Data Protection Policy

Data Controller

ONWAY HOLIDAYS, S.L.
Address: C/ Can Calafat 63, Local 62, Ed. Naves Blancas, Pol. Son Oms, 07199 Palma
Tax ID (C.I.F.): B16617896
Telephone: +34 640 06 15 79
Email: info@onwaytransfers.com

Introduction

This document details the terms of the privacy policy that ONWAY HOLIDAYS has established for the processing of your personal data in compliance with current regulations (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter GDPR, and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, hereinafter LOPDGDD.

 

Data Protection Principles

ONWAY HOLIDAYS adheres to the following principles:

• Principle of lawfulness : personal data will be processed to the extent that at least one of the conditions provided for lawful processing is met: (i) when the data subject has given consent; when the processing is necessary for ( ii ) the performance and management of a contract, ( iii ) compliance with a legal obligation, or ( iv ) the pursuit of a legitimate interest of the company or of third parties.
• Principle of good faith and purpose limitation : personal data will be collected and processed for specific purposes communicated to the interested party and, in no case, for different purposes.
• Principle of minimization and limitation of storage : only personal data that is adequate, relevant and not excessive will be processed, and for the time strictly necessary for their respective purposes.
• Principle of transparency : data subjects will be clearly informed about the main characteristics and protection measures of their personal data, in particular, about the respective purposes of processing and possible transfer to third parties.
• Principle of need of access : only employees and collaborators whose functions require it will have access to the personal data processed by ONWAY HOLIDAYS.

 

WHAT PERSONAL DATA DO WE PROCESS?

• Contact information: name and surname, telephone number, email address, address
• Identifying information of natural persons: DNI / Identification document.
• Academic and professional information: education and qualifications, professional experience.
• Bank details.

WHAT HAPPENS IF YOU PROVIDE US WITH DATA FROM THIRD PARTIES OR IF A THIRD PARTY HAS PROVIDED US WITH YOUR DATA?

• If you provide us with Personal Data of third parties, you guarantee that you have informed them about the purposes and the way in which we need to process their personal data.
• If a third party has provided us with your data, we will process it within the purposes set out in this Privacy Policy.

ORIGIN

All data concerning the interested party processed by ONWAY HOLIDAYS has been freely provided by the interested party.

If the application includes personal data of individuals other than the applicant , the applicant must inform those individuals of the information contained in the preceding paragraphs before submitting the application. ONWAY HOLIDAYS disclaims all liability for failure to comply with this requirement.

By providing your data through any of the means provided, you guarantee the veracity of the data provided and undertake to communicate any changes that may occur in them.

Please remember that when we ask you to fill in your personal details to grant you access to a feature or service, we will mark some fields as mandatory, as this information is necessary for us to provide the service in question. Please note that if you choose not to provide this information, you may not be able to access those services or features or submit your request.

 

In which sections of the website do we collect your data:

• Through the registration form on the Website
• You can write to us via email and/or request any information you deem necessary to clarify any doubts related to our services or the operation of our website.

PURPOSE: WHAT IS YOUR PERSONAL DATA USED FOR?

Users / browsers of the website of the Controller.

We will process your personal data provided through our web forms for the following purposes:

• To address requests, complaints and incidents submitted through our contact channels incorporated on the website.
• Register as a supplier or agency.
• Understanding user behavior on the website in order to detect potential cyberattacks on our website.
• Comply with the legal obligations that are directly applicable to us and regulate our activity.
• To protect and exercise our rights or respond to claims of any kind.
• In your case, sending commercial communications relating to the goods or services that make up our activity, and/or news or newsletters related to our sector.

Customers and suppliers.

We will process your personal data provided for:

• Managing the business relationship.
• The provision of the services you have contracted us for.
• Administrative, accounting and tax management.
• To address requests, complaints and incidents submitted through our established contact channels.
• Understanding user behavior on the website in order to detect potential cyberattacks on our website.
• In your case, sending commercial communications relating to the goods or services that make up our activity, and/or news or newsletters related to our sector.
• Comply with the legal obligations that are directly applicable to us and regulate our activity.
• To protect and exercise our rights or respond to claims of any kind.

Employees

• Administrative, accounting and tax management of employees.

Job seekers

• To assess and, where appropriate, manage your curriculum vitae for selection processes that match your professional profile and to carry out the necessary actions for the selection and hiring of personnel.

Video surveillance

• The facilities are secure, equipped with presence detectors with cameras that record images when the alarm is triggered.

LEGAL BASIS. WHY DO WE USE YOUR PERSONAL DATA?

Users / browsers of the website of the Controller.

• In the consent you have given us to process your data for the purposes indicated. Refusal to provide your personal data will make it impossible to process your data for the aforementioned purposes.
• To comply with our legal obligations. In this case, the data subject may not refuse the processing of their personal data.

Customers and suppliers.

• The application, at the request of the interested party, of pre-contractual measures (budgets, order forms, service offers…).
• Performance of a contract to which it is a party or application of pre-contractual measures.
• Legitimate interest (sending requested information, responding to inquiries...).
• To comply with our legal obligations. In this case, the data subject may not refuse the processing of their personal data.
• In our legitimate interest to protect our image, business, and reputation by preventing attacks on our website, the data subject may not refuse the processing of their personal data, although they may exercise, where applicable, the rights recognized in section eight of this policy.

Employees.

• Execution of an employment contract.

Job seekers.

• In the consent you have given us to process your data for the purpose of analyzing it and, if it meets our needs, starting the selection process.

Video surveillance

• Legitimate interest of the Controller.

DATA RETENTION.

The personal data you provide will be kept for as long as necessary to fulfill the purpose for which it was collected. Once this period has ended, we will keep your data properly stored and protected for the legally required limitation periods. Once any potential legal action has expired, we will proceed to delete your personal data.

Once blocked, your data will be inaccessible to ONWAY HOLIDAYS, and will not be processed by it, except to make it available to Public Administrations, Judges and Courts, to address possible liabilities arising from the processing, as well as for the exercise and defense of claims before the Spanish Data Protection Agency.

AUTOMATED DECISION-MAKING AND PROFILING

The website does not make automated decisions or create profiles.

WHO DO WE SHARE YOUR DATA WITH?

To fulfill the purposes indicated in this Privacy Policy, it is necessary for us to give access to your personal data to entities that support us in the services we offer you, namely:

• ONWAY HOLIDAYS collaborators.
• Financial institutions
• Technology service providers
• Social security
• Tax Agency

Apart from the aforementioned exceptions, ONWAY HOLIDAYS will not transfer personal data to third parties, except when legally required. However, if data is transferred to a third party, the user will be informed beforehand and their express consent will be requested. The entity responsible for the database, as well as those involved in any phase of the processing and/or the entities to whom the data has been communicated—always with the corresponding authorization granted by the user—are obligated to maintain professional secrecy and to adopt the necessary levels of protection and technical and organizational measures within their reach to guarantee the security of personal data . This includes preventing, to the extent possible, unauthorized access , unlawful modification, theft, and/or loss of data, in order to ensure the appropriate level of security for the files, according to the nature and sensitivity of the data provided by users of this website.

We would also like to inform you that our organization uses cloud-based information storage systems through the service provider Microsoft, a technology company that currently offers all the necessary data protection guarantees. For this reason, Microsoft is listed on the official lists of entities with security guarantees, which you can consult at the following link: https://www.privacyshield.gov/welcome

During the treatment, ONWAY HOLIDAYS will carry out the legally required transfers, management with banking entities and organizations or persons directly related to the responsible party.

INTERNATIONAL DATA TRANSFERS

ONWAY HOLIDAYS does not perform any International Data Transfers.

RIGHTS YOU CAN EXERCISE

You can exercise any of the rights explained below by simply telling us the reason for your request and the right you wish to exercise. If we deem it necessary to verify your identity, we may ask you for a copy of your identification document.

What are your rights when you provide us with your data?

Right of Access:

By exercising this right, the interested party can find out what personal data of theirs is being processed by ONWAY HOLIDAYS, its purpose, its origin or its possible transfer to third parties and, in such case, has the right to access it.

Right of Rectification:

The interested party will have the right to request ONWAY HOLIDAYS to rectify any inaccurate or incomplete data, specifying in the request which data they wish to have modified.

Right of Cancellation:

The interested party shall have the right to request ONWAY HOLIDAYS to delete personal data concerning him or her when, among other reasons, they are inadequate or excessive or are no longer necessary for the purposes for which they were collected.

Right to Portability:

The interested party may receive their personal data provided in a structured, commonly used and machine-readable format, and be able to transmit it to another controller, provided that this is technically possible.

Right to Restriction of Processing:

The interested party, in certain circumstances, may request the limitation of the processing of their data, in which case we will only keep them for the exercise or defense of claims.

Right of Opposition:

The interested party, with the right to object, may object to the processing of their data in cases such as: advertising and commercial prospecting activities or when such processing has as its purpose the adoption of a decision relating to you based solely on an automated processing of your personal data.

Right to be forgotten:

The data subject may request the erasure of personal data without undue delay when any of the circumstances described apply. For example, unlawful processing of data, or when the purpose for which the data was collected or processed no longer exists.

How to exercise the above rights?

The interested party may exercise their rights by sending a written request, with the reference “Data Protection”, attaching a copy of their ID card or equivalent identification document to:

• the address, detailed above, of the Data Controller, or
• the email account detailed above in the Contact of the Responsible Party

Right to withdraw consent:

The interested party may revoke at any time the consent given for the processing of their data by writing to ONWAY HOLIDAYS at the address detailed above of the Data Processor, or to the email address detailed above in the Data Processor's Contact, with the reference Data Protection, attaching a copy of their ID card or equivalent identification document, without this revocation of consent affecting the processing based on the consent prior to its withdrawal.

Right to lodge a complaint with the Supervisory Authority:

In any case, the interested party may, if they believe that their rights have been violated, file a complaint with the Spanish Data Protection Agency, located at Calle Jorge Juan 6, 28001 Madrid, telephone 901 100 099, and website www.agpd.es.

SECURITY

The data controller has adopted the legally required levels of security for the protection of Personal Data and has implemented all available technical means and measures, in accordance with current technology, to prevent the loss, misuse, alteration, unauthorized access, and theft of the Personal Data provided, in order to ensure its privacy. The controller also undertakes to comply with the obligation of confidentiality regarding the data included in the file.

The user is assured of the confidentiality and duty of secrecy of all those who process the data on their behalf . Notwithstanding the foregoing, the user acknowledges that the security of communications over the internet is not guaranteed.

The user's personal data is processed by ONWAY HOLIDAYS under the strictest confidentiality, adopting the necessary technical and organizational measures to prevent the loss, misuse, alteration, unauthorized access and theft of the personal data being processed.

For the management and storage of data, it uses Information Systems that involve the international transfer of information to third countries.

COMMUNICATIONS

Communications made by email or any other electronic means will be those necessary to process your request.

Under no circumstances will your data be used for any other purpose or shared with third parties. ONWAY HOLIDAYS is firmly against spam and will therefore never use your personal data to send unsolicited commercial communications without your consent.

However, they will be those that have been expressly consented to or authorized by the recipients in accordance with Law 34/2002, of July 11, on Information Society Services and Electronic Commerce, except as provided for in Article 21.2 of this same Law, as amended by the First Final Provision of the new General Telecommunications Law.

SOCIAL MEDIA POLICY

ONWAY HOLIDAYS maintains a corporate profile on the social networks Facebook and LinkedIn. Therefore, in accordance with the Personal Data Protection regulations, ONWAY HOLIDAYS is the "Data Controller" of your data due to the existence of these social media profiles and the fact that you follow us and we may follow you.

This means that if you decide to join our corporate profile as a follower or by liking our content or profile, you accept this policy, which explains your rights and how we use your data.

As the data controller, we guarantee confidentiality in the processing of your data and compliance with your rights, always under the effects of the aforementioned regulations.

Furthermore, we would like to inform you that we will use these social media platforms to announce news or relevant information related to the services we offer, or on topics we believe may be of interest to you. Using the functionalities of these platforms, you may receive news with this type of information on your timeline or profile.

However, we also inform you that there is no link between ONWAY HOLIDAYS and said platforms or social networks, so you will accept their usage policy and conditions once you access them and/or validate their notices, terms and conditions in the registration procedure, ONWAY HOLIDAYS is not responsible for the use or processing of your data that is done outside of the strict relationship and provision of services indicated in this policy.

VERSIONS OF THE DATA PROTECTION POLICY

ONWAY HOLIDAYS reserves the right to modify its Data Protection Policy at its discretion, due to regulatory changes or changes in organizational practices. Such modifications will be published on this website, providing users with the necessary resources to access and read them . In any case, the relationship with users will be governed by the rules in effect at the time of access to this website.