In accordance with the provisions of the current regulations on data protection and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE), FIDELTOUR SL informs users that it has created a profile on the social network(s) Facebook, Twitter, and LinkedIn, with the main purpose of advertising its products and services. Details of FIDELTOUR SL:
TAX ID (CIF): B16519019
ADDRESS: FUSTERS 33, 3rd FLOOR, DOOR 14, 07009, PALMA DE MALLORCA (ILLES BALEARS)
EMAIL: club@fideltour.com
WEBSITE: www.fideltour.com
The user has a profile on the same Social Network and has decided to join the page created by FIDELTOUR SL, thus showing interest in the information that is advertised on the Network. By joining our page, you provide us with your consent for the processing of those personal data published on your profile.
The user can access the privacy policies of the Social Network at any time, as well as configure their profile to guarantee their privacy.
FIDELTOUR SL has access to and processes the user’s public information, in particular their contact name. These data are only used within the Social Network itself. They are not incorporated into any file.
In relation to the rights of access, rectification, erasure and objection, which you possess and may exercise before FIDELTOUR SL, in accordance with the GDPR, you should take the following nuances into account:
Right of Access: This is the user’s right to obtain information about their specific personal data and the processing that has been carried out or is being carried out, as well as any available information regarding the origin of such data and the communications made or planned regarding them.
Right of Rectification: This is the right of the data subject to have inaccurate or incomplete data modified. It can only be fulfilled in relation to information that is under the control of FIDELTOUR SL, for example, deleting comments published on the page itself, images or web content where the user’s personal data appear.
Right to Restriction of Processing: This is the right to have the purposes of the processing originally foreseen by the data controller limited.
Right of Erasure: This is the right to delete the user’s personal data, except in cases provided for in the GDPR or other applicable regulations that determine the obligation to retain them, in the appropriate manner and time.
Right to Data Portability: The right to receive the personal data that the user has provided, in a structured, commonly used and machine-readable format, and to transmit them to another controller.
Right of Objection: This is the user’s right to prevent the processing of their personal data or to request that FIDELTOUR SL cease such processing.
FIDELTOUR SL will carry out the following actions:
Access to the public information on the profile.
Publication on the user’s profile of any information already published on the FIDELTOUR SL page.
Sending personal and individual messages through the Social Network channels.
Status updates on the page that will be published on the user’s profile.
The user may always control their connections, delete content they are no longer interested in and restrict who they share their connections with; to do so, they must access their privacy settings.
Facebook Hotspot · Processing of personal data
Fideltour, S.L., as the Data Processor of personal data, sets out below the rules governing access and processing of personal data in order to provide IT maintenance services for the software and any other activity inherent to the service contracted by its clients through the captive portal (hotspot) of the network of their establishment.
The processing of personal data that the Data Controller makes available to Fideltour, S.L., as the Data Processor, so that it may provide its services, includes:
| Collection | Storage |
| Consultation | Verification |
| Erasure | Communication |
| Recording | Modification |
| Extraction | Communication by transmission |
| Interconnection |
Personal data subject to processing
The Data Processor may access the personal data of the data subjects listed below.
According to the provisions established in the current regulations on the Protection of Personal Data, the Data Processor and all its personnel must:
a) Use the personal data subject to processing, or those collected for inclusion, only for the purpose of this assignment. Under no circumstances may the data be used for their own purposes.
b) Process personal data only by following documented instructions from the controller, including with respect to the transfer of personal data to a third country or an international organisation, unless required to do so under Union or Member State law applicable to the processor; in such a case, the processor shall inform the controller of that legal requirement prior to the processing, unless such law prohibits such notification for important reasons of public interest. If the processor considers that any of the instructions infringes the GDPR or any other applicable data protection regulation of the Union or the Member States, the Data Processor shall immediately inform the Data Controller.
c) Ensure that persons authorised to process personal data are committed to confidentiality or are subject to a statutory obligation of confidentiality, as well as committed to the strict compliance with the security measures established for the provision of the service defined in the PURPOSE of this contract.
d) Ensure the necessary training in personal data protection for persons authorised to process personal data.
e) Take all appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing. In any case, mechanisms must be implemented to:
a. Guarantee the permanent confidentiality, integrity, availability and resilience of processing systems and services.
b. Restore availability and access to personal data quickly, in the event of a physical or technical incident.
c. Verify, evaluate and assess, on a regular basis, the effectiveness of the technical and organisational measures implemented to ensure processing security.
d. Pseudonymise and encrypt personal data, where applicable.
f) Not disclose data to third parties unless previously authorised by the Data Controller, in legally permissible cases. The Data Processor may disclose data to other processors of the same Data Controller, in accordance with the instructions of the Data Controller. In this case, the Data Controller shall identify beforehand and in writing the entity to which the data must be communicated, the data to be communicated, and the security measures to be applied for the communication. If the processor must transfer personal data to a third country or an international organisation under Union or Member State law applicable to it, the processor shall inform the controller of that legal requirement beforehand, unless such law prohibits such notification for important reasons of public interest.
g) Respect the conditions for engaging another Data Processor, as established in the applicable and current regulations on Personal Data Protection. The Data Processor may not subcontract any of the services that are part of the purpose of this contract that involve personal data processing, except for auxiliary services necessary for the normal operation of the services provided by the Data Processor. If subcontracting becomes necessary, this must be communicated beforehand and in writing to the Data Controller, at least 15 working days in advance, indicating the processing activities intended to be subcontracted and clearly identifying the subcontracted company and its contact details. Subcontracting may proceed if the controller does not express objection within the established period. The subcontractor, who will also have the status of Data Processor, is equally obligated to comply with the obligations established in this document and with the instructions issued by the controller. It is the responsibility of the initial Data Processor to regulate the new contractual relationship so that the new processor is subject to the same conditions (instructions, obligations, security measures) as those set out in clause SIXTH of this contract, and with the same formal requirements regarding the proper processing of personal data and the guarantee of the rights of the data subjects. In case of non-compliance by the subcontractor, the initial Data Processor shall remain fully liable to the Data Controller for compliance with the obligations.
h) Provide support to the Data Controller in carrying out data protection impact assessments, where applicable, as well as in carrying out prior consultations with the supervisory authority, when required.
i) Make available to the controller all information necessary to demonstrate compliance with the obligations established in this article, as well as to allow and contribute to audits, including inspections, carried out by the controller or by another auditor authorised by the controller.
j) Assist the Data Controller regarding the detection of data security breaches. The Data Processor shall notify the Data Controller, without undue delay and within a maximum period of 24 hours, through the contact method agreed between both parties, of any personal data security breaches under its responsibility of which it becomes aware, complementing the notification with the provisions of Art. 33.3. If it is not possible to provide the information simultaneously, and to the extent that this is not possible, the information shall be provided gradually without undue delay.
k) Process the personal data placed at the disposal of the Data Processor ensuring that its personnel comply with the instructions of the Data Controller.
l) Ensure that the Data Protection Officer or, failing that, the Privacy Officer, participates appropriately and in due time in all matters related to the protection of personal data.
m) Maintain a record, when processing personal data that poses a risk to the rights and freedoms of the data subject or when processing is not occasional, or when it involves processing special categories of data and/or data related to convictions and offences, of all categories of processing activities carried out on behalf of the controller, or, where applicable, when the Processor employs more than 250 employees.
n) Assist the Data Controller in relation to the exercise of the data subject’s rights and in compliance with the stipulations of the contract. When the affected persons exercise any of these rights before the Data Processor, concerning the processing activities included in the purpose of this contract, the processor must communicate it through the communication channel agreed upon in the execution of the contract. The communication must be done immediately and in no case later than the next working day after receiving the request, together with any other information that may be relevant to resolve the request.
The data subject is provided with the possibility of exercising the rights described in general terms in the corresponding section of this Social Media Privacy Policy.
The user may directly request the Data Processor to erase their stored personal data by following the general instructions provided in the corresponding section of this Social Media Privacy Policy.
In the event of the termination, cancellation or expiry of the contractual service relationship between the Data Controller and the Data Processor, the latter shall be required to return the media and all data contained therein, provided by the Data Controller to the Data Processor for the proper provision of the service. Likewise, all personal data and media generated during the provision of the service shall be returned to the Data Controller within a maximum period of 60 working days from the termination of the commercial contract between the parties. This information shall be returned in the format in which it exists at the time of the termination of the contract, except in cases where, due to its volume, this requires an extraordinary effort on the part of the Data Processor; such a situation shall require an agreement between the Data Controller and the Data Processor in order to agree on the format in which the information will be returned. In any case, the information shall be returned at the offices of the Data Controller designated as its registered address.
The termination or expiry of the contractual service relationship shall oblige the Data Processor to retain the personal data provided by the Data Controller, as long as there is a legal obligation to retain them. Once the legally established period to cover such responsibilities has elapsed, the personal data must be destroyed, as well as any medium or document containing any personal data.
Once the user has joined the FIDELTOUR SL page, they may post comments, links, images or photographs, or any other type of multimedia content supported by the Social Network. The user must, in all cases, hold ownership of such content, possess the corresponding copyright and intellectual property rights, or have the consent of the affected third parties. Any publication on the page—whether text, graphics, photographs, videos, etc.—that violates or is likely to violate morality, ethics, good taste or decorum, and/or that infringes, violates, or breaches intellectual or industrial property rights, image rights, or the law, is expressly prohibited. In such cases, FIDELTOUR SL reserves the right to immediately remove the content and may request the permanent blocking of the user.
FIDELTOUR SL shall not be held responsible for the content freely published by a user.
The user should be aware that their posts will be visible to other users, and therefore, they are primarily responsible for their own privacy.
Images that may be published on the page will not be stored in any file by FIDELTOUR SL, but they will remain on the Social Network.
FIDELTOUR SL reserves the right to carry out contests and promotions in which the user who has joined its page may participate. The terms and conditions of each of them, when the Social Network platform is used for this purpose, will be published on the same platform, always complying with the LSSI-CE and any other applicable regulations.
The Social Network does not sponsor, endorse, or administer any of our promotions in any way, nor is it associated with any of them.
In accordance with the rights granted to you by the current data protection regulations, you may exercise your rights of access, rectification, restriction of processing, erasure, data portability and objection to the processing of your personal data, as well as withdraw the consent given for their processing, by submitting your request to the postal address indicated above or to the email address club@fideltour.com. You may contact the competent Supervisory Authority to submit any complaint you consider appropriate.
Rights of data subjects
FIDELTOUR SL will use the Social Network to advertise its products and services. In any case, if it decides to process your contact details for direct commercial prospecting activities, it will always do so in compliance with the legal requirements of the GDPR and the LSSI-CE.
Recommending the FIDELTOUR SL page to other users so that they may also benefit from promotions or stay informed about its activities shall not be considered advertising.
Below we provide the link to the Social Network’s privacy policy:
Facebook: https://www.facebook.com/about/privacy
Twitter: https://twitter.com/privacy
LinkedIn: http://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv
