PRIVACY POLICY

This privacy policy is in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of the 27th of April, 2016, concerning the protection of natural persons with regard to the processing of personal data and free movement of these data (RGPD), to Organic Law 3/2018, of the 5th of December, Protection of Personal Data and digital rights guarantee (LOPDGDD), as well as in what is not contrary to the regulations indicated, to the Law Organic 15/1999, Protection of Personal Data (LOPD) and its development regulations, and/or those that could replace or update in the future.

Our organisation is committed to the privacy of your personal data. The personal data provided are necessary to provide our services and are processed in a lawful, fair and transparent way, ensuring adequate security of them, including protection against unauthorised or illegal processing and against loss, destruction or accidental damage through the application of technical and organisational measures.

In this document we want to offer you, in a transparent and loyal way, all the nece information related to the processing of your personal data that this organisation makes. 

I. DATA CONTROLLER

IDENTITY: THE ORIGINAL TRAVELLER FOOD, S.L.

C.I.F. / N.I.F.: B98921943

REGISTERED OFFICE: CTRA. LAS MARINAS KM 3, 03700 DENIA (ALICANTE)

TELEPHONE: 673092975

EMAIL: rrhhvalencia@quiquedacosta.es

DATA PROTECTION OFFICER: rrhhvalencia@quiquedacosta.es

II. RECIPIENTS OF PERSONAL DATA

  1. The personal data provided will not be disclosed to third parties unless this is expressly provided for in the specific processing activities.
  2. Optionally, for the contracting of cloud computing services and/or services for sending emails, communication, as well as other related IT services, personal data may be:

    • Transferred to IT service companies located within the European Economic Area (EEA) or,

    • Where some of our suppliers or service providers are located outside the European Economic Area (EEA), we guarantee that international transfers of data will be carried out in accordance with applicable legislation. In particular, where providers are located in the United States, such transfers may be based on the EU-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov), whose adequacy was recognised by the European Commission on 10 July 2023, or on Standard Contractual Clauses approved by the European Commission.
  3. Where applicable, personal data may be disclosed to public authorities and other bodies where required in compliance with legal obligations.

III. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

For each specific processing activity involving personal data, we will inform you of the legal basis that legitimises such processing.

IV. RIGHTS

4.1. RIGHT OF ACCESS

It is the right to obtain from the controller confirmation as to whether or not personal data relating to the data subject are being processed and, if so, the right to access to the personal data and the following information: the purposes of the processing, the categories of the processing, the recipients or the categories of recipients to whom the data have been or will be disclosed, the storage period or the criteria used to determine this period, the existence of the right to request from the controller the rectification or deletion of personal data or the restriction or objection to the processing of personal data relating to the data subject, the right to lodge a complaint with the Spanish Agency for Data Protection (AEPD), the existence, where applicable, of automated decisions, including profiling, where data are transferred to third countries the right to be informed of the appropriate safeguards applied.

4.2. RIGHT TO RECTIFICATION

You have the right to request the rectification of your personal data if these are innaccurate including the right to complete data that is incomplete. Please note thatby providing personal data by any means, you warrant that such data are true and accurate, and you undertake to notify us of any changes or modifications to such data. Therefore, any damage caused as a result of the communication of erroneous, inaccurate or incomplete information in the forms of the website, will be the sole responsibility of the concerned party.

4.3. RIGHT TO SUPRESSION/DELETION

It is the right to request the suppression of your personal data when, among other assumptions, they are no longer necessary for the purpose for which they were gathered, or are otherwise being processed or you withdraw your consent. It should be borne in mind that erasure will not be applicable when the processing of personal data is necessary, among other cases, for teh fulfilment of legal obligations or for the formulation, exercise or defense of claims.

4.4. RIGHT TO LIMITATION

It is the right to request that restrict the processing of your personal data, which means that in certain cases you can ask us to temporarily stop the processing of your personal data or to store your data for longer than necessary when you may need it.

4.5. RIGHT TO WITHDRAW CONSENT

It is the right to withdraw the consent you have provided by ticking "I have read and accept the privacy policy" at any time and as specified in the relevant section "Exercise of rights" or in the specific processing of commercial communications or Newsletter. Please note that this right will not be applied if, inter alia, the processing of personal data is necessary for the compliance with a legal obligation, the performance and maintenance of a contractual relationship, or for the formulation, exercise or the defense of claims. Likewise, the withdrawal of consent will not have retroactive effects, it will not affect the lawfulness of the processing based on the consent prior to its withdrawal. 

4.6. RIGHT TO DATA PORTABILITY

It is the right to receive the personal data concerning you and that you have provided to us, in a structured, commonly used and machine-readable format and to transmit them to another  controller, provided that: the processing is based on your consent and is carried out by automated or computerised means.

4.7. RIGHT TO OBJECT

You have the right to oppose the processing of your personal data on the basis of our legitimate interest. We will cease to process your personal data unless we can prove compelling legitimate grounds for the processing that prevail over your interests, rights and freedoms, or for the formulation, exercise or defence of claims.

4.8. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that we are processing your personal data in an incorrect manner, you can contact us or you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

https://www.agpd.es/portalwebAGPD/index-ides-idphp.php

4.9. EXERCISE OF RIGHTS

You may exercise your rights by sending a letter to the postal address indicated above or by e-mail rrhhvalencia@quiquedacosta.es, enclosing, in both cases, a copy of your NIF/NIE/Passport or similar document. 

V. SECURITY MEASURES

The data controller applies appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of the data.

VI. PROCESSING OF PERSONAL DATA

6.1. GENERAL PROVISIONS

Personal data requested in each of the specific processing operations are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, thereby complying with the principle of data minimisation.

Personal data requested in each of the specific processing operations are strictly necessary, and refusal to provide them would mean that the requested service could not be provided.

The communication of personal data provided for in each of the specific processing operations is in some cases necessary for the performance and maintenance of a contract and in other cases for compliance with a legal obligation applicable to the responsible party.

6.2. BASIC PROCESSING

CONTACT FORM

Personal data provided in the contact form will be used solely to respond to queries or requests for  information and to manage the relationship arising from the query.

The legal basis that legitimises the processing of personal data is the express consent given by ticking‘I have read and accept the privacy policy’.

Data will not be transferred to third parties, except where legally required or when necessary for the proper provision of the service.

Personal data will be kept for a period of two years from the moment it ceases to be processed, without prejudice to the exercise of your rights as a data subject, unless there is a contractual or legal relationship that requires it to be kept for longer.

ELECTRONIC COMMERCE FORM (E-COMMERCE)

Personal data will be processed for the following purposes: to respond to queries, requests or complaints received via the web form, email or telephone; to manage registration as a registered user to allow access to your personal area, order history and billing details; to manage and process orders, payments, billing, shipments and returns, as well as to comply with the legal obligations arising from the purchase or reservation contract and to comply with the legal obligations arising from tax, accounting, consumer and e- commerce regulations. If you expressly consent, informative or promotional communications about products, services and news will be sent.

The legal basis that legitimises the processing of personal data is the express consent given by ticking ‘I have read and accept the privacy policy’. As a result of this, compliance with legal obligations in the areas of accounting, tax, consumer protection and data protection.

Data will be kept for the duration of the contractual or commercial relationship and for the legally required periods, and as long as consent is not revoked in cases of commercial communications.

Data will not be disclosed to third parties unless required by law or where necessary for the provision of the service, such as: courier or transport companies for the delivery of orders; banks or payment gateways for the processing of payments; and technology providers offering web hosting, maintenance or support services. All data processors guarantee compliance with the GDPR.

No data transfers will be made outside the European Economic Area without adequate safeguards.

Data will not be transferred to third parties except where legally required or when necessary for the provision of the service, such as: courier or transport companies, for the delivery of orders, banks or payment gateways, for the management of payments and technical suppliers.

COMMERCIAL COMMUNICATIONS OR NEWSLETTER FORM

Personal data collected in the context of subscribing to the newsletter will be processed to send information, news, promotions or related content, manage subscriptions, preferences and user cancellations, through various means such as WhatsApp, email, telephone or SMS. It should be noted that this type of data processing may involve analysing the profile of the data subject in order to determine their preferences and thus be able to send them information that is more suited to their interests.

The legal basis that legitimises the processing of personal data is the express consent given in advance by ticking ‘I have read and accept the privacy policy’.

Data is obtained directly from the data subject via the newsletter subscription form or direct contact by email or telephone.

No data is obtained from third parties without express consent.

You can request to unsubscribe from this type of processing, depending on the means used, as follows: 

  • Email: Through the link provided for this purpose in each electronic communication or through a similar procedure specified in the commercial communication.
  • WhatsApp: By requesting to unsubscribe.
  • SMS: By requesting to unsubscribe.
  • Telephone: By requesting to unsubscribe.

Data will not be transferred to third parties, except where legally required. However, certain service providers acting as data processors, such as web hosting services, newsletter delivery tools and IT support, may have access to your data, always under a contract that guarantees confidentiality and compliance with current regulations. If WhatsApp is used, as a necessary contractual requirement, personal data will be transferred to WhatsApp Ireland Limited, which is located within the EEA.

International data transfers are made by GOOGLE, LLC. when using the GMAIL email application. Data processors: IT services.

Personal data provided for subscription to our newsletter will be kept for as long as the user maintains their subscription. In the event of cancellation or revocation of consent, your data will be deleted unless there are legal obligations that require its retention.

WITHDRAWAL RIGHTS FORM

The personal data provided will be processed for the following purposes: to manage and process the request to exercise the right of withdrawal, to verify the identity of the applicant and their connection to the order in question, to manage the return of the product and, where applicable, the refund of the amounts paid, to comply with legal obligations arising from applicable consumer, tax and commercial legislation, and to manage any incidents, complaints or enquiries relating to the request.

The legal basis for data processing is: the consent given by clicking on the withdrawal request, the performance of the contractual relationship arising from the purchase made, and compliance with legal obligations applicable to the data controller.

Data to be processed are: identifying details, such as first name and surname; contact details: ema address, telephone number and postal address; and order details, such as order number, date of purchase and the products for which the right of withdrawal is being exercised.

Data may be transferred to transport and logistics companies responsible for the collection or return of products, financial institutions or payment service providers for the management of refunds, technology providers providing services to the data controller as data processors, and public administrations, courts and tribunals or other bodies where there is a legal obligation.

As a general rule, no international data transfers will be carried out. Should we use service providers located outside the European Economic Area, such transfers will be carried out in accordance with the appropriate safeguards provided for in Regulation (EU) 2016/679 (GDPR).

Data will be retained for the time necessary to process the withdrawal and, subsequently, for the periods established by law to address any potential liabilities arising from the contractual relationship, as well as tax, commercial or consumer obligations.