Es Lanzarote - EsLanzarote

“Eslanzarote” is deeply committed to complying with Spanish and European regulations on the protection of personal data and guarantees the full compliance with the stipulated obligations, as well as the implementation of the security measures established in the General Data Protection Regulation (GDPR) (EU) 2016/679 of April 27, and in the Organic Law 3/2018 of December 5, on the Protection of Personal Data and the guarantee of digital rights (LOPD and GDD, hereinafter LOPD).

In accordance with these regulations, we inform you that the use of our website may require the provision of certain personal data through registration or contact forms, or by sending emails, which will be processed by “Eslanzarote,” the Data Controller, whose details are:

Company Name: Enlanzarote Sostenible S.L.
CIF: B75529768
Registered Address: C/ Los Reyes, 89 - 35550 - San Bartolomé, Las Palmas - Spain
Phone: +34 658 759 103
Email: [email protected]
Obtaining and Processing Personal Data
A personal data is any information related to a person: name, email, address, phone, NIF/NIE… Additionally, when a user visits our website, certain information is automatically stored for technical reasons, such as the IP address assigned by their Internet service provider.
“Eslanzarote,” as the Data Controller, has the duty to inform the users of its website about the collection of personal data that may be carried out, whether by sending an email or by completing the forms included on the website.
Only the necessary data will be obtained to carry out the contracted service or to adequately respond to the user's request for information. The collected data is identifying and corresponds to a reasonable minimum to carry out the activity performed. In particular, no specially protected data is collected at any time. Under no circumstances will the data be used for different purposes than the intended.

Contact Form/Email
Purpose: Responding to your request for information made through our contact form(s).
Legitimization: The legal basis that legitimizes this processing is the user's consent, which may be revoked at any time.
Data transfer: Personal data will be processed through servers managed by Webempresa, which will be considered the Data Processor.
Subscription Forms for Newsletter
Purpose: Sending communications, some of which are commercial, of interest to users based on the website's theme. As established by the LSSICE, “Eslanzarote” commits to not sending commercial communications without identifying them as such. For these purposes, information sent to customers for maintaining the existing contractual relationship, if applicable, will not be considered commercial communication.
Legitimization: The legal basis that legitimizes this processing is the user's consent, which may be revoked at any time.
Data transfer: Personal data will be processed through servers managed by Mailchimp, which will be considered the Data Processor.
Registration Forms/Client Activation/Contracting
Purposes:
Manage your user registration on our website.
Manage the reservations made.
Provide information about the processing and the status of reservations.
Send communications via email and/or phone to inform the user about potential incidents, errors, problems, or the status of reservations or contracts.
Legitimization: The legal basis that legitimizes this processing is the execution of a contract.
Data transfer: “Eslanzarote” will not transfer or communicate your data to any third party, except in cases provided for by law or when it is strictly necessary for the provision of a service. Specifically, data may be transferred to:
Providers of technological services.
Providers of payment services.
Messenger and parcel companies.
Third parties or intermediaries, as service providers, operating in our own name (consulting, advisory…).
Data transfers will be carried out respecting the strictest confidentiality, using necessary measures, such as signing confidentiality agreements or adhering to their privacy policies established on their respective websites. The user may refuse the transfer of their data to the Data Processors by written request through any of the previously referenced means.
Furthermore, in cases where necessary, client data may be transferred to certain agencies, in compliance with a legal obligation: Spanish Tax Agency, banking entities, Labor Inspection, etc.

Minors
Only persons over 14 years of age can provide personal data on this website. According to the LOPD and GDD, in the case of minors under 14 years, it will be mandatory to obtain the consent of their parents or guardians for us to process their personal data.
On the other hand, only persons over 18 years of age may contract our services. In the case of minors under 18 years, consent from their parents or legal guardians will be mandatory for us to provide the offered services, unless the minor is emancipated.

User Registration - Passwords
To contract the services offered on this website, user registration is required. To do this, the user must fill out the corresponding form, in which we initially collect the following information:

Name and surname
Email and/or phone
Shipping addresses, if applicable
IP
Username/password
Additionally, the user must accept the Contracting Conditions, which are outlined in another section of the website.
The user must also provide a password, which must meet certain security requirements. Passwords do not expire. To recover the password, the user must go to the specific recovery form and enter their email to continue the process and modify it by clicking the link that will be sent to the email address provided. The user is responsible for maintaining the confidentiality of their password, as well as for all uses made of it. They should inform “eslanzarote.com” of any unauthorized use of their account or password as soon as possible.

Once registered, the user has access to a private panel, where they can view certain content, records of reservations made, reservation status, etc. They can also manage account options, such as the password or user data.
The user may receive the following notifications:

Upon registering on the platform (email for account validation).
Necessary notifications to manage reservations or contracts, such as proof of them, incidents, renewals, etc.
Newsletter from the website if registered for it (the user may unsubscribe in their private area and in the corresponding links included at the bottom of each newsletter).
For password recovery.
Upon unsubscribing or deleting the account.
Security Measures
Users of the “Eslanzarote” website are informed that security measures, both technical and organizational, have been adopted to avoid the loss, misuse, alteration, unauthorized access, and theft of data, thereby guaranteeing confidentiality, integrity, and quality of the information contained therein, in accordance with the provisions of the current data protection regulations. Personal data collected in the forms will only be processed by “Eslanzarote” staff or designated Data Processors.
The “Eslanzarote” website also has SSL encryption, which allows the user to securely send their personal data through the contact or registration forms on the site.

Accuracy of Data
The user declares that all data provided by them is true and correct and commits to keeping it updated. The user will be responsible for the veracity of their data and will be solely responsible for any conflicts or disputes that may arise from their falsity. It is important that, in order to maintain personal data up to date, the user informs “Eslanzarote” whenever there are any modifications.

Data Transfer
“Eslanzarote” will not transfer or communicate your data to any third party, except in cases legally provided for or when strictly necessary for providing a service. Specifically, the data may be transferred to:

Providers of technological or IT services
Providers of payment services
Messenger and parcel companies
Third parties or intermediaries, acting as service providers, that operate in our name (consulting, advisory…).
Data transfers will occur respecting the strictest confidentiality, employing necessary measures such as signing confidentiality agreements or adherence to their privacy policies established on their respective websites. The user may refuse the transfer of their data to the Data Processors by written request through any of the previously referenced means.
Additionally, in those cases where necessary, client data may be transferred to certain entities, in compliance with a legal obligation: Spanish Tax Agency, banking entities, Labor Inspection, etc.

Exercise of User Rights
The LOPD and GDD and the GDPR grant individuals the possibility to exercise a series of rights related to the processing of their personal data. To do so, the user should address their request via email to [email protected] or by written communication to the address that appears in our Legal Notice, clearly identifying themselves. This communication should reflect the following information: user’s name and surname, the purpose of the request, the address, and identification data.
The exercise of rights must be carried out by the user themselves. However, they may be executed by an authorized person as the user’s legal representative, providing documentation that proves such representation.

The user may request the exercise of the following rights:

Right to request access to personal data: This is the right to obtain information about whether their personal data is being processed, the purpose of the processing being carried out, as well as the available information on the source of the data and the communications made or planned.
Right to request rectification: In the event that the personal data are incorrect or inaccurate, or to request the deletion of data that turns out to be inadequate or excessive.
Right to request limitation of processing: In which case only data strictly necessary for the exercise or defense of claims will be retained by “Eslanzarote.”
Right to object to processing: This refers to the user’s right not to have their personal data processed or to cease processing in cases where their consent is not required, related to files for commercial prospecting, or that have the purpose of making decisions concerning the user based solely on automated processing of their data, unless for legitimate reasons or for exercising or defending potential claims, the data must continue to be processed.
Right to data portability: In the event that the user wishes their data to be processed by another company, “Eslanzarote” will facilitate the portability of their data in an exportable format.
In the case where consent has been granted for a specific purpose, the user has the right to withdraw consent at any time, without affecting the lawfulness of processing based on the consent prior to its withdrawal.
We commit to executing all these rights within the maximum legal term (1 month). If a user considers that there is a problem with how “Eslanzarote” is handling their data, they may direct their complaints to the Security Officer or the relevant data protection authority, with the Spanish Data Protection Agency being the competent authority in the case of Spain.

Data Retention
Personal data of users who use the contact form or who send us an email requesting information will be processed for the strictly necessary time to attend to the request for information, or until the granted consent is revoked.
Personal data of clients will be processed until the contractual relationship ends. The retention period of personal data will be the minimum necessary, and may be kept for up to:

4 years: Law on Offenses and Penalties in Social Order (obligations concerning registration, enrollments, cancellations, contributions, payment of wages…); Articles 66 et seq. General Tax Law (accounting records…)
5 years: Article 1964 Civil Code (personal actions without a special deadline)
6 years: Article 30 Commercial Code (accounting books, invoices…)
10 years: Article 25 Law on Prevention of Money Laundering and Terrorism Financing.
Indefinitely: aggregated and anonymized data.
For their part, the data of users who subscribe to the newsletter will be retained indefinitely until the granted consent is revoked.
In the case of processing data of candidates (CVs), “Eslanzarote” may retain their curriculum for a maximum of two years for future job openings unless the candidate states otherwise.

Social Media
“Eslanzarote” has a profile on some of the main social networking sites (Facebook, X). The purpose of the data processing by “#ncomm” will be to inform its followers about its activities, using the tools that the corresponding social network allows, and to provide a personalized user assistance service. The user should bear in mind that the use of these social networks is subject to their respective terms of use and privacy policies. “#ncomm” recommends users to consult these terms and privacy policies prior to using the provided links or applications.
Under no circumstances will “#ncomm” extract data from social media unless explicit and specific consent has been obtained from the user to do so. Additionally, “#ncomm” is not responsible for the privacy practices of these social media platforms or their applications, especially concerning confidentiality, personal data processing, and content.

International Data Transfers
“Eslanzarote” uses the electronic communication service provided by Mailchimp, located in the United States. Standard contractual clauses approved by the European Commission have been signed with this entity to ensure an adequate level of protection in the processing of your personal data, in accordance with the criteria established by GDPR.

Recruitment Selection
The candidate who sends electronic communications to “Eslanzarote,” with the aim of accessing the personnel selection processes of the responsible party, authorizes us to analyze the documents submitted (e.g., CV), all content directly accessible through Internet search engines (e.g., Google), profiles maintained on professional social networks (e.g., LinkedIn), data obtained in access tests, and information disclosed in job interviews, with the aim of evaluating their candidacy and to, if applicable, offer them a job position. If the candidate is not selected, “Eslanzarote” may keep their CV stored for a maximum of two years for future job offers unless the candidate states otherwise. The legal basis that legitimizes this processing will be the consent of the interested party, which may be revoked at any time.

Confidentiality
The information provided by the user will, in any case, be considered confidential, and may not be used for purposes other than those described herein. “Eslanzarote” is obliged not to disclose or reveal information regarding the user's intentions, the reasons for the requested advice, or the duration of their relationship with them.

Validity
This privacy and data protection policy has been drafted as of January 28, 2025. It may change depending on modifications in regulations and jurisprudence that may arise, being the responsibility of the data subject to read the updated document to know their rights and obligations in this regard at all times.

Manage your reservation