PRIVACY POLICY

By means of this Privacy Policy, Andorra Turisme informs you of the personal data that we collect through the services offered by this website, how we process them, and the rights that the applicable Personal Data Protection regulations grant you in relation to these data and our processing thereof.

Applicable regulations

The following regulations apply:

Qualified Law 29/2021, of 28 October, on personal data protection of the Principality of Andorra (hereinafter, the LQPD),
Decree 391/2022, of 28 September, approving the Regulations for the application of the LQPD,
Decree 45/2023, of 25 January, approving the Regulation amending the Regulation implementing the LQPD, and
Regulation (EU) 679/2016 of the European Parliament and of the Council, of 27 April, on the protection of natural persons with regard to the processing of personal data and the free movement of such data (hereinafter, ‘the GDPR’).

We have structured this policy into the following drop-down menus to make it easier for you to access points of interest, although we recommend that you read it in its entirety:

1- To whom does this Privacy Policy apply?

This Policy applies to visitors to our website, and to all people whose personal data may appear on our website or in the context of the services offered by this website.

2- Who is responsible for the processing of your personal data?

The sole person responsible for the processing of your personal data in accordance with what is indicated in this policy is:

ANDORRA TURISME SAU (Andorra Turisme), with tax ID no. NRT A-707655R and with registered office at Edif. Ràdio Andorra, Av. de la Bartra, s/n AD200 Encamp (Principat d’Andorra).

We have an external Data Protection Officer, ̶ Win2win, SLU, an Andorran company specialised in privacy and personal data protection, whom you can contact by e-mail at dpo@andorraturisme.ad.

Andorra Turisme is not responsible for the activities conducted by other websites, even if accessed through links on our website, including the hotels.visitandorra.com subdomain. We therefore strongly recommend that you carefully read the information provided by these other managers before giving them your personal data (especially the privacy and cookie policies of each website you visit), and that you communicate with this manager if you have any concerns or questions.

3- What do we use your data for and what is the lawful basis for using such data?

To join our AndorraWorld Fans community

You can find all the information about the terms of use of our community and everything related to your privacy here.

The basis for this processing activity is the execution of the community membership contract that you sign when you send us the application form.

To help you to search for a hotel in Andorra

We collect the data you provide in the hotel search engine to anonymously send to the ObeHotel platform, owned by the company Efimàtica Assessorament Informàtic SL, which groups together the accommodation offer of most of the hotels in the Principality of Andorra. The subdomain hotels.visitandorra.com is managed directly by the aforementioned company, and the hotel you select within this platform will be responsible for processing any and all personal data you provide in order to formalise your booking. For more information about such processing, we recommend consulting the privacy policy of the hotel, which you will find directly on that platform.

We do not store your data and the basis for us to send them to the booking platform is your consent, which you give us by successfully completing the fields in the hotel search engine on the home page of our website, and our legitimate interest in providing you with an access point to the booking platform.

To manage event tickets purchased through our website

We collect the data you provide in connection with the booking or purchase of tickets in order to process your purchase and to communicate to you by e-mail or telephone any related information that may be of interest to you, as well as to manage and issue documents evidencing the purchase of tickets and any related communications. We may also use the data you provide during the purchase or booking of the ticket to monitor whether or not the event is accessed using that ticket, and to extract statistics in relation to interest in the event in question.

The basis for the processing is the ticket purchase contract, and our legitimate interest in improving the quality of the events we manage or promote through the sale or booking of tickets through our website.

To send you information, promotions and discounts of interest (customised newsletters)

We collect your e-mail address and the information you provide about yourself and your interests when you subscribe to our newsletter service, or when you change those interests in relation to your subscription, in order to inform you about news, events, exclusive content, discounts or promotions and many other things we have to tell you about in accordance with your interest profile, so that you can make the most of your stay in Andorra. The management of these communications involves user profiling, which consists of using the personal data provided and, in your case, browsing information from our website, Facebook, Instagram, YouTube and Twitter, to evaluate certain aspects related to your preferences in order to offer you commercial communications that are appropriate to your profile.

The lawful basis of this processing is your consent, which you can withdraw at any time through the link in each e-mail, without this withdrawal having any other consequence than ceasing to receive the information that we were sending you and being able to take part in promotions reserved to our subscribers.

To respond to your requests or complaints

We collect the personal data you provide in your e-mails, by telephone or through the forms on the contact page, or requests to exercise your rights, in order to respond to your requests or complaints in relation to our services or the rights you have in relation to your personal data.

The lawful basis of this processing is the consent that you give when you send or give us these data, and our legitimate interest in responding to you.

To ensure the correct operation of our website (functional cookies)

We use functional cookies to ensure the correct operation of our website.

As these cookies are necessary for the proper functioning of the website, the use of such cookies does not require your express consent, and the basis that legitimatises their use is our legitimate interest in being able to offer you our website services.

You can find out more about these cookies in our Cookie Policy.

To extract aggregate statistics on the use that visitors make of our website (analytical cookies)

We use analytical or statistical cookies to measure the success of our campaigns, identify the most and least visited pages, and analyse what content is of most interest to our visitors, all with the aim of improving the services we offer you through our website.

When it comes to analytical cookies, we will not use them without your consent. We will ask for your consent through a window that you will see in the bottom left-hand corner of our pages if you still have not set your cookies preferences with us. You can change your preferences or withdraw your consent using the cookie settings button that you will see at all times at the bottom of our website. If you do not give us your consent, we will try to obtain statistics to improve our services by working with completely anonymous data and, as we said, producing aggregated results.

You can find out more about these cookies in our Cookie Policy.

To send you personalised direct marketing (advertising cookies)

We use proprietary and third-party advertising cookies to send you personalised marketing.

When it comes to advertising cookies, we will not use them without your consent. As with analytical cookies, we will ask for your consent through a window that you will see in the bottom left-hand corner of our pages if you still have not set your cookies preferences with us. You can change your preferences or withdraw your consent using the cookie settings button that you will see at all times at the bottom of our website. If you do not give us your consent or you withdraw your consent, nothing will happen, except that your visit to our website may not be used to improve the marketing you receive.

You can find out more about these cookies in our Cookie Policy.

For other purposes that are not incompatible with the above purposes

We may use your personal data for other purposes that are not incompatible with the above purposes (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) where permitted by applicable data protection regulations and, of course, acting in accordance with these and all other applicable regulations.

4- With whom can we share your personal data?

Andorra Turisme does not transfer your personal data, unless:

You ask us to do so
We are legally obliged to do so (for example, we are legally obliged to provide copies of invoices to the Tax and Border Department of the Government of Andorra when requested to do so)
We need to protect your rights, our rights, the rights of our employees or the rights of third parties (which may require disclosure to the police for security purposes or to health authorities to prevent the spread of disease, for example, for contact tracing purposes)
We need them to be processed by our service providers, on our behalf (e.g. 4Tickets.es for ticket management or companies specialised in sending newsletters, or for the management and maintenance of our information systems)
We shall be co-responsible for the collection of data, so that, always with your consent, other entities process them on their own behalf. This is the case of:
- Google Ireland Ltd, with registered office at 4 Gordon House Street, Barrow - Dublin, Ireland, to which we have entrusted the data processing of the cookies necessary to use its Analytics services. Google Ireland Ltd acts as an independent data controller for all processing it conducts on your behalf in accordance with its privacy policy. We transfer data to Google Ireland Ltd on the basis of the data protection agreement that this company located in the EU includes in the addendum to the standard contract for countries in which the GPDR applies, as is the case of Andorra, in which we add the additional safeguard of activating the anonymisation of the IP addresses that collect the cookies. In our cookie policy you will see which analytical and advertising cookies we offer you and how to configure them.
A company outsourced by us may have access to personal data on our website or in our systems from time to time, even if they do not need to process it on our behalf. This is the case, for example, of the web development and maintenance company or some of the services of our IT service providers. Since they could access data from Andorra Turisme, they have signed a service provision contract that obliges them to maintain the same level of privacy that we have at Andorra Turisme.
We need to protect or defend the rights or property of Andorra Turisme.

Any international transfer that we may need to make will comply with the provisions of the regulations in force that apply to Andorra Turisme at any given time.

5- How long do we keep your personal data?

Andorra Turisme retains your personal data exclusively for the duration of the processing that requires them and, thereafter, to comply with the legal obligations that apply to us at any given time (including the obligation to be able to demonstrate that we have complied with your request to destroy personal data).

We will destroy any unnecessary or disproportionate personal data about you that may appear in e-mails and instant messages we receive, or through forms on our website as soon as we receive it.

We will destroy (and rectify) any personal data that we find to be inaccurate as soon as we verify its inaccuracy.

If you send us a copy of an identity document, we will destroy this copy as soon as we have verified that it fulfils the function for which you sent it to us.

Likewise, the profiling data we use to personalise the information you receive through our newsletters will be irreversibly anonymised when you cancel your subscription.

Where we do not have a legitimate purpose for processing some of your personal data, we will delete or anonymise them, and if this is not possible (for example, because they are backed up), we will store them securely and block them to isolate them from further processing until deletion is possible.

6- What rights do you have?

You have the right to obtain confirmation as to whether or not Andorra Turisme holds any of your personal data.

We remind you that, when we share personal data with other data controllers, you will have to exercise your rights directly against such data controllers following the instructions provided in their own privacy policies. Specifically, in relation to the data that our cookies share with Google, we would like to inform you that you can install in your Chrome, Internet Explorer, Safari, Firefox and/or Opera browser the plug-in to not send Google Analytics data or Google Ads to Google Inc.

Below we explain what other rights you have and how to exercise them.

Your rights

In accordance with the provisions of the LQPD and the GDPR, you can request to exercise the following rights:

Access to your personal data.
Rectification of your personal data, specifying the reason.
Deletion of some or all of your personal data.
Restriction of data processing, specifying the reason for the restriction.
Objection to processing of your personal data.
Data portability when the lawful basis for collecting data was your consent or a contract.
The right not to be subject to automated individual decisions.

The consent given, both for the processing and for the transfer of the data subjects’ data, may be revoked at any time by communicating such revocation to us, just like any other right, as indicated in the following section. This revocation will in no case be retroactive.

Where and how to exercise your rights

You can exercise your rights:

By sending a written request to Andorra Turisme, addressed to our postal address indicated in Section 4 of the policy, indicating a means of contact so that we can respond to your request, or ask you for further information if necessary. We would be grateful if you could indicate on the envelope ‘Exercise Personal Data Protection Rights’.
By sending the form associated with the right you wish to exercise to the e-mail address dpo@andorraturisme.ad, indicating ‘Exercise Personal Data Protection Rights’ in the subject line. You will find these forms further on in this section of the Privacy Policy.

In both cases, if we are unable to verify that you are who you say you are, we will ask you to please send us proof of your identity, to ensure that we only reply to the data subject or their legal representative.

If the person sending the e-mail does so in the capacity of representative of the data subject, the representative must prove their authority to do so through documents or legal instruments that correctly identify the data subject and the representative and specify the order or procedure by which representation is delegated.

Likewise, and especially if you consider that you have not obtained full satisfaction in exercising your rights, we inform you that you may file a complaint with the national data protection authority in your country, or by contacting the Andorran Data Protection Agency (APDA).

Forms for exercising your rights

In order to make it easier for you to exercise your rights, we recommend that you use the appropriate application form below:

7- What responsibilities do you have?

By providing us with your details, you guarantee that they are accurate and complete. Likewise, you confirm that you are responsible for the veracity of the personal data that you have provided us with and that you will keep such data suitably updated so that they correspond to your actual situation, and that you are responsible for any false or inaccurate personal data that you may provide us with, as well as for any direct or indirect damages that may arise from data inaccuracy.

You may not provide us with other people’s personal data unless it is justified in relation to the services you request from us. In any case, if you provide us with the personal data of third parties, you are responsible for informing such third parties prior to providing us with their personal data. The information you give to third parties whose data you provide to us must include all the provisions of this Privacy Policy, and you are responsible for the lawfulness of such personal data and for conveying to data subjects the rights they have in relation to their personal data.

In cases where you are required to provide us with personal data of a child under the age of 16 or of a person whose rights are restricted, in doing so you are obliged to obtain the consent of the holders of parental authority or guardianship. Without this consent, you are prohibited from providing us with any personal data relating to such persons.

8- How do we protect your personal data?

We are fully committed to protecting your privacy and your personal data. We have drawn up a list of all the personal data processing activities conducted by Andorra Turisme, we have analysed the risk that each of these activities may pose to you, and we have implemented the appropriate legal, technical and organisational safeguards to prevent, insofar as possible (since zero risk does not exist), the alteration of your personal data, their misuse, loss, theft, unauthorised access or unauthorised processing. We keep our policies appropriately up to date to ensure that we provide you with all the information we have about how we process your personal data, and to ensure that our staff are given appropriate guidance about how they should process your personal data. We have signed data protection clauses and data processor agreements with all our service providers, taking into account the need for each to process personal data. We restrict access to personal data to those employees who really need to know them in order to conduct any of the processing mentioned in this policy, and we have trained and made them aware of the importance of confidentiality and maintaining the integrity and availability of your data, as well as of the disciplinary measures that any infringement in this area would entail.

9- Changes to this Privacy Policy

We will update this policy from time to time to reflect any changes to the law or our processing. If the changes are material, we will notify you before they take effect by sending you a notice or by prominently posting a notice on this website, and you will have the option to exercise your rights as set out in the previous section. In any event, we encourage you to periodically review this Privacy Policy to understand how we protect your personal data.

If you have any questions about this policy, please do not hesitate to contact us at dpo@andorraturisme.ad.

Last updated: 10 January 2023