Data protection policy

Pullmantur Data Protection Policy

Introduction

At Pullmantur Cruceros, we are committed to protecting the personal information you share with us as it is essential for us to ensure and protect the privacy and confidentiality of your personal data, in accordance with the General Data Protection Regulation (EU Regulation 2016/679) (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

This statement establishes our privacy and data protection policy with respect to the information you provide us so that we can guarantee that: i) at any time, you may request the cancellation of your personal data provided that the legal requirements for data protection and conservation are met; ii) we undertake to comply with the obligation of secrecy of the personal data collected, the duty to store them and not communicate them to third parties without the express consent of the owner of the same; iii) we have adopted the necessary technical and organisational measures, taking into account the state of the art, the costs of their application, and the nature, scope, context and purposes of processing, in addition to the variable risks of probability and severity for the rights and liberties of individual persons, in order to ensure a level of security that is adequate for the detected risk, and ensure pseudonymisation and encryption of personal data and our ability to ensure the permanent confidentiality, integrity, availability and resilience of processing systems.

1. Controller

The following terms and conditions correspond to the company Pullmantur Cruises S.L. CIF [Corporate Tax ID number] B84581701. With corporate address at calle Mahonia, número 2. 28043. MADRID. Registered in the Companies Registry of Madrid in volume 22355 general, book O, folio 65, section 8, page number M-399166, Entry 2. CICMA-1878 as a wholesaler-retailer (hereinafter, Pullmantur Cruises).

2. DPO information

You may contact the DPO by sending an email to dpo.legal@pullmantur.es, or by using the “contact DPO” form available on the website or by writing to calle Mahonia, 2, Quinta Planta. 28043, Madrid.

3. Purpose of processing

The collection and use of personal data is only possible if you voluntarily provide us with your personal data. The different purposes for processing your data will be:

(i) Contracting a travel package (“the Contract”)

The personal data provided in the course of booking your travel package (the “Reservation”) will be collected, processed and used for the purpose of managing your reservation for the subsequent execution of the contract and for the purpose of maintaining the contractual relationship, managing, administering, providing, extending and improving the services as well as sending technical and operational information relating to the Contract, by any means, including email and/or equivalent means.

Upon making the Reservation, the personal data of other travellers may also be recorded. Therefore, please make sure that this information is provided with the consent of your travel companions.

The personal data of children and adolescents (minors below the age of 13) are collected, stored and used only for the purposes of managing or resolving the Contract or the Claim.

(ii) Special requirements

If health information is provided, it will be collected, processed and used in order to attend to your special needs (provided that they were previously confirmed) as well as to provide you with medical services on board and/or evacuation services, if necessary.

(iii) Management of claims

The personal data provided over the course of your claim (the “Claim”) will be collected, processed and used for the purpose of managing your claim as well as sending or requesting information related thereto and that is necessary for its proper resolution, by any means, including email and/or equivalent means. If health data is included in your claim, it will be processed in order to analyse and process the claim.

Upon making the claim, the personal data of other travellers may also be recorded. Therefore, please make sure that this information is provided with the consent of your travel companions.

(iv) Payment for services.

The personal data provided to execute your Contract shall be collected, processed and used in order to manage payment thereof. Should you choose to finance your Reservation by signing up for the VISA PULLMANTUR credit card (through a collaboration agreement between Pullmantur and Bankinter Consumer Finance, E.F.C., S.A.), your data will be transferred to said financial entity in order to manage the issuance of the VISA PULLMANTUR credit card and/or the financing of your Reservation.

(v) Satisfaction surveys.

The personal data provided in the course of booking your travel package (the “Reservation”) shall be collected, processed and used in order to improve the services we provide as well as better adapt and design our commercial offers through the creation of satisfaction surveys.

(vi) Commercial communications.

Should you give us your express and unequivocal consent, the personal data provided will be collected, processed and used in order to send you commercial communications, either on paper or by electronic, telephonic or telematics means, on products and services that are, at any time: i) marketed by Pullmantur; ii) marketed by any Pullmantur Group companies whose activities are carried out pursuant to Royal Legislative Decree 1/2007, modified by Royal Decree-Law 23/2018, of 21 December, in order to incorporate the transposition of Directive (EU) 2015/2302 on package travel and linked travel arrangements, as well as applicable international regulations. The User may choose, at any time, the channels or means by which he/she wishes to receive or not to receive the aforementioned communications.

In order to provide better service and improve control of the user’s data, Pullmantur has created the Centralized Register of Authorizations (CRA), the purpose of which is to store all the data provided by the User and process them exclusively for the purposes to which the User has given his/her express and unequivocal consent.

The User’s data in the Centralized Register of Authorizations includes the creation date, mail, phone number, name, surnames and registration channel.

The data added into the CRA will be collected through the following channels that Pullmantur has put in place for data collection: (i) telematic (downloads of estimates, online check-in, purchase process from cruises or other complementary services), (ii) in-person (call centre, on-board check-in process and call me back).

(vii) Profiles.

Should you give your express and unequivocal consent, the personal data provided will be collected, processed and used in order to carry out automated profiling in order to offer products adapted to your needs. For this purpose, Pullmantur informs you that: i) this analysis does not produce any legal effects or discriminatory consequences that may arise due to sensitive criteria, such as race or ethnic origins, political opinions or religious beliefs, health or sexual orientation, as this information is not included in the processing; ii) your right to obtain human intervention in the processing, to express your point of view, obtain an explanation of the decision reached based on the automated processing and to challenge such decision via direct communication with our DPO by emailing dpo.legal@pullmantur.es; iii) the logic applied is based on performing a proactive analysis of the risks and to apply technical statistics to your data as well as customer segmentation for the following purposes: a) to study products or services that may be adjusted to the User’s specific profile and contracted trip or make commercial offers that meet your needs, b) monitor the products and services contracted; c) carry out satisfaction surveys (done by Pullmantur or by third-parties hired by the former), by telephone or electronically, in order to evaluate the services provided; d) design new products or services, improve the design and usability of current products and services and define and improve users’ experiences.

The user also accepts that his/her customer profile data may be transferred by Pullmantur to Pullmantur Group companies for the above purposes, and that these companies may contact the user with relevant content. The user, if available, authorises the incorporation of the data that they have personally provided into the profiles created on him/her, such as: contact information (name, address, email); additional information (cruise type, itineraries, excursions, preferred routes); identification information (name, surnames, phone number, email); customer history (reception of offers, purchase data from other cruises or complementary services offered by Pullmantur); data from apps, websites or social networks (such as usage data from online searches or information requests).

3.1 Data retention period

Personal data provided for purposes (i) to (v) will be retained as long as the business relationship between the parties is maintained and for a maximum period of 5 years. However, if, due to its characteristics, the trip was affected by Law 10/2010, of 28 April, on the prevention of money laundering and terrorist financing, the data shall be retained for a maximum period of 10 years - after the contract ends.

Personal data provided for purposes (vi) and (vii) and that have been incorporated into the CRA will be retained as long as the data subject does not exercise his/her rights to erasure, objection, restriction of processing or revoke the consent granted.

4. Legitimacy for processing

The legal basis for processing personal data provided for purposes (i) to (iv) is compliance with the legal obligations based on the Contract signed pursuant to Royal Decree-Law 23/2018, of 21 December, in order to incorporate the transposition of Directive (EU) 2015/2302 on package travel and linked travel arrangements, as well as by the applicable international regulations, in particular, by the Athens Convention, of 13 December 1974, modified by the London Protocol, of 19 November 1976; by the text updated on 5 September 2013 of Regulation (EC) no. 392/2009 of the European Parliament and of the Council, of 23 April 2009, on the liability of carriers of passengers by sea in the event of accidents; by Regulation (EU) no. 1177/2010 of the European Parliament and of the Council, of 24 November 2010, concerning the rights of passengers when travelling by sea and inland waterways and by Regulation (EC) no. 2006/2004, and by the other applicable national and international regulations related to the individual services that make up the tourist package.

The legal basis for processing the personal data provided for purpose (v) is Pullmantur’s legitimate interest to improve its products through customer satisfaction surveys and the evaluation thereof through NPS (Net Promoter Score) measurements.

The legal basis for processing personal data provided for purposes (v) and (vi) is express and unequivocal consent from the data subject.

5. Recipients

5.1 Communication of data.

Pullmantur Cruises shall communicate personal data to third parties in the following cases:

a) Legal obligation: In order to comply with any legal obligations, Pullmantur shall communicate your personal data to third parties in accordance with:

  • U.S. Federal Legislation, if your journey has its origin, destination, stopover or flies over that country, your personal data in the current PNR (reservation) will be accessible to the Customs Department of the United States.
  • Order of the Ministry of Transport of the Russian Federation, of 19 July 2012, no. 243, your personal data and that of the rest of the passengers in the same booking reference shall be communicated to the Ministry of Transport of the Russian Federation by means of connection to the automated centralized database on passengers (ACDPDP).
  • Fraud detection and prevention entities.

b) Execution of the Contract: In order to comply with any obligation arising from the execution of the travel package contract entered into, Pullmantur shall communicate your personal data to third parties, such as:

  • Financial entities.
  • Suppliers of technological services.
  • Suppliers of services related to customer service.
  • Suppliers and collaborators of logistics, transport and delivery services.
  • Suppliers related to the contracted Cruise ship.
  • Royal Caribbean Cruises Ltd (USA) and to the rest of the Pullmantur group companies (see www.pullmantur.es).

In order to correctly process and resolve claims, we must communicate the necessary personal data to different suppliers of products that are involved in the claim or whenever it is necessary for the proper execution thereof.

5.2 Transfer of data to countries outside the EU (European Union)

To the extent necessary, we must transfer your data to non-EU recipients, ensuring that the recipient of the data guarantees an adequate level of data protection and that it does not violate any other legitimate interests. In order to ensure an adequate level of protection for the data recipient, please note that we use the contracts required by the GDPR and LOPDGDD.

We inform you that you have the right, free of charge and to the extent that legal requirements are met, to exercise your rights of access, rectification, erasure, data portability, objection, restriction of processing as well as the right not to be subject to automated individual decision-making.

In all communications whose purpose is to send advertising, you may exercise your right to object and to restriction of processing. In addition, to the extent that you have given your consent for data protection, you make revoke it at any time with effect for the future. To exercise these rights, or revoke the consent given, you may write to Pullmantur with the reference “GDPR Rights”, at its headquarters located at C/Mahonia, 2 (28043), Madrid or by email addressed to the DPO of Pullmantur (dpo.legal@pullmantur.es).

6. Right of access by the data subject

We inform you that you have the right, free of charge and to the extent that legal requirements are met, to exercise your rights of access, rectification, erasure, data portability, objection, restriction of processing as well as the right not to be subject to automated individual decision-making.

In all communications whose purpose is to send advertising, you may exercise your right to object and to restriction of processing. In addition, to the extent that you have given your consent for data protection, you make revoke it at any time with effect for the future.

To exercise these rights, or revoke the consent given, you may write to Pullmantur with the reference “GDPR Rights”, at its headquarters located at C/Mahonia, 2 (28043), Madrid or by email addressed to the DPO of Pullmantur (dpo.legal@pullmantur.es).

7. Claims to the data protection authority

The user can address his or her claims arising from the processing of his or her personal data to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.agpd.es).

8. Data source

If your reservation and subsequent contracting were done directly with Pullmantur, your personal data and that of your travel companions were obtained from the data subject.

If your reservation and subsequent contracting were done through a Retail Agency, we hereby inform you that your personal data and that of your travel companions were obtained from the same Retail Agency you made the reservation with.

This data protection policy was last modified in November 2019.