This information includes the categories of personal data processed, their source, and, where applicable, whether they are from publicly accessible sources.

MALLORCA CULTURAL TOURS SL must include in the forms or documents used for the collection of personal data, including those established on the website owned by MALLORCA CULTURAL TOURS SL, the information to comply with the duty to inform contained in the articles

13 and 14 of the General Data Protection Regulation (hereinafter GDPR), and, where necessary, record the consent granted by the interested party.

To accommodate the increased demand for information that must be provided to the data subject whose personal data is to be processed, the possibility of presenting the information using a layered or leveled information model is established. This must be consistent with the information being provided in clear, simple language and in a concise, transparent, intelligible, and easily accessible manner.

Article 11 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), regulates the basic information required in a first layer.

The layered information consists of:

Presentation of basic information (1st layer): consists of presenting basic information at a first level, in a summarized form, at the same time and in the same medium in which the data is collected.

Reference to Additional Information (2nd layer): This consists of presenting the information in detail and completely, in an appropriate, structured, concise, and precise format. The way this additional information is presented depends on the characteristics of the medium used to provide the information; it can be presented in paper or electronic format.