The companies responsible for processing your personal data are Parques de la Naturaleza Selwo, S.L. the company responsible for operating Selwo Aventura and Parques Reunidos Servicios Centrales, S.A., with registered office at Calle Federico Mompou 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain each acting individually as controllers and together as joint controllers (the "Controllers").
If you have any questions about the processing of your personal data or if you would like to ask for relevant parts of the Joint Controllers agreement, please contact the Data Protection Officer (DPO) by post at Calle Federico Mompou 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain or by e-mail on dpo@grpr.com.
The Controllers will process your personal data in accordance with the purposes detailed below and in accordance with the purpose of the channel through which you have provided them:
The personal data provided will be processed in order to manage the purchase or reservation of products and services of the Responsible Parties, process the payment of the same and send you by e-mail the confirmation and the corresponding receipt together with the relevant documentation for your visit and access to the park.
If during the process of purchasing or booking products and services you make use of promotions that are subject to compliance with specific conditions on your part (large family, discount code for certain groups, etc.), please note that at the ticket offices of the park we may ask you for the corresponding documentation to verify compliance with these conditions (large family card, official document accrediting membership of certain groups, DNI/NIE/Passport/Driving Licence, etc.), without this entailing the registration or storage of this information by the Responsible Parties.
Should unforeseen events or circumstances arise that may affect the product or service contracted by you (weather conditions, safety reasons, public health, etc.), the Responsible Parties may contact you by electronic means (e-mail, SMS, telephone calls) to inform you of the possible circumstances that may affect your visit.
Category of personal data processed: name, surname, email, telephone, transactional information derived from the purchase or reservation of products and services, proof and payment details, date of birth (to ensure that you are over fourteen (14) years of age, otherwise, in accordance with European legislation on data protection, we would need to obtain the consent of your legal guardians) and country (to ensure that any communication we send you for the purposes described above is in the language of the country you have provided to ensure that it is understood at all times).
Basis of legitimacy: the basis that legitimates the processing of your personal data is the execution of the contract entered into between you and the responsible parties for the purchase or reservation of products and services (terms and conditions of contract). Without such personal data, the purchase or reservation of products and services from the Controllers could not be formalised.
If you request information about products and services, assistance from agents for the purchase of the same or send us queries, suggestions, complaints, claims or incidents through any of the channels that the Responsible Parties make available for this purpose (specific form, telephone, email or web chat) the personal data will be processed to manage and respond to your request by email, telephone call or web chat depending on the means used by you to send us your request.
When the customer service is provided by telephone, the Controllers will also proceed to record the conversation held with you. This process is done to verify the quality of the attention we provide to you during the call.
Category of personal data processed: first name, last name, telephone number, e-mail, transactional information related to the purchase or booking of products and services (e.g. admission locator), date of birth (to ensure that you are over fourteen (14) years of age, otherwise, in accordance with European data protection legislation, we would need to obtain the consent of your legal guardians), country (in order to ensure that we deal with your request in the language of the country you have provided to ensure that it is understood at all times), voice (in the case of a telephone call) and any other information you provide in order to process your request correctly.
Basis of legitimacy: the data processing will be carried out for the implementation, at the request of the data subject, of pre-contractual measures or for the execution of the contract (terms of contract) to which you are a party for the purchase or reservation of products or services. Without the above-mentioned personal data, your request cannot be fulfilled.
In addition, the processing of personal data that may result from the recording of the call is necessary for the satisfaction of legitimate interests of the Controllers in order to periodically verify that our operators meet the internal quality standards required by the Controllers for the performance of their duties and to remedy any deficiencies detected in this regard. However, you may object to this processing at any time by sending your request to the DPO through any of the channels indicated in this privacy policy.
If you purchase or book any of our products or services, the Responsible Parties may send you surveys by electronic means (email, SMS, telephone calls) aimed at finding out your degree of satisfaction, your experience and your possible suggestions about the product or service contracted. Your opinion will be used to improve the processes, products and services of the Controllers.
Category of personal data processed: email, telephone, transactional information related to the purchase or reservation of products and services, country (in order to ensure that the survey is sent in the language of the country you have provided during the purchase process to ensure that the survey is understood at all times) and any other non-personal information that you provide through the surveys to which you respond.
Basis of legitimacy: this processing is necessary for the satisfaction of legitimate interests pursued by the Controllers in order to know the opinion of their customers regarding the products and services contracted and their possible suggestions in this regard. The Controllers understand that the rights and freedoms of their customers are not undermined and that there is a balance between the interests of both parties insofar as this processing makes it possible to achieve the purpose pursued (to know the opinion of the customers), which is necessary for the Controllers to improve their products, services and operational processes of the park and for the customers to obtain an improvement in the quality of their experiences. In addition, as a result of the volume of visitors that may visit the park, we understand that sending surveys electronically is necessary for the purpose described and there is no other mechanism that would achieve this purpose with the same effectiveness. Likewise, we understand that our customers may have a reasonable expectation regarding the performance of this processing based on the contractual relationship they have with the Controllers for the purchase or reservation of products and services, on the specific information provided by the Controllers during the purchase process and on the fact that this type of processing is carried out within a standard and common practice in the industry of companies providing services. Furthermore, in order to achieve this purpose, we remind you that we only process strictly necessary personal data of a non-sensitive nature, that we do not send surveys to children under fourteen (14) years of age and that we only contact our customers on an ad hoc basis and for a limited period of time.
However, you may at any time object to the processing of your personal data or exercise your other rights under data protection legislation in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.
Only if you expressly consent through the box included for this purpose in the different forms of this website or by clicking on the "send" button of the newsletter form, your personal data will be processed by the Responsible Parties to send you by any means, including electronic means (e-mail, SMS, telephone calls), communications about the European companies of the Parques Reunidos Group (all of them identified below in this Privacy Policy) which may include newsletters, discounts, promotions, relevant information or commercial information about their activities, events, products and services related to the leisure and hotel sector, including personalised communications after profiling and analysis of your preferences through automated decisions so that these communications may be of interest to you. The aforementioned personalisation will be carried out by means of profiling based on automated decisions made in accordance with the configuration and filtering of the parameters detailed below in our email marketing platform: demographic criteria based on the postcode and country provided, self-sourced transactional information related to your purchase history and the type of products and services purchased (tickets, season pass or park pass, experiences, parking or food and beverage related products) and inferred socio-economic parameters based on your age, the type of product or service you purchase and the analysis of your behaviour when you receive a commercial communication from the Controllers (whether or not you activate the purchase of the product or service offered to you through the commercial communication sent).
The indicated profile will not be used to make automated decisions with legal effects on you or that will significantly affect you in a similar way (economic effects, denial of services, discriminatory, disadvantages with respect to other customers, etc.) as it will only be carried out so that you only receive communications with commercial information that we consider to be more in line with your interests.
Category of personal data processed: the e-mail address and telephone number will be processed for sending commercial communications and the country to send these communications in the corresponding language. The personalisation parameters indicated above (demographic criteria, transactional information and inferred socio-economic parameters) will be processed so that you will only receive communications with commercial information that we consider to be most relevant to your interests.
Basis of legitimacy: this processing will only be carried out if you voluntarily give your express consent through the box provided for this purpose in the various forms on this website. We remind you that, in addition to the other rights granted to you by data protection regulations, at any time you may also withdraw your consent and request to unsubscribe from the sending of commercial communications, request not to be subject to automated individual decisions, including the creation of your profile, request human intervention in automated decision-making, express your point of view, resolve any doubts in this regard or contest them in accordance with the provisions of the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.
The Controllers will proceed to dissociate the postcode and country provided by you through the forms on this website from the other personal information in order to carry out quantitative and qualitative aggregated statistical reports to carry out market research and analysis that will allow us to evaluate our market positioning based on the geographical area from which the products and services are purchased and to make strategic business decisions (e.g. sales trends).
Category of personal data processed: aggregated information relating to postcode and country and previously dissociated from the other personal data provided.
Basis of legitimacy: this processing is necessary for the satisfaction of legitimate interests pursued by the Controllers to know and understand the geographical area from which their products and services are purchased in order to carry out the described purpose. The Controllers understand that the rights and freedoms of their customers are not undermined and that there is a balance between the interests of both parties (customers and Controllers) insofar as this processing makes it possible to achieve the purpose pursued (to evaluate our positioning in the market), which is necessary for the Controllers to make strategic business decisions and even improve their products, services and operational processes of the park, which would mean providing our customers with a better quality of their experiences. In addition, we understand that there is no other more moderate mechanism to achieve this purpose with the same effectiveness, as only basic non-sensitive information (postal code and country) is used and previously dissociated from any personal data that would allow the individual identification of customers during the course of this purpose. We also understand that our customers may have a reasonable expectation of this processing based on their contractual relationship with the Controllers for the purchase or booking of products and services, on the specific information provided by the Controllers and on the fact that this type of processing is standard industry practice for service providers.
However, you may at any time object to the processing of your personal data or exercise your other rights under data protection regulations in accordance with the procedure described in the section "What are your rights when you provide us with your personal data" included in this Privacy Policy.
Only if you provide your email address and give your express consent through the pop-up that will appear during the online purchase process in case of inactivity on your part, your personal data will be processed so that, if you do not complete the purchase or reservation of products and services previously selected by you, we can send you by email a reminder to complete the purchase or reservation of them. If you do not complete the purchase or reservation of such products and services, you will be sent a brief survey by email to find out why you do not wish to complete the purchase or reservation, which will help us to improve the web experience for our customers.
Category of personal data processed: e-mail
Basis of legitimacy: this processing will only be carried out if you voluntarily give your express consent through the pop-up that will appear during the online purchase process in case of inactivity on your part. We remind you that, in addition to the other rights granted to you by data protection regulations, you may also withdraw your consent at any time and request to unsubscribe from the sending of abandoned cart reminders in accordance with the provisions of the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.
If you share content on your social networks and mention the park's user account (for example, you mention us in stories or posts...), we may process your personal data to promote the image of the park on your social network profiles by sharing that publication where you mention the park.
Please note that we do not control the processing of personal data of users of social networks where the park has a registered account (Facebook, Twitter and Instagram). For more information on how and for what purposes the social media provider collects and processes personal data, and on users' rights and options to protect privacy, please refer to the applicable privacy policies of the social media provider.
Category of personal data processed: user account, image and/or voice of the social network user and/or third parties that may appear in your post.
Basis of legitimacy: this processing will only be carried out if you voluntarily give your express consent by replying in the affirmative to the direct message sent from the social network profile of the Controllers. We remind you that, in addition to the other rights granted to you by data protection regulations, you may also withdraw your consent for us to delete the publication at any time, either in accordance with the provisions of the section "What are your rights when you provide us with your personal data" included in this Privacy Policy, or by sending a direct message to our profile on the social network where we have shared said content.
Personal data will be processed in order to comply with legal obligations applicable to the Controllers as a result of the relationship with you as a customer and the processing of your personal data (for example, in the event that you request via the "Customer Web Portal" the issuance of an invoice).
Category of personal data that may be processed on the basis of applicable legal obligations: name, surname, first name, telephone number, email address, tax address, document proving the identity of the holder of the personal data or the status of customer (ID card, NIE, Passport, Driving License), large family card, bonus card, transactional information about your purchase, where applicable, data collected through the use of cookies or similar technologies (see our Cookies Policy) or any other mandatory information that may be required for compliance with our legal obligations, including at the request or request of the competent authorities.
Basis of legitimacy: compliance with legal obligations applicable to the Controllers under European Union law and/or the applicable domestic legal regime (compliance with legal obligations required by tax, civil, commercial, privacy, e-commerce or consumer and user protection regulations, among others). Without your personal data, the Controllers would not be able to comply with their obligations.
Activate the necessary mechanisms in order to prevent and detect the improper use of the website or potential fraud related to the purchase or reservation of products and services that could affect the Controllers themselves or their customers. If possible fraudulent activities related to the payment of products and services are detected, the Controllers may communicate the information on the affected transaction and the identification data of the person who carried it out to the owner of the platform used for the payment and, where appropriate, to the competent public authorities so that the relevant measures may be adopted in each case.
Category of personal data processed: transactional information, payment information and contact details provided during possible fraudulent purchase processes.
Basis of legitimacy: this processing is necessary for the satisfaction of legitimate interests pursued by the Controllers. The Controllers understand that the rights and freedoms of natural persons are not infringed and that there is a balance of legitimate interests insofar as this processing makes it possible to achieve the purpose pursued (to prevent and detect possible fraudulent activities) and is beneficial to customers and users of the website, as it allows the necessary measures to be taken to protect them from unlawful activities such as attempted fraud by third parties, for the Controllers themselves in order to prevent the improper use of the website and its products and services, and for society in general in order to ensure that fraudulent activities are discouraged and detected when they occur.
The Controllers use their own and third party cookies and similar technology (HTTP Cookies, Pixel Tracker and Local Shared) on this website and, as a result, process and store the information and personal data of users as they browse through the website, in accordance with the purposes and configuration parameters that are made available to users at all times.
You can read all the information about the use of cookies and similar technology used on this website and the processing of personal data resulting from it in our Cookie Policy.
Depending on the purpose for which we process your personal data, the applicable retention criteria will be those detailed below:
In any of the above cases, when the personal data ceases to be relevant for the purposes collected or, where appropriate, you withdraw your consent or exercise your right of deletion or opposition to the processing indicated, where appropriate, the Controllers may keep them duly blocked (identification and reservation of personal data, adopting technical and organisational measures to prevent their processing, including their visualisation) in order to, if necessary, make them available to the competent Public Administrations and in particular to the competent Data Protection Supervisory Authority, Judges, Courts or the Public Prosecutor's Office during the period of limitation of the legal actions that may arise from the relationship maintained with you or from the processing of your personal data and/or the legally established retention periods in accordance with European Union Law and/or the internal legal system. Once these periods have elapsed, your personal data will be physically deleted without the possibility of recovery.
Only if it is necessary to meet possible legal liabilities or to comply with legal retention periods, your personal data may be disclosed to competent Public Authorities and, in particular, to the competent Supervisory Authority for Data Protection, Judges, Courts or the Public Prosecutor's Office in accordance with European Union Law and/or the domestic legal framework.
In addition, the Controllers have suppliers who may also process your personal data to provide services related to the purposes about which you are being informed (including, but not limited to, companies operating in the following sectors: information security, customer relationship management and administration (CRM), technology, legal advice, marketing, customer service, multidisciplinary professional services, IT services, etc.). These providers will only access your personal data in order to carry out their services on behalf of and for the benefit of the Controllers, always following their instructions and under no circumstances will they use such data for their own purposes and/or for unauthorised purposes.
One of these providers is Salesforce, which provides services related to the cloud marketing platform and serves companies all over the world. Therefore, if you provide your personal data through any of the forms on this website, with the exception of the online sales form, and agree that we may send you commercial information or that the information contained in the surveys to which you respond may be processed as additional criteria for creating your profile in order to send you this commercial information, this provider will process your personal data in our name and on our behalf within the European Economic Area (EEA) and in compliance with the applicable European Data Protection Regulations. However, by way of exception, for example in the event of a disaster recovery situation (process to recover data and functionalities in the event of a systems disruption caused by a natural or man-made disaster), it may also provide its services through companies outside the EEA, which may require processing your personal data even in countries that do not offer a level of protection comparable to the level offered by the European data protection law (e.g. in the USA). Nevertheless, equally in the latter case, the Controllers have entered into binding contractual commitments with Salesforce and have ensured that appropriate security measures are in place to ensure that their personal data are at all times processed with an adequate level of protection comparable to that required in the EEA (standard contractual clauses approved by the European Commission on data protection in accordance with the European Data Protection Regulations (GDPR), additional security measures in accordance with the European Court of Justice's decision C-311/18 and subject to certification mechanisms). For further information, please do not hesitate to contact the Data Protection Officer at any of the addresses (postal or email) indicated in the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy. Likewise, please note that, you may withdraw your consent and/or exercise your rights at any time in accordance with the provisions of the section indicated in this Privacy Policy or request to unsubscribe from receiving commercial communications through the means that will be made available for this purpose in each of the commercial communications that you will receive if you give your express consent to do so.
Remember that the purpose of "disseminating the content of users who have previously mentioned or tagged the park on social networks" means that any person with a user account on the social network where the publication is shared can view the personal data referred to therein. Apart from these cases, your personal data will not be communicated to third parties or be the subject of international transfers unless it is necessary for compliance with European Union law or domestic law.
If you expressly agree to receive marketing information about any of the companies of the Parques Reunidos Group, please note that these are based in the European Union and are primarily engaged in the management and exploitation of fun parks, aquatic parks, zoos, leisure centres and travel agency services (e.g. sale of ticket+hotel packages). The European companies of the Parques Reunidos Group are:
You may exercise your right of access, rectification, opposition, deletion, limitation, portability and, where appropriate, not to be subject to automated individual decisions, including profiling, by sending your request in writing to the attention of the DPO to the postal address located at Calle Federico Mompou 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain or to the e-mail address dpo@grpr.com. If there are reasonable doubts as to the identity of the holder of the personal data, a copy of an official document (DNI/NIE/Passport) may be requested in order to process the request.
For those processing operations that are based on obtaining your consent, we inform you that, at any time, you may withdraw your consent or object to the processing through the procedure detailed in the previous paragraph. Furthermore, we remind you that, if you have expressly consented to receive communications containing commercial information, we also offer you the possibility of unsubscribing through the means that will be made available to you for this purpose in each of the commercial communications that you may receive. Likewise, we remind you that where appropriate, you may also ask us not to be subject to individualised decisions based exclusively on the automated processing of your personal data for profiling or request human intervention, express your point of view, resolve any doubts or contest them by sending your request to the DPO in accordance with the procedure described in the previous paragraph.
Los datos personales tratados por los Responsables son facilitados directamente por usted como titular de los mismos a través de esta página web y/o durante la relación mantenida con usted.
Si usted facilita datos personales de terceros, se obliga a recabar el consentimiento expreso e informado de los titulares de los mismos para facilitar sus datos personales a los Responsables conforme a las previsiones que se describen en la presente Política de Privacidad.
Si fuera necesario facilitar a los Responsables información sobre alergias y/o intolerancias (por ejemplo, para configurar los menús que podrán servirse durante un evento o actividad previamente contratada por usted), recuerde que sólo deberá facilitar el número de personas y el tipo de alergia y/o intolerancia y no datos personales que permitan identificar individualmente a la persona con dicha alergia y/o intolerancia.
Minors under fourteen (14) years of age are not authorised to purchase or book any of the products or services offered on this website.
Notwithstanding the foregoing, if as a result of the purchase or booking of any of the products or services offered through this website (for example, birthday celebrations or communions), or the sharing of content on social networks mentioned to the park, you freely and voluntarily decide to provide personal data of a minor under fourteen (14) years of age (for example, to theme the space where the contracted services may be carried out), you are not authorized to purchase or book any of the products or services offered on this website, to theme the space where the contracted services may be carried out), you as the holder of the parental authority or legal guardian of the minor, must give your express and informed consent for the Controllers to process the personal data of the minor within the framework of the contractual relationship maintained with you as a result of the purchase or contracting of such products or services in accordance with the provisions of this Privacy Policy.
Usted puede presentar una reclamación ante la Agencia Española de Protección de Datos para salvaguardar sus derechos cuando así lo estime oportuno. Sin perjuicio de lo anterior, le recomendamos que se dirija previamente a la DPO, a través de la dirección de correo electrónico dpo@grpr.com o bien a través de la dirección postal Calle Federico Mompou, 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, España para poder ayudarle con su solicitud y resolver cualquier cuestión relacionada con el tratamiento de sus datos personales.
Last updated: 15 July 2024