Privacy policy | Civitfun

In accordance with applicable data protection regulations, this Privacy Policy is intended to help you understand the following:

1.- Data controller

The Data Controller of the personal data that you have provided to us is Civitfun Tourism S.L. (hereinafter “Civitfun”), domiciled at Complejo Mirall Balear, Camí De Son Fangos 100, 07007, Torre A, 5ª Planta, Palma De Mallorca, Spain with NIF (Número de Identificación Fiscal [Tax ID Number]): B76653088 and email: dataprotection@civitfun.com.

2.- Data protection officer

Civitfun belongs to a group of companies, called HBX Group (“HBX Group”). HBX Group has a Global Data Protection Officer (“DPO”) to address any queries, requests or clarifications regarding the processing of personal data that may be made by HBX Group at the following email address dataprotection@civitfun.com or at our postal address, mentioned in the paragraph above.

3.- How do we get your personal data?

The personal data processed will be those that you provide to us through the various channels that HBX Group makes available to you.

In addition, when you visit the HBX Group website, various technologies are used to collect and store information and this may include the use of cookies or similar technologies to identify your browser or device. HBX Group also uses these technologies to collect and store information when you interact with services offered by HBX Group or other functions. You can learn more about how HBX Group processes personal data obtained through cookies or as a result of your browsing in the event that you agree to the installation of cookies (for more information about cookies on the Website, please visit our Cookies Policy).

4.- What personal data we process, for what purpose and for what reason

These purposes are listed below depending on the category of data subject, indicating what data will be processed (type of data) and for what reason or basis (legal basis). We may also process any additional data you provide to us or that is generated in the course of your relationship with HBX Group for the purposes set out above.

Customers and prospects
Identification details: first name, surnames, passport number. Contact details: email, phone.	Execution of a contract between you and/or the company you represent and HBX Group or application of pre-contractual measures: Managing the contractual relationship with you and ensuring the provision of the contracted products and services, which includes both the management of the services offered by HBX Group, as well as the quality of the service, billing, collection and withdrawal thereof. Managing the business relationship with potential customers, addressing requests for information about the products and services offered by HBX Group. Managing and processing any legal, extrajudicial and insurance claims received by HBX Group relating to you. HBX Group legitimate interests: Carrying out business communications related to products and services similar to those contracted by you. In this case, HBX Group’s legitimate interest would be to engage in direct marketing activities aimed at its customers, in accordance with Recital 47 of the General Data Protection Regulation. Conducting surveys and market research to understand the quality of our products or services and the preference of our customers. HBX Group’s legitimate interest is to improve the commercial offering and experience of its customers.

Customers and prospects

Data categories

Purpose and legal basis

Identification details:
first name, surnames, passport number.
Contact details:
email, phone.

Execution of a contract between you and/or the company you represent and HBX Group or application of pre-contractual measures:
- Managing the contractual relationship with you and ensuring the provision of the contracted products and services, which includes both the management of the services offered by HBX Group, as well as the quality of the service, billing, collection and withdrawal thereof.
- Managing the business relationship with potential customers, addressing requests for information about the products and services offered by HBX Group.
- Managing and processing any legal, extrajudicial and insurance claims received by HBX Group relating to you.
HBX Group legitimate interests:
- Carrying out business communications related to products and services similar to those contracted by you. In this case, HBX Group’s legitimate interest would be to engage in direct marketing activities aimed at its customers, in accordance with Recital 47 of the General Data Protection Regulation.
- Conducting surveys and market research to understand the quality of our products or services and the preference of our customers. HBX Group’s legitimate interest is to improve the commercial offering and experience of its customers.

Suppliers and potential suppliers
Identification details: first name, surnames, passport number. Contact details: email, phone.	Execution of a contract between you and HBX Group or in the application of pre-contractual measures: Managing the business relationship with potential suppliers, addressing requests for information. Formalising the contractual relationship, including the process of contracting and signing of contracts. Managing the contractual relationship with HBX Group suppliers, including tracking the relationship and payment to them.

Suppliers and potential suppliers

Data categories

Purpose and legal basis

Identification details:
first name, surnames, passport number.
Contact details:
email, phone.

Execution of a contract between you and HBX Group or in the application of pre-contractual measures:
- Managing the business relationship with potential suppliers, addressing requests for information.
- Formalising the contractual relationship, including the process of contracting and signing of contracts.
- Managing the contractual relationship with HBX Group suppliers, including tracking the relationship and payment to them.

Corporate contacts
Personal data that you provide to us when you contact us via email, such as: Identification details: first name, surname. Contact details: email, phone. Data related to the relationship established with HBX Group.	HBX Group’s legitimate interest arising from contact for corporate purposes with data subjects, which is expressly recognised by privacy regulations, where applicable. The purpose is to: Maintain relationships of any kind with the company, entity or organisation for which you work or collaborate, or with you if you are an independent professional, whom it contacts through the Website or any form, communication channel or email box. Including through the delivery of business cards to HBX Group staff.

Corporate contacts

Data categories

Purpose and legal basis

Personal data that you provide to us when you contact us via email, such as:

Identification details:
first name, surname.
Contact details:
email, phone.
Data related to the relationship established with HBX Group.

HBX Group’s legitimate interest arising from contact for corporate purposes with data subjects, which is expressly recognised by privacy regulations, where applicable.

The purpose is to:
- Maintain relationships of any kind with the company, entity or organisation for which you work or collaborate, or with you if you are an independent professional, whom it contacts through the Website or any form, communication channel or email box. Including through the delivery of business cards to HBX Group staff.

General contact
Personal data that you provide to us when you contact us via email, such as: Identification details: first name, surname. Contact details: email, phone. Data related to the relationship established with HBX Group.	HBX Group’s legitimate interest arising from contact for corporate purposes with data subjects, which is expressly recognised by privacy regulations, where applicable. The purpose is to: Maintain relationships of any kind with the company, entity or organisation for which you work or collaborate, or with you if you are an independent professional, whom it contacts through the Website or any form, communication channel or email box. Including through the delivery of business cards to HBX Group staff.

General contact

Data categories

Purpose and legal basis

Personal data that you provide to us when you contact us via email, such as:

Identification details:
first name, surname.
Contact details:
email, phone.
Data related to the relationship established with HBX Group.

HBX Group’s legitimate interest arising from contact for corporate purposes with data subjects, which is expressly recognised by privacy regulations, where applicable.

The purpose is to:
- Maintain relationships of any kind with the company, entity or organisation for which you work or collaborate, or with you if you are an independent professional, whom it contacts through the Website or any form, communication channel or email box. Including through the delivery of business cards to HBX Group staff.

Know your business and compliance
We obtain the following data directly from you: Identification details: first name, surnames, passport number. Contact details: email, phone number. Any personal data you provide to us that is generated in the relationship. We obtain the following data from third parties: Data used to identify people, such as names, identification documents. Information about business activities, such as affiliation and ownership of companies, employment/function details. When authorised by law, information about court judgements and criminal activity, such as details of crimes and court orders. Where authorised by law, sanctions lists, watch lists, and lists of politically exposed persons, including their presence on such lists and their affiliations (or those of their family members or business partners) with government officials. Public media information, such as information in published news sources that may reveal connections to suspicious criminal activities. Information about family circumstances (for example, your marital status and dependants) if you are a Politically Exposed Person or a close collaborator of a Politically Exposed Person. Professional and personal affiliations (for example, organisations and individuals with whom you may be associated in your professional or personal capacity).	The processing of your personal data is legitimised by the legitimate interest of HBX Group where HBX Group is interested in entering into a deal with a third party as follows. The purpose of this processing is to screen individuals for and detect fraud, terrorism, money laundering, bribery and corruption, and other crimes by performing checks on databases such as WorldCompliance and Accuity provided by LexisNexis or other similar service providers.

Know your business and compliance

Data categories

Purpose and legal basis

We obtain the following data directly from you:

Identification details:
first name, surnames, passport number.
Contact details:
email, phone number.
Any personal data you provide to us that is generated in the relationship.

We obtain the following data from third parties:

Data used to identify people, such as names, identification documents.
Information about business activities, such as affiliation and ownership of companies, employment/function details.
When authorised by law, information about court judgements and criminal activity, such as details of crimes and court orders.
Where authorised by law, sanctions lists, watch lists, and lists of politically exposed persons, including their presence on such lists and their affiliations (or those of their family members or business partners) with government officials.
Public media information, such as information in published news sources that may reveal connections to suspicious criminal activities.
Information about family circumstances (for example, your marital status and dependants) if you are a Politically Exposed Person or a close collaborator of a Politically Exposed Person.

Professional and personal affiliations (for example, organisations and individuals with whom you may be associated in your professional or personal capacity).

The processing of your personal data is legitimised by the legitimate interest of HBX Group where HBX Group is interested in entering into a deal with a third party as follows.

The purpose of this processing is to screen individuals for and detect fraud, terrorism, money laundering, bribery and corruption, and other crimes by performing checks on databases such as WorldCompliance and Accuity provided by LexisNexis or other similar service providers.

Web / Platform users
Browsing data Technical data IP address	The processing of your personal data is legitimised by the express consent you provide to us through the cookie banner made available by HBX Group. You may withdraw your consent at any time in accordance with the information provided in our Cookie Policy. However, HBX Group may process information obtained through cookies or similar technologies without your consent as long as it is anonymous or aggregated information that does not contain any attribute that can be directly or indirectly identified. The purpose is to: Customise and segment the content of the Website through the use of cookies or similar technologies when they are consented to by the user through the corresponding banner.

Web / Platform users

Data categories

Purpose and legal basis

Browsing data
Technical data
IP address

The processing of your personal data is legitimised by the express consent you provide to us through the cookie banner made available by HBX Group.

You may withdraw your consent at any time in accordance with the information provided in our Cookie Policy. However, HBX Group may process information obtained through cookies or similar technologies without your consent as long as it is anonymous or aggregated information that does not contain any attribute that can be directly or indirectly identified.

The purpose is to:

Customise and segment the content of the Website through the use of cookies or similar technologies when they are consented to by the user through the corresponding banner.

Social network users
Personal data that allows us to understand the privacy policy of the social network in which you have a user account/profile, as well as the privacy settings you have as a user of that social network. This data depends on your own social media privacy settings and that the privacy policy of that social network.	HBX Group has active profiles on different social networks, the following processing of personal data applies to individuals who become members of HBX Group, follow or are part of such profiles. Compliance with the obligations arising from your status as a registered user of the social network and the conditions of use of said social network: Interaction of your profile on the corresponding social network with Civit HBX Group fun, including response to enquiries, comments published in public profiles.

Social network users

Data categories

Purpose and legal basis

Personal data that allows us to understand the privacy policy of the social network in which you have a user account/profile, as well as the privacy settings you have as a user of that social network. This data depends on your own social media privacy settings and that the privacy policy of that social network.

HBX Group has active profiles on different social networks, the following processing of personal data applies to individuals who become members of HBX Group, follow or are part of such profiles.

Compliance with the obligations arising from your status as a registered user of the social network and the conditions of use of said social network:

Interaction of your profile on the corresponding social network with Civit HBX Group fun, including response to enquiries, comments published in public profiles.

Applicable to all subjects
Data categories	Purpose and legal basis
The personal data that you provide to us that is generated in the relationship.	Compliance with our civil, commercial, tax, accounting and legal obligations related to compliance with personal data protection regulations, among others that apply.

5.- When and why do we communicate your personal data to third parties?

Personal data may be communicated to the following recipients, for the reasons explained below:

Recipient	Purpose	Legal base
Public administrations; Courts and tribunals; Law enforcement	To comply with legal obligations to which HBX Group is subject for the conduct of its business, and in cases provided for by law, including obtaining grants and public aid.	Complying with a legal obligation.
Accounting audit companies	To comply with legal audit obligations for accounts to which Civit HBX Group fun is subject as a result of its activity.	Complying with a legal obligation.
Third parties that provide detection and compliance database services.	To examine individuals to prevent and detect fraud, terrorism, money laundering, bribery and corruption, and other crimes by performing checks on databases such as WorldCompliance and Accuity provided by LexisNexis or other similar service providers.	HBX Group’s legitimate interest in entering into a deal with a third party.
Companies that are part of the HBX Group	We may communicate the data to other Group companies in order to offer you the best service, taking into account your allergies and/or special needs and other administrative purposes.	Civitfun’s legitimate interest recognised by applicable data protection regulations.
Third parties interested in acquiring all or part of the HBX Group share capital.	Analysis and execution of business operations in which HBX Group may be involved due to structural modifications or business transmission.	Legal authorisation by Article 21 of the Organic Law on Data Protection and Guarantee of Digital Rights.

In addition, data may also be shared with vendors who need to access your data for the provision of services that HBX Group has contracted with such vendors, and with whom HBX Group has signed confidentiality and personal data processing agreements that are necessary and required by law to protect your privacy.

HBX Group will not share your data with other third parties without first obtaining your consent, except where necessary for the fulfilment of legal or contractual obligations to which HBX Group is subject at any time due to its nature and activity.

If in the future HBX Group makes other personal data communications, it will inform you in a timely manner.

6.- International data transfers

HBX Group may engage the services of suppliers located in countries outside the European Economic Area, based on adequacy decisions by the European Commission. In which case the country is considered to have regulations equivalent to European ones. In the event that HBX Group needs to contract services from suppliers located in countries that do not have European equivalent regulations, the contracting will include all the guarantees and safeguards required by the regulations to preserve your privacy, after verification of the legislation of the destination country.

Such safeguards may consist of the application of contractual clauses and guarantees in addition to them, in accordance with the regulations of each destination country, or of binding corporate rules approved by the data protection authorities. We also inform you that the regulations allow us to send your data to such countries, if necessary to comply with our obligations arising from the service you request from us.

We also inform you that HBX Group may have companies outside the European Union. In such cases, HBX Group requires these companies to comply with appropriate measures to protect your personal data in accordance with European regulations.

For more information about the safeguards to your privacy, or the destination countries to which we need to transfer your data in order to fulfil our contractual obligations to you, you may contact HBX Group, at the addresses indicated in the “How you can exercise your rights” section of this Privacy Policy.

7.- Automated decisions

HBX Group does not make decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the processing purposes described above are carried out with human intervention.

The drafting of indicated profiles, for the purposes of candidate management, will in no case be used in the decision-making by our entity that may have legal effects for you or that may significantly affect you.

8.- How long do we keep your data?

We will only retain your personal data for as long as we need it for the purposes for which we collect it and to comply with legal, financial, business or reporting requirements or until you withdraw your consent. In some circumstances, we may anonymise personal data so that it is no longer identifiable and we may continue to use it. When we no longer need the personal data, we will securely delete or destroy it.

HBX Group will retain the data collected for the purposes above for the duration of your relationship with HBX Group and, even thereafter, until the prescription of any legal liability arising therefrom.

9.- How can you exercise your rights?

You may exercise, with respect to the data collected, the rights of access, rectification, opposition, deletion, limitation and portability of the data, in accordance with the regulations on data protection and withdraw your consent.

These rights may be exercised by sending a communication:

In the e-mail dataprotection@civitfun.com with the subject "Personal Data"; or
By any postal means of which evidence of receipt is recorded by Civitfun, addressed to the following address: Complejo Mirall Balear, Camí De Son Fangos 100, 07007, Torre A, 5ª Planta, Palma De Mallorca, Spain indicating in the reference envelope “Data Protection”.

In addition, if you believe that the processing of your personal data violates the regulations or your privacy rights, you can file a complaint:

By postal mail or email to the above addresses, or
Before the Spanish Data Protection Agency, by going to www.aepd.es or at Calle Jorge Juan, 6, 28001, Madrid.

10.- Change, modifications and updates

HBX Group reserves the right to revise this Privacy Policy at any time it deems appropriate to reflect regulatory changes, best practices or to update personal data processing activities. You will be informed of such updates in accordance with regulatory requirements in the event that your rights are significantly affected as a result of such modification or update.