Data Controller. The personal data collected through the website www.trenesturisticos.com will be processed by the following entities, who are the Data Controllers of the personal data provided through this website. ALSA FERROCARRIL, S.A.U. with registered office at Calle Josefa Valcárcel, 20, 28027, Madrid and CIF A-83093930 is the company owner of the domain www.trenesturisticos.com, registered in the RM of Madrid, Volume 17,299, Folio 203, Section 8, Page M-296645 with license for the operation of railway transport services No. 12/0VM/2/02/04. VIAJES ALSA, S.A.U., the company that markets the products and/or services offered on www.trenesturisticos.com, an online travel agency, with registered office at Calle Josefa Valcárcel, 20, 28027, Madrid, CIF A-28689891, registered in the Mercantile Registry of Madrid, Volume 25806, Folio 201, Section 8, Page M-16079, License CIC-MA: 3548.

 

Purposes of the processing of personal data.

In general, the collection and processing of your personal data on the website www.trenesturisticos.com has the following purposes: i. To be able to contact the user; ii. To satisfactorily manage the online purchase of tickets/tourist packages made; iii. To properly attend to and manage reservations, inquiries, comments, incidents, or suggestions sent; iv. To manage basic administrative tasks; v. To keep you informed, either by email or by any other means, of news, products, and services (where appropriate, managing their proper provision) that may be of interest to you; vi. To provide added services, improvements in our services, and in the customer experience when using the Web. vii. Statistical analysis of visits to the Web and the behaviors of its Users therein. viii. To properly manage navigation through this website. ix. To comply with all corresponding legal obligations, as well as to communicate your personal data to the State Security Forces and Bodies and other bodies with competence in the matter, when so required. x. To correctly manage situations of emergency, catastrophes, or cases of force majeure, it may be necessary to communicate your personal data to bodies or entities with competence in the matter. Regarding the processing of your data for promotional or advertising purposes, the data subject will be provided, along with the corresponding data collection form, with the appropriate simple and free procedure so that they can grant their consent to the processing of their personal data for said purpose.

 

Legitimation.

The legal bases that legitimize the indicated treatments are the development and fulfillment of the established contractual relationship (i, ii, iii, iv), the consent of the user (v), the legitimate interest of the company (vi, vii, viii), and the fulfillment of a legal obligation (ix and x).

 

Typology of processed personal data.

In general, at www.trenesturisticos.com, the personal data that the user provides upon contracting the products and/or services selected in the purchase process is processed, collecting the personal data of the buyer and/or the personal data of the traveler; through online data collection forms, call centers, and/or any sales channels enabled by the company. However, on many occasions, our customers' personal data is provided by third parties such as travel agencies or other natural persons who request or contract, on your behalf, the products and/or services we offer through our different sales channels. The categories of data processed are generally identifying information such as name, surname, ID (DNI), email, contact telephone, payment data, and purchase history, data relating to large family status, all for the purpose of verifying beneficiary status. The personal data required in our different sales channels is necessary to provide the contracted service and attend to you properly. In the event of not providing the required data, the company will not be able to attend to your request as the required personal data is mandatory to comply with our legal and/or contractual obligations.

 

Recipients of personal data.

The data provided as a result of the purchase will be stored in the processing systems of ALSA FERROCARRIL, S.A.U. and VIAJES ALSA, S.A.U. and will also be transferred to the systems of the companies that operate the transport services in the tourist trains offered on www.trenesturisticos.com. All parties involved in the processing of your personal data are responsible for its confidentiality in the terms legally required, in accordance with their specific privacy policies. We do not transfer your data to third parties for commercial purposes; we will only send you commercial information where we can offer you company discounts and advantages that may be of interest to you, and only if you have accepted the sending of commercial communications. International data transfers are not carried out. We work with external providers such as technology service providers or marketing and advertising-related service providers, who are always required to work with servers located in the European Economic Area that guarantee an adequate level of protection in data processing. In the event that we work with external providers that do not offer the same level of protection because they are located outside the European Economic Area, they are required to provide adequate guarantees by signing, in accordance with current data protection regulations, the corresponding Binding Corporate Rules (BCR) as a guarantee of the correct management of your personal data, as well as the signing of Standard Contractual Clauses adopted by the European Commission.

 

Rights of the interested parties.

The interested party may exercise the rights of access, rectification, erasure, objection, portability, limitation, and other rights regarding the protection of personal data, by request to our email address established for this purpose: asesoria@alsa.es, or to the postal address: TRENES TURISTICOS, Legal Department, Calle Josefa Valcárcel, 20, 28027, Madrid. Any interested party may, at any subsequent time, under the terms established in the data protection regulations in force at any time, revoke the authorization granted for the processing of personal data. The interested party shall have the right to lodge a complaint or claim with the Spanish Data Protection Agency (www.aepd.es). The user shall be responsible, in any case, for the veracity of the data provided, the company reserving the right to exclude from the services any user who has provided false data, without prejudice to other actions that may proceed in Law. The user is responsible for communicating any modification of the personal data provided.

 

Data retention period.

We only store users' personal data to the extent that we need it to use it according to the purpose for which it was collected, and according to the legal basis for its processing. We will keep personal data as long as a contractual and/or commercial relationship exists with the user and as long as they do not exercise the right to erasure, cancellation, and/or limitation of the processing of personal data. In these cases, we will keep the data duly blocked, without giving it any use, while it may be necessary for the exercise or defense of claims or any type of judicial, legal, or contractual liability may derive from its processing, which must be attended to and for which its recovery is necessary. The company will comply with the provisions of current regulations regarding the duty to cancel personal information that is no longer necessary for the purpose or purposes for which it was collected, blocking it, in order to be able to address possible liabilities derived from the processing of the data, and only during the limitation periods of said liabilities. Once these periods have elapsed, that information will be permanently deleted using secure methods.

 

Information we collect from web visits.

We collect and store limited personal information and anonymous global statistics of all users who visit our website, whether because the user actively provides it to us or because they are simply browsing our website. The information we collect includes the Internet Protocol (IP) address of the device the user is using, the browsing program used, its operating system, the date and time of access, the Internet address of the website from which the user accesses, and also information about how you use our website. We use this information to know the loading time of our website, how it is used, the number of visits, and the type of information the user consults the most. This information helps to identify if the website is working correctly, and if we detect failures or errors in operation, to fix them and improve the performance of our website, to offer a better service to all users. In consideration of the above, we collect usage and navigation data for statistical and advertising purposes, to control the use of our page, and to improve knowledge about the User's interests.

 

Minors.

Minors under 16 years of age should not send any personal information without the consent of their parent or guardian. The company is not responsible for any personal information sent by minors under 16 without the appropriate authorization.

 

Security measures.

The company has adopted the security levels for the protection of personal data required by current regulations, based on the type of information processed, and has implemented other additional technical means and measures at its disposal to prevent its alteration, loss, unauthorized processing, or access to the personal data provided. The company guarantees that it has adopted the appropriate security measures to guarantee information security and the confidentiality of the data you send us over the Internet. For this, Secure Socket Layer (SSL) security technology is used, a system that allows the encryption of information sent to us, preventing its reading even if it is inappropriately intercepted. The server is certified, so your browser can confirm the company's identity before any transmission is sent. This certificate guarantees the identity of the destination computer to which your data is being sent. You can recognize that SSL security is operational by the appearance of a padlock icon on the bottom edge of most browsers. If you click on this icon, the certificate associated with the secure connection will appear. Notwithstanding the above, the user must be aware that security measures on the internet are not impregnable.

 

Social Networks.

If you register as a user through social profiles, the company will process certain information associated with your person. If you do not agree with the processing of the type of data we will collect, you should not continue the registration process with your social profile and can choose to register via the traditional way by completing the form provided for that purpose. The data from your social profile that you decide to share with the company will also be processed for the purpose of enriching our databases and creating/refining commercial profiles to have better and more detailed knowledge from a commercial point of view of individual users and as a group (needs, tastes, preferences, etc.) to be able to design, plan, and personalize our products and services and our commercial and marketing actions. Notwithstanding the above, we inform you that automated decisions will not be made based on said commercial profile. If you expressly accept it in the registration process, your data will be used to send you personalized commercial communications, as explained in this Privacy Policy.

The categories of data that Trenes Turísticos will obtain and process when you register as a user via social profile are the following:

• "Public Profile" data (this data category is mandatory): information you have provided to the social network with which you wish to register on our website when you completed your social profile and specifically that section. It includes: first and last name, gender, user identifier on the social network (ID-account number), profile photo, cover photo and networks, age range, language, and country.

• Other social profile data that you have decided to share with Trenes Turísticos, for example, other contact details, images, personal characteristics, social circumstances, academic and professional data, employment detail data, etc.

• Data generated by the use of the social network that you have decided to share with Trenes Turísticos (for example, likes and comments).

• Email (mandatory)

Personal data marked as mandatory must necessarily be provided to complete the registration with your social profile. If you do not agree with this, you should not continue the registration process with your social profile and can choose to register on our website via the traditional way by completing the form provided for that purpose. In any case, as a social network user, you can always control your connections, delete content that no longer interests you, and restrict who you share your connections with; to do this, you must access the privacy settings enabled on each social network. Likewise, in the event that you decide to publish comments, links, images, or photographs or any other type of multimedia content on social networks, you must take into account that you must be the owner of the same, enjoy the copyright and intellectual property rights, or have the consent of the affected third parties. Any publication on the company's social network profile, whether text, graphics, photographs, videos, etc., that violate or are likely to violate morality, ethics, good taste, or decorum, and/or that infringe, violate, or break intellectual or industrial property rights, and/or any rights protected by Law, is expressly prohibited. In these cases, the company reserves the right to immediately withdraw the content and may request the permanent blocking of the user. The company will not be held responsible for the content that a User has freely published.

 

Cookies.

Access to this website may involve the use of cookies. Cookies are small amounts of information that are stored in the browser used by each user so that the server remembers certain information that it can later use. This information allows you to be identified as a specific user and allows your personal preferences to be saved, as well as technical information such as visits or specific pages you visit. Those users who do not wish to receive cookies or want to be informed before they are stored on their computer can configure their browser for this purpose.