This privacy policy of Cetursa Sierra Nevada S.A. (hereinafter, the Provider) informs the treatment we make of the personal data that they provide or will facilitate in their navigation, and the data protection policy that will be applied to such data, so that users determine freely and voluntarily if they wish to facilitate them, continuing navigation.

1. Data Controller:

   The Data Controller and the entity that owns the domain www.sierranevada.es (hereinafter, the Website), is the entity Cetursa Sierra Nevada S.A.

   Address: Plaza de Andalucía, s/n sierra nevada 18196 - Monachil (Granada)

   Phone: +34 958249161

   Email: dpd@cetursa.es

   Data Protection Officer Data:

   AUCON ASESORES, S.L.

   Phone: 958215099

   Email: dpd.cetursa@datagestion.net

2. Purpose of the processing and legitimation:

   The processing of your personal data through the Website pursues the following purposes with its corresponding legitimacy:

   • Book and buy

     The Provider offers information regarding different offers for the purchase of Ski passes, accommodation, activities, sports equipment, classes, discounts and packages, as well as the registration form to be part of the Sierra Nevada Club.

     In relation to the stated purpose your personal data will be processed to process your request, in order to provide you with the service that you hire correctly, or to be able to manage any type of request that, on the stated purpose, is made by the user.

     The bases that legitimize the processing of your personal data are: the execution of the contract, being necessary to cough the personal data requested, the express consent of the interested party who gives us through the marking of the corresponding box, and the fulfillment of legal obligations by the responsible.

     For the completion of the procedures indicated in the previous purpose it is possible that you leave the Website and end them in https://centrocomercio.sierranevada.es/,being part of the same Website and accepting this Privacy Policy.

   • Official Sierra Nevada app

     Through the corresponding form, you can register to use the official Sierra Nevada App, as well as download it for use on your mobile device. In relation to the stated purpose your personal data will be processed to process your registration and registration, the maintenance of the relationship and the download and maintenance of the specific software.

     The basis that legitimizes the processing of your personal data is the provision of the service or execution of the contract that the conditions of use of the App entail, being necessary all the personal data that we request to achieve the purpose described and the express consent you give us when checking the corresponding box.

   • Newsletter/newsletter Newsletters

     If you subscribe to any of our informational newsletters, present or future, as reported, your personal data will be processed to fulfill the purpose of sending you news and news from the Provider, as well as offers about products or services and any other commercial communication related to the Provider.

     The basis that legitimizes the processing of your personal data is the express consent you give us when filling out the subscription form and ticking the box created for this purpose. You can revoke your consent at any time through the link we offer you in any of the commercial communications you receive.

   • Private Area

     If you are a user of the Private Area or the Clients area we will process your personal data to manage registration and access, as well as communications in relation to it.

     The basis that legitimizes the processing of your personal data is the provision of the service itself.

   • Broadcast list via WhatsApp Sierra Nevada

     The WhatsApp Sierra Nevada is a channel of dissemination of news, offers and activities that may be of interest to you and a way of information of the state of the resort during the ski season. Through the WhastApp messaging app. your personal data will be processed to fulfill the stated purpose.

     The Provider informs you that it is not responsible for the processing of personal data carried out by the company that manages WhatsApp.

     The basis that legitimizes the processing of your personal data is the express consent you give us when filling out the corresponding form and ticking the box created for this purpose. You can revoke your consent at any time through the link we offer you in any of the commercial communications you receive.

   • Data stored during your visit

     When you browse the website, our servers generally store, among other data, information about your browser and the operating system you use, the website from which you visit us, other pages you visit and the date of your visit. With the exception of the IP address, personal data is only stored if you have voluntarily provided it to us, prior to, for example, in connection with an entry, a survey, request for quotation, user registration, commercial promotion.

     The basis that legitimizes the processing of your personal data is the express consent you give us when filling out the corresponding form, as well as our legitimate interest in the Website functioning properly.

4. Type of data processed:

   For the purposes set out in the previous section, it is a set of personal data that we can divide into the following sources and categories:

   • Directly provided data:

     At the time of submission through the various forms contained in the website.

     The user guarantees that the data provided for the provision of the requested services respond truthfully to the actual situation and that it will communicate any modification affecting them. Consequently, the user will be liable to the Provider for any damages caused as a result of the breach of the obligations assumed in this clause.

   • Data derived from the provision of the service itself.

     All data requested through the Website Forms marked with (*) are mandatory. The provision of the data for these purposes is voluntary, although, if not, the requested request cannot be answered or managed. Therefore, the communication of your personal data for this purpose is a necessary requirement for us to respond to the requests made.

5. Data retention period:

   Your personal data will be kept as long as they are necessary for the development of the contractual relationship, as well as to deal with eventualities and/or possible claims. After this period the data will be deleted in accordance with the provisions of the data protection regulations which implies its blocking, being available only at the request of Judges and courts, the Public Prosecutor's Office or the competent Public Administrations, in particular the Data Protection, during the limitation period of the actions that may derive to be subsequently deleted. The limitation periods vary depending on the type of service, for example purposes, in general the limitation period for most personal civil actions is 5 years.

   In addition to the general treatment of the previous point, the following particularities on data retention shall be observed:

   • Customer Data: 4-year retention period (Art. 66 and following from the General Tax Law), and 6 on ledgers and invoices (Art. 30 of the Commercial Code)
   • Data contained in the resume: a maximum of 1 year for future selection processes unless you state otherwise.
   • Data provided for the subscription to our Newsletter:from the time the User gives his/her express consent, until he/she withdraws it.

6. Your rights:

   The current regulations on the protection of personal data confer on you a series of rights in relation to the processing of data that our services involve and that we can summarize in the following:

   • Right of access: Know what kind of data we are dealing with and the characteristics of the processing we are carrying out.
   • Right of rectification: To be able to request the modification of your data because they are inaccurate or not truthful.
   • Right of portability: To be able to obtain a copy in an interoperable format of the data being processed.
   • Right to restriction of processing, in cases contained in the Law.
   • Right to erasure: Request the deletion of your data when the processing is no longer necessary.
   • Right to object: Request the cessation of sending of commercial communications in the terms indicated.
   • Right to revoke the consent given.

   For the exercise of these rights, you must send an express request, along with a copy of your ID or equivalent accreditation document, through the means listed below. If the request made does not receive a response in time and form on our part, or does not find this satisfactory, we inform you that the competent supervisory authority is the Spanish Data Protection Agency (www.aepd.es).

   • EMAIL addressed to the address dpd.cetursa@datagestion.net with subject matter Data Protection. This submission must be made from the email address you included in the form. Otherwise, they will not be shown to you, as you do not consider your identity sufficiently proven.
   • BY POSTAL MAIL: Addressed to the Address of the person responsible indicated in paragraph 1.

   On the website of the Spanish Data Protection Agency (AEPD) you can find a series of models that will help you in the exercise of your rights.

7. Communication of personal data

   In order to be able to fulfill the purposes described in paragraph 2, your personal data may be communicated to different providers of the Provider. For example, providers of hosting, sports equipment or messaging services such as WhatsApp, ticket buying and selling providers, or companies that provide us with any related services. The personal data communicated will be strictly necessary to fulfill the specific purpose and will only be communicated if necessary to comply with it.

   In addition, in order to comply with legal obligations, we may communicate your personal data to Public Administrations such as the Junta de Andalucía and to courts and tribunals, provided that such information is required in accordance with established legal processes or regulations that require us to do so.

   If your personal data is communicated in order to fulfill the purposes described, the Provider shall ensure that the entity to which they are communicating offers sufficient guarantees to implement appropriate technical and organisational measures for the processing to be in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights.

   Any other communication to third parties that is not necessary to fulfill the stated purposes, or in compliance with legal obligations, will require your prior express, informed and unequivocal consent.

8. Security Measures:

   In accordance with the provisions of the current regulations on the protection of personal data (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018 of 5 December, Protection of Personal Data and Guarantee of Digital Rights), we comply with all the provisions of the GDPR and LOPDGDD regulations for the processing of personal data of our responsibility, and manifestly with the principles described in Article 5 of the GDPR, by which they are treated in a lawful, fair and transparent manner in relation to the data subject and appropriate, relevant and limited to what is necessary in relation to the purposes for which they are treated.

   We have sufficient mechanisms in place to:

   • Ensure the permanent confidentiality, integrity, availability and resilience of treatment systems and services.
   • Restore availability and access to personal data quickly, in the event of a physical or technical incident.
   • Check, evaluate and assess, on a regular basis, the effectiveness of the technical and organizational measures implemented to ensure the safety of treatment.
   • Pseudonymize and encrypt personal data, if necessary.

   The Provider guarantees that it has implemented appropriate technical and organizational policies to implement the security measures established by the GDPR and LOPDGDD in order to protect its rights and freedoms, providing you with all the necessary information so that you can exercise the rights that assist you. The Provider has installed all the means and technical measures at its disposal to prevent the loss, misuse, alteration, unauthorized access and theft of the personal data you provide us. However, you should be aware that internet security measures are not impregnable.

9. Minors:

   Minors (14 years old) are prohibited from accessing and using the portal. The provider is not responsible for the veracity and accuracy of the data that it complies with. If you are underage, it is your sole responsibility to determine which services and/or content are appropriate for the age of the latter.

   There are computer programs that allow you to filter and block access to certain content and services and decide what are the contents and services of the Websites that minors may have access to and which may not.

10. Social networks:

    We have profiles on the main social networks and whose links you will find on the Website, being responsible for the processing of the data of our followers, fans, subscribers, commentators and other user profiles (hereinafter, followers). The processing of data that we will carry out with such data will be, at most, the one that the corresponding social network allows. Therefore, we can inform you by any permitted means about our news, activities, promotions. In no case will we extract data unless we obtain timely and expressly your consent to do so. When, due to the very nature of social networks, the effective exercise of your rights as a follower is subject to the modification of your personal profile, we will help and advise you to this end to the extent of our possibilities.

11. Duration and modification of the privacy policy:

    The Provider reserves the right to modify this Privacy Policy, in whole or in part, by posting the changes on the Website. It also reserves the right to change, delete or add, without prior notice, both the contents and services provided, as well as the way in which they are presented. Accordingly, the general conditions/Policies that are published at the time you access will be understood as in force and you must read them periodically.

    Regardless of the provisions, we may terminate, suspend or interrupt, at any time without prior notice, access to the contents of the Website, without the possibility on the part of the User to demand any compensation.