GALAPAGOS PROMOTION: SEPTEMBER THROUGH DECEMBER

Pursuant to theGeneral Data Protection Regulation, 679/2016 of May 25, 2016, with entry into force on May 25, 2018.

This privacy policy applies to data processing carried out by Centraldevacaciones.com. Please read it carefully, in it you

will find important information about the processing of your personal data and the rights recognized by current regulations on the matter. Confidentiality, professional secrecy and security are fundamental values ​​of Centraldevacaciones.com, which assumes the commitment to guarantee the privacy of the user or visitor at all times, and in all interactions with him.Centraldevacaciones.comalso assumes the commitment not to collect unnecessary information about the User. Likewise, we promise to treat with extreme diligence the personal information that the User may provide through our website.

It is important that so that we can keep your personal data updated, you inform us whenever there has been any change in them, otherwise, we are not responsible for their veracity. We consider that, if you do not expressly cancel your personal data from our files, you are still interested in continuing to be incorporated into them until Centraldevacaciones.com deems appropriate and as long as it is appropriate for the purpose for which they were obtained. Centraldevacaciones.comis not responsible for the privacy policy regarding personal data that may be provided to third parties through the links available on our website.

Centraldevacaciones.com can modify these privacy policies to adapt them to the modifications that occur on our website, as well as legislative or jurisprudential modifications on personal data that appear, for which reason it is necessary to read them, each time you provide us with your data through this Web. For any question regarding the Personal Data Protection Policy, you can contact us by email: info@centraldevacaciones.com or by phone 969 69 33 69. In general, the fields of our forms that are marked as mandatory must be completed in order to process your requests.

Who is responsible for the processing of your data?

• The person responsible for the treatment of the data collected on the web www.centraldevacaciones.com it is CENTRALDEVACACIONES SOCIEDAD LIMITADA, onwards Centraldevacaciones.com, with address in Cuenca, Cl. Colón 65. 16002 Cuenca, with C.I.F. B72872666 and registered in the Mercantile Registry of Cuenca, Volume 607, Book 0, Page 98, Page CU-9024, 1st entry.

What personal information do we collect?

The data we process are those obtained:

• From the forms that you fill out and the requests that you make on the Web, for example, when you register, sign up for our communications (newsletters), save a budget/idea or buy a trip or related service. We also process the data included in the requests and requests that we receive by email or in our call center.
• Of profiles and analytics obtained from the browsing of users of the Web, registered or not.
• From your participation in our commercial campaigns, for example, in contests or promotions.
• The profile or social network with which you have decided to log in on our website.

The data we obtain is provided, either directly by you, or by third parties that process requests on your behalf, for example, the holder of the reservation, the company for which you work or other travel agencies that may act as intermediaries.

• The categories of data that we process usually consist of:
• Identification and contact information, ID or passport, tax address, municipality, postal code and province.
• Data of personal characteristics, such as language, gender, date of birth and nationality.
• Data of transactions carried out and economics.
• Commercial monitoring data and, where appropriate, related to preferences and commercial profile.
• Identification and contact data obtained from the social profile that you have used to log in to our These data are only processed for this purpose.
• Data generated by your use of social networks, which you have decided to share with us (for example, likes and comments).

Why will we process your data?

At Centraldevacaciones.com we treat your personal data provided for the following purposes:

• Guarantee proper management of our commercial relationship with you (in response to your queries and requests), as well as conduct satisfaction surveys to improve your experience, although compliance with them is not mandatory.
• Process your requests and provide you with the contracted services diligently.
• Comply with our legal obligations, for example, in accounting and tax matters.

The data of the users of the Web are also processed for the administration, management and control of the website itself and its private access areas and for statistical purposes and improvement of the website and our services.

For security and quality control reasons, calls made to our call center and by our agents may be recorded. If you do not want the call to be recorded, you must explicitly tell the agent that answers you.

We process data of our clients and users for the following commercial purposes:

• We carry out commercial communications to our clients and users. These communications refer to products or services marketed by Centraldevacaciones.com related to the following sectors: tourism, leisure, financial and insurance.
• With your consent, we will prepare a commercial profile based on your reservations and the data that you have provided us on the Web through marketing studies so that our offers and commercial communications are adjusted to said profile. No automated decisions are made based on the profiles of our clients.
• If you have requested a quote or have started a reservation process on the Web or through our Call Center without completing it, the data provided may be used to carry out commercial monitoring of your request. For this purpose, our agents may contact you by email, by SMS, by WhatsApp-type communications or by phone, for example, to resolve any incidents in the reservation process.
• If you participate in our promotional campaigns, raffles, coupons, etc., your data will be processed for their management and control. Participation in our promotions implies your consent for the processing and transfer of your data to the extent and under the conditions indicated in the bases that regulate the promotional campaign in which you have been interested and wished to participate, said consent being a prerequisite for their participation. Depending on the operation of the specific promotion in which you have registered, the data of the participants or winners may be published on the Centraldevacaciones.com websites, social networks or the media. In the case of contests and raffles, the personal data of the winners necessary for the correct enjoyment of the prizes,

To whom can we communicate your data?

In general, we will only communicate your data with your prior consent, when it is necessary for the processing of your requests or the provision of contracted services or to comply with our legal obligations.

And in particular:

• For the correct processing of the requested reservations, the data included in the reservations will be communicated to the providers of the tourist services included in the contracted trips and/or to management companies of global reservation systems, tour operators, wholesalers, bed banks as well as to the technological companies that are members of Centraldevacaciones.com that by contract provide technical support for the proper functioning of the site as well as the agencies and consultancies that process the tax returns required by LAW. This may involve the international transfer of your data, when said companies are outside the European Economic Area, such as air service issuing companies, bed reservations and the like, since current contracts are globalized.
• We can also communicate transaction data to fraud and scam detection platforms to detect and prevent fraudulent payments or reservations.
• We can resort to technological solutions or services provided by companies that are outside the European Economic Area for certain functionalities of the Web. In such a case, we will adopt the appropriate measures to guarantee an adequate level of protection of personal data.
• We use various services provided by Google and its affiliates. These companies are adhered to the Privacy Shield agreement between the EU and the US. In application of this agreement, personal data transferred from one company in the EU to another in the United States will be treated in accordance with a series of rules of protection and well-defined safeguards, thus ensuring an adequate level of protection. You can check the validity of Google’s adherence to the Privacy Shield at the following link:https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

Legal basis of the treatments

The basis for the processing of your data is the management of the legal relationship established with you, the provision of the requested or contracted services and compliance with legal obligations, especially the applicable regulations on accounting, tax, tourism or Security and passenger control.

The following treatments are based on the existence of a legitimate interest:

• The management of the security of the Web and our call center, as well as the adoption of fraud detection and prevention measures, is based on the existence of our legitimate interest in guaranteeing the security of our systems and transactions.
• The realization of statistics and quality control, including the recordings of calls to our call center, are based on our legitimate interest to evaluate our services.
• The commercial follow-up of your requests, the sending of commercial communications and the consolidation of the commercial databases ofcomare based on our legitimate interest and to promote the products or services marketed byCentraldevacaciones.com, as well as your consent to receive such communications by electronic means.
• The analysis of consolidated customer data is based on the interest of the group to process this information for internal administrative purposes.
• The following treatments are based on your consent, without the withdrawal of such consent conditioning the provision of the contracted services:
• The realization of commercial profiles for the sending of offers and personalized commercial communications are based on the consent that is requested;
• The creation of browsing profiles based on the information obtained from cookies or similar technologies.

How long will we keep your data?

In general, we keep your data during the validity of the relationship you have with us and, in any case, during the periods established in the applicable legal provisions, for example, in accounting and tax matters, and during the time necessary to attend to possible responsibilities arising from the treatment. We will cancel your data when they are no longer necessary. For exceptional cases such as for the exercise or defense of claims or some type of judicial, legal or contractual responsibility may arise, they will remain duly blocked.

The recordings of the calls in the call center will be canceled within a maximum period of 2 months, without prejudice to their conservation for the time necessary to manage eventual incidents or the terms established by the applicable legal provisions.

The data processed for commercial purposes, including commercial profiles, will remain valid as long as its deletion is not requested. The supports in which the existence of your consent for the processing of your data for these purposes, for example, the logs of sending electronic forms, will be kept for the entire duration of the treatments and the applicable prescription periods.

What are your rights?

You have the right to obtain confirmation of whether or not we are processing your personal data and, if so, to access it.

Once registered on the Web* (dynamic area) you will be able to consult the history of your reservations, as well as access your profile, see your pending payments, check your saved Ideas/Quotes, your purchase attempts and saved packages.

You can also request that your data be rectified when it is inaccurate or that incomplete data be completed, as well as request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, you may request the limitation of the processing of your data. In this case, we will only process the affected data for the formulation, exercise or defense of claims or with a view to protecting the rights of other people. Under certain conditions and for reasons related to your particular situation, you may also oppose the processing of your data. In this case, we will stop processing the data except for compelling legitimate reasons that prevail over your interests or rights and freedoms, or for the formulation, exercise or defense of claims.

Likewise, and under certain conditions, you may request the portability of your data so that they are transmitted to another data controller.

You can revoke the consent that you have given for certain purposes, without affecting the legality of the treatment based on the consent prior to its withdrawal.

To request your withdrawal from processing for commercial purposes, you can:

• Send an email to the following email address:info@centraldevacaciones.com
• Use the links provided in any of our communications.

At any time you can revoke your consent for your geolocation or the installation of cookies for tracking or the creation of navigation profiles by modifying the privacy options of your web browser or your terminal. You can obtain more information about online behavioral advertising (online behavioral advertising) and how to manage the privacy of your browser to reject this type of treatment at http://www.youronlinechoices.com/es/. More information in our cookie policy available at https://www.centraldevacaciones.com/php/politica-de-cookies/

To exercise your rights, you must send us a request accompanied by a copy of your national identity document, or another valid document that identifies you by post or email, to our Data Protection Delegate at the addresses indicated in this text.

You can obtain more information about your rights and how to exercise them on the page of the Spanish Data Protection Agency at http://www.agpd.es or on the page of the data protection authority of your country.