Data Protection Policy

**Last Updated:** May 8, 2026

1. Data Controller

Company: ONWAY HOLIDAYS, S.L.
Address: C/ Can Calafat 63, Local 62, Ed. Naves Blancas, Pol. Son Oms, 07199 Palma
Tax ID (C.I.F.): B16617896
Telephone: +34 640 06 15 79
Email: info@onwaytransfers.com


2. Introduction

This policy details how ONWAY HOLIDAYS processes personal data in compliance with the **General Data Protection Regulation (GDPR)** (EU 2016/679) and the Spanish Organic Law 3/2018 (**LOPDGDD**).

3. Data Protection Principles

ONWAY HOLIDAYS adheres to the following principles:

**Lawfulness:** Data is processed based on consent, contract execution, legal obligation, or legitimate interest.
**Good Faith and Purpose Limitation:** Data is collected for specific purposes and never used for unrelated ends.
**Minimization and Storage Limitation:** Only necessary data is processed, and it is kept only for the strictly required duration.
**Transparency:** Users are clearly informed about how their data is protected and used.
**Necessity of Access:** Only employees whose roles require it may access personal data.


4. What Personal Data Do We Process?

**Contact Details:** Name, surname, phone, email, and address.
**Identification:** ID card (DNI) or identification documents.
**Professional/Academic:** Training, qualifications, and experience.
**Financial:** Banking information.


5. Purpose: How is Your Data Used?

**Website Users:** To handle requests, complaints, or incidents; register providers/agencies; detect computer attacks; and send authorized commercial communications.
**Clients and Suppliers:** To manage commercial relations, provide contracted services, and handle administrative, accounting, and tax tasks.
**Employees/Job Applicants:** To manage labor contracts and evaluate CVs for personnel selection.
**Video Surveillance:** To ensure facility security.


6. Legal Basis (Legitimation)

**Consent:** For processing web inquiries and job applications.
**Contract:** For the execution of labor or commercial agreements.
**Legitimate Interest:** For responding to queries, protecting the website from attacks, and facility security (video surveillance).
**Legal Obligation:** For data processing required by law, where the subject cannot refuse.

### 7. Data Retention

Data is kept for the time necessary to fulfill the collection purpose. Afterward, it is kept **blocked** (inaccessible) during legal prescription periods to handle potential responsibilities or legal claims. Once these periods expire, the data is deleted.

### 8. Data Recipients

ONWAY HOLIDAYS does not transfer data to third parties unless there is a legal obligation. However, access is given to necessary support entities, such as:

* Collaborators and financial entities.
* Technology service providers (e.g., Microsoft Cloud storage).
* Public administrations (Tax Agency, Social Security).


9. Your Rights

You may exercise the following rights by sending a request with a copy of your ID to the Controller’s address or email:

**Access:** Know what data is being processed and for what purpose.
**Rectification:** Correct inaccurate or incomplete data.
**Erasure (Right to be Forgotten):** Request deletion when data is no longer necessary.
**Portability:** Receive data in a structured, machine-readable format.
**Limitation & Objection:** Limit processing or object to use for advertising/automated decisions.
**Withdrawal of Consent:** Revoke consent at any time without affecting prior lawfulness.
**Right to Complain:** File a claim with the Spanish Data Protection Agency (AEPD) at www.agpd.es.


10. Security and Communications

ONWAY HOLIDAYS has implemented technical and organizational measures to prevent loss, misuse, or unauthorized access. Email communications are strictly for managing requests and the company maintains a clear anti-spam position.

11. Social Media

The company manages profiles on **Facebook and LinkedIn**. Following or "Liking" these profiles implies acceptance of this privacy policy. ONWAY HOLIDAYS is responsible only for data processed within these social interactions and not for the general terms and conditions of the platforms themselves.