Politica de privacidad
1. First things first, who are we?
1.1. Introduction
Hello! We are Opodo S.L. and Grupo Zavala SL, known by you as the branding name you see in this Platform. Vacaciones eDreams, SL is a company belonging to the ODIGEO Group (“eDO Group”).
When this Privacy Notice mentions “we”, “us”, or “our”, it refers to Vacaciones eDreams S.L.U. acting as Data Controller regarding our Platforms or the Data Controller of the service provided in accordance with our General terms and conditions and our Prime terms and conditions .
Thank you for using our Platform. Your trust is the most important value to us, that is why in this Privacy Notice we are going to show you our responsibilities regarding the privacy and security of your data. The only thing you have to do is read it, and if you have any questions related to it, you can tell us about it in our Privacy form . Remember that for non-data protection related questions, you can check our Help Center and contact our customer service team, where needed. After that, you are all set to book your next adventure through us.
1.2. Data Protection Officer
We have a Data Protection Officer who monitors and advises the group of companies regarding the data processing carried out with respect for your privacy in accordance with the applicable privacy regulations.
When you exercise your privacy rights through our Privacy form a dedicated team of privacy rights experts will take care of your request. If you want to raise any privacy topic but not exercise any of your Privacy Rights, you can do so in the same form by selecting “Other Data Protection comments or suggestions”. We will verify your request and/or identity before taking further action on your request for security purposes.
1.3. Definitions
For a better understanding of this Privacy Notice we have prepared a definitions section that includes the following concepts based on the General Data Protection Regulation (“GDPR”): Automated Decisions, Data Controller, Data Processor, Privacy Rights, Lawful Bases, Personal Data, Platforms, Sensitive Personal Data and Third Countries.
2. Why do we process your data?
The main purpose is to offer you travel-related mediation services in accordance with our General terms and conditions . This includes the specific purposes covered here.
We rely on different legal basis for such processing purposes. Depending on the legal basis for our processing of your data, you may have a particular Privacy Right alongside the rest of the Privacy Rights. For example, in individual cases, you have the right to object to the processing of your data (you can find further information under Section 6: How can you control your data and exercise your Privacy Rights?).
2.1. Booking
Lawful bases: #Contract #Legitimate Interest#Your Consent
During the purchase process, we ask you for the data that we need to provide you with our mediation services to contract travel products. Please, bear in mind that the identification data we use internally is the email that you introduce in your booking or account.
2.2. Booking
Lawful bases: #Contract #Your Consent #Legitimate Interest
You can create a user account on our Platforms, enabling us to use your data to manage your account. You can also subscribe to our programs for our customers (e.g. Prime account). We will process your data with the objective to show you the most relevant travel booking and post-booking experience, allowing you to receive the services and features covered in the General terms and conditions and the Prime terms and conditions .
2.3. Travel-related services
Lawful bases: #Contract #Your Consent #Legitimate Interest
We may offer you other travel-related services based on our role as a travel agent as described in our General terms and conditions .
2.4. Communications
Lawful bases: #Contract #Your Consent #Legitimate Interest
In line with the communications already mentioned above (in Section 2.1: Booking), we can get in touch with you by the different means provided by you, and for contract-related purposes (such as emergencies, queries, reminders, alerts, or quality communications).
2.5. Marketing activities
Lawful bases: #Legitimate Interest #Your Consent
Under certain circumstances described below, we may use your personal data for marketing purposes.
2.6. Call and chat recordings
Lawful bases: #Legitimate Interest #Your Consent #Contract
We may process and record your calls and online communications for quality, contractual and legal purposes when you contact our Customer Service.
2.7. Legal and compliance purposes
Lawful basis: #Legitimate Interest
We use browsing and device data for functional and analytical purposes. The main goal here is to optimise our online Platforms to our customers’ needs, making our site easier and more enjoyable to use. We strive to use pseudonymised or anonymised data for these purposes.
2.8. Promotion of a safe and trustworthy service
Lawful bases: #Legal Obligation#Legitimate Interest#Contract
We may use data for the detection and prevention of fraud and other illegal or unwanted activities, as well as for security purposes (e.g. authentication of users and bookings). Our objective here is to create and maintain a trustworthy environment for all (for you, your fellow travellers, other customers, our service providers and our travel providers, etc.). For such purposes, we may have to stop or put on hold certain bookings. We also process data to ensure its accuracy and prevent mismatches, which helps us maintain the integrity of our systems and provide you with the best possible service. The processing of your data will be necessary for legitimate interest purposes, since we have an interest in ensuring network and information security.
As some of these security measures we have implemented for these purposes are compulsory by law and international standards, the corresponding data processing is also necessary for compliance with a legal obligation to which we are subject. In other cases, we have deployed security measures that require the processing of personal data for legitimate interest purposes, since we have an interest in preventing fraud, as fraud has a negative financial impact in companies, and avoiding it or reducing it as much as possible reduces costs which can benefit in better offers to our genuine customers.
2.9. Legal and compliance purposes
Lawful bases: #Legal Obligation #Legitimate Interest
In certain cases, we may need to use your data to handle and resolve legal disputes, for regulatory investigations and compliance, to enforce our General terms and conditions or to comply with lawful requests from law enforcement. This processing is necessary for complying with a legal obligation which we are subject to, and also it is necessary for legitimate interest purposes, since we have an interest in defending our rights and interests.
2.10. Lawful basis we rely on
The main Lawful Bases commonly used are #Your Consent #Contract #Legal Obligation #Legitimate Interest
2.11. Automated Decisions that could produce legal effects or similarly significantly affect you
We do not make any decisions based solely on automated processing, beyond the legitimate interest of fraud prevention and the customisation of your user experience, marketing and advertising, which will not produce legal effects or similarly significantly affect you.
3. What types of data do we process?
We offer you a wide range of services, which you can also use in a wide range of ways. Depending on whether you contact us online, by phone or otherwise and on which services you use, various data from different sources may come into play. Much of the data we process is provided by you when you use our services or contact us, for example when you register and provide your name or email address or address (Data you give to us). We also receive the technical device and access data which is automatically collected when you interact with our services. This may be, for example, information on which device you are using (Data we collect from you).
In any case when the data might not be obtained directly from you, we will provide you with transparent information regarding the use of your data for the specific purpose within a reasonable period after the data has been obtained.
The types of data while relating to a person are grouped into the following data categories (categories are not exclusive, and data may transcend multiple categories):
3.1. Identification and Contact data
Data you give to us Data used to identify you as a natural person and/or data we use to contact you.