With this Privacy Policy, Casamanya Playground S.L. (hereinafter, we or OUTNORDTRAVEL) informs you about the personal data that we collect through the services that we offer and are reflected through this website, how we treat them and the rights that the Personal Data Protection regulations that apply to us grant you in relation to your personal data and our processing of them.
Applicable regulations:
- Law 29/2021, of 28 October, Qualified on the Protection of Personal Data of the Principality of Andorra (hereinafter, the LQPD),
- Decree 391/2022, of 28-9-2022 approving the Regulations implementing the LQPD, and
- Regulation (EU) 679/2016 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, “the GDPR”).
We have structured this policy in the following drop-downs to make it easier for you to access the points of interest to you. However, please read all sections of the Legal Notice and this privacy policy before using this website.
In the table below you will find links to provide you with easy access to the points of this policy that are of interest to you. However, please read all sections of the Legal Notice and this privacy policy before using this website:
This Policy applies to persons who interact with OUTNORDTRAVEL through this website, to users of the services that OUTNORDTRAVEL offers for the purposes described in section 4 of this policy (the Services), and to all persons whose personal data (for example, their images) may appear on our website or in the context of the Services.
The only responsible for the processing of your personal data in accordance with this policy is: OUTNORDTRAVEL, with NRT L-712607-G and registered office at Edif La Solana Pal B 1.1. Erts, La Massana AD400 (Principality of Andorra).
We have an external Data Protection Officer – Win2win, SLU, an Andorran company specialising in privacy and personal data protection – who can be contacted at DPDextern@win2win.ad.
OUTNORDTRAVEL is not responsible for the activities carried out by other websites, even if you access them through links on our website. Therefore, we strongly recommend that you carefully read the information provided by these other responsible parties before giving them your personal data (especially the privacy and cookie policies of each website you visit), and that you contact this responsible party if you have any concerns or questions.
In general, it is you who directly provides us with your personal data, for example, through the forms found on this website. The only exceptions to this rule are:
- Your identification data, in case you decide to log in using your Facebook account (which acts as an identity provider) instead of filling in the registration form;
- Your voice and/or your image, where they may be collected by our video surveillance cameras;
- Data provided to us by third parties who book or purchase our products or services on your behalf (as a beneficiary);
- Contact details provided to us by our service and product providers where you represent them;
- Details of the products you purchase by showing one of our loyalty cards;
- The last four digits of your credit card, which together with the purchase amount and the transaction number is returned to us by our payment service provider in case you wish to query or revoke the transaction;
- Photographs or videos of events that we organise or in which we participate, and in which you may appear;
- Photographs, texts or other media that the author may submit for publication on our website or our social networks, usually within the framework of a participatory process, in accordance with the relevant terms and conditions, and therefore with your consent.
- Images or other personal data corresponding to any news item in which we consider that the public interest, our obligation of transparency and the right to information prevail over the possible interests of the persons whose image or other personal data is published on our website or social networks;
- Images that correspond to any content on the website to which we have the corresponding rights;
- Personal data about you that may appear in emails and instant messaging that we receive, or through forms on our website; and
- Cookies on this website, about which you will find more information in our cookie policy.
If we do not know you, we may use your personal data to confirm your identity and, if necessary, the entity you work for and your role in that entity. We do this where we are subject to legal obligations that require us to authenticate your identity before processing your data further, or where it is in our legitimate interest to ensure that your request is genuine and is not made for fraudulent purposes or is spam.
We collect the optional data you voluntarily provide on forms to provide you with a more personalised service in relation to the purpose for which the form is specifically intended, and to extract statistics to help us improve our service, services and products.
The basis that legitimises us to process this data for this purpose is the consent you express when you provide it to us. As always, you can retract and withdraw your consent at any time, with the sole effect that we will no longer use this data and, therefore, the services associated with the form will be less personalised from that moment onwards.
We collect your data for the purpose of:
- To complete the check-in and check-out;
- To make copies of all guests’ identity documents available to law enforcement authorities for a period of one year;
- To process your promotional codes and payments;
- Provide you with a consistent and personalised service, advising you on the services you can enjoy in our facilities (based on your previous use or preferences you have communicated to us);
- To provide you with luggage storage, safe deposit and parking services;
- Purchase or book services offered by third parties, when you request us to do so and on your behalf (for example, to coordinate excursions and other sightseeing tours, to arrange taxis or chauffeur-driven vehicles for you, and to facilitate restaurant and event reservations);
- Manage and provide you with access to Wi-Fi, television and other connectivity services (including access to business centre services such as fax and photocopying facilities) and entertainment systems (such as PlayStation or video-on-demand);
- Providing you with in-room catering (including respecting any dietary restrictions, health or other personal needs you communicate to us);
- Provide you with room service (including room cleaning, laundry services, and anything else you may request for your convenience that we can provide, such as a cushion, duvet or mobile phone charger);
- Collect and sometimes publish your feedback about the hotel on our website.
- Collect the tourist tax and, if applicable, the cancellation fee for your booking.
- Handle your other requests and enquiries, or your complaints and suggestions; and
- Determine your eligibility for age-restricted products and services (such as alcohol or in-room adult entertainment).
If you represent a supplier of products or services, we collect your contact details and signature to:
a) Manage our relationships of all types with the supplier you represent.
b) Manage the corresponding file on our list of approved suppliers.
c) Manage the quotations and invoices of the supplier you represent.
The processing operations linked to purposes a) and b) are legitimised by the employment or service contract you have signed with the supplier you represent and our legitimate interest in contacting this supplier. And the processing operations linked to purpose c) are legitimate because they are necessary for the performance of the contract(s) you have signed with us.
We collect information that we receive orally or in writing directly from you or from a third party who represents you or for whom you are a beneficiary, when you contract with us for a service or product (for example, a hotel room reservation agreement, or a wholesale contract for fuel or other products) in order to manage that contract, provide you with the relevant service and bill you for it.
If you make a payment by POS, we collect the last 4 digits of your payment card together with the identifier of your payment, the date and the amount, so that we can deal with any request for information or refund in relation to that payment. These data do not allow us to identify you, and therefore, if you wish to request something from us in relation to them, you will have to provide us with some information that allows us to link them to you.
In addition, we inform you that, as a result of this contractual relationship, we may communicate to you orally or in writing commercial information related to the products or services you have contracted from us.
The processing of this data is legitimate because it is necessary for the execution of the contract for services or products in which you are interested, and because of our legitimate interest in keeping you informed in relation to the products or services purchased.
Content of OUTNORDTRAVEL collects the data you provide directly to us, or those provided by third parties on your behalf (identification data, contact, economic and often occupation), during the signing of agreements or contracts to which OUTNORDTRAVEL and you are party, in order to formalize them, manage them, execute them, and keep you informed about everything that may interest you in relation to the matters referred to in the scope of each agreement or contract.
This is the case of the prohibition (or cancellation of the prohibition) of access to gambling halls and the registration in the General Register of prohibitions of access to gambling, which is an agreement of minimum duration of one year, and which you sign at the time of sending us the correctly completed application form.
The processing of your data for the purpose of keeping you informed in relation to the matters referred to in the scope of our agreement or contract is legitimised by our legitimate interest.
The processing of your data for all other purposes is legitimised, in these cases, because it is necessary to execute the terms and conditions of the corresponding agreement or contract, or to establish pre-contractual conditions when you request it.
We collect the information you provide to us at our offices, by telephone or by email to prepare a proposal for the product that best suits your needs and, if you accept it, to prepare the relevant contract.
We sometimes collect further information about our customers or potential customers and/or their beneficial owners for the following purposes:
- We perform “due diligence” in order to better advise you regarding the fixed or variable capital investment of the deposit you made (or will make) on behalf of OUTNORDTRAVEL, and to tailor it to your investment and risk profile and the risk of the fund, diversifying the investment; and
- We fill in KYC (Know Your Customer) forms, the main purpose of which is to prevent natural or legal persons from using legitimate services to engage in illegal activities.
We collect the data you provide us with through this website, our contact telephone number or e-mail address, or directly at our offices, in order to offer you the corresponding service.
The basis for such processing is that it is necessary for the performance of the contract governed by the terms and conditions of use of the service you request from us.
We may process the data you provide to us, for example during the purchase or booking of products or services, to ask you to rate the service you received.
We may also extract aggregated statistics (i.e. the statistical output of which does not include personal information of any kind) in relation to the interest in our marketing campaigns.
The basis for this processing is our legitimate interest in improving the quality of our services and the events we manage or promote, as well as our marketing campaigns.
We collect your e-mail address when you subscribe to our commercial communications service in order to send you our catalogues by e-mail and inform you about new products, discounts or promotions, and competitions or prize draws so that you can make the most of our facilities and services.
We also use the e-mail address you provide when you register or purchase our services to inform you about news, events, exclusive content, discounts or promotions and competitions or draws, so that you can make the most of the services you are interested in.
If you have subscribed through our website, the legal basis for this processing is your consent, and you may withdraw your consent at any time by exercising your right as indicated below in this policy, or through the link at the bottom of each email. The only consequence of withdrawing your consent is that you will no longer receive catalogues and information sent to you by email, and you will no longer be able to participate in promotions, competitions or prize draws reserved for our subscribers.
If you receive the information because you have purchased any of our services, the legal basis for this treatment is our legitimate interest in keeping you informed about our products and services related to those you have purchased, which you can oppose at any time, as in the previous case and with identical consequences, exercising your right as indicated below in this policy or through the link to this effect at the bottom of all our emails.
We collect the personal data you provide to us in your emails or instant messaging messages, by telephone, through contact forms or clarification of doubts, or through requests to exercise your rights, in order to deal with your requests, queries or complaints in relation to our services or with the rights you have over your personal data.
The legal basis for this processing is the consent you express by submitting or providing this data to us, our legal obligation to respond to your rights requests, and our legitimate interest in responding to you. The provision of your personal data is therefore voluntary, although if you do not provide it we will not be able to process your request, query or complaint. You may revoke your consent whenever you wish, although such revocation will also make it impossible to continue processing your request, query or complaint.
We retain data that may be necessary to deal with your or our potential claims, based on our legitimate interest in defending ourselves and safeguarding our rights.
If you have signed a contract or a consent of assignment of image rights with us, we may collect photographs or videos of our facilities, products or services in which you are identified, and perhaps heard, and then use them in promotional campaigns or publish them in media such as national or international press, our website, or our social networks. If you have signed a consent for the transfer of image rights, we inform you that you can revoke it at any time so that we can remove your image from our website and/or our networks, without the revocation having any effect on the dissemination of your image that has taken place before processing it.
In addition, we may graphically record the ambience of our premises to promote our premises, products and services and, from time to time, your image may appear in this graphic material. In contrast to the previous paragraph, in this case the legal basis for the processing of your images is our legitimate interest, which you can object to at any time if you consider it to be contrary to your own interests. In order to assess your objection against our legitimate interest and, if necessary, immediately remove the images that identify you, we will ask you to tell us where you have seen them.
The “Ads” platforms are intended for advertisers who wish to advertise on Google, Twitter and/or LinkedIn. OUTNORDTRAVEL uses these advertising platforms to create campaigns and advertisements that will be displayed on other websites. When generating an ad, we segment the target audience by:
- Location
- Demographics (age, gender, etc.)
- Interests (activities, hobbies, etc.)
- What they buy online and through other channels.
- Etc.
On our website we use Facebook Ads, a tool that allows you to segment your audience to target ads, and about which you can find more information, including how to set it up, here.
Thanks to Facebook’s Custom Audiences feature, it is possible to create an audience from the data of users and subscribers to this website, such as email addresses and phone numbers. To do this, databases need to be shared with Facebook to subsequently create custom audiences by targeting ads to people with similar profiles.
For the targeting of ads in accordance with Facebook’s policies, no sensitive personal information is used and is not shared with third parties or other advertisers, and will be deleted by Facebook when this process is completed. In addition, Facebook will be responsible for ensuring confidentiality.
The ad system designed by Facebook allows you to display relevant and useful ads without revealing your identity to advertisers, and can reach groups of people with specific profiles. To do this, Facebook tracks users’ actions after they click on an ad.
To use the custom audiences function, our website uses Facebook’s Website Custom Audience tool, which uses the Facebook pixel that tags the visitor to this website in an anonymised form.
The basis for this processing is the consent you give us by accepting the marketing cookies, without which the Facebook pixel cannot be used. In addition, if you wish to object to the use of Facebook Website Custom Audiences, you have the possibility to do so here.https://www.outnordtravel.com/en/cookies/
At any time as a user, you can revoke your consent via this link, where you can configure your ad reception. You can also indicate that you do not want interest-based ads from Facebook or other companies through the European Interactive Digital Advertising Alliance (EDAA) of Your On-line Choices or in the settings of your computer or mobile device.
Functional cookies are used to collect, store, consult and process personal information (related to you through unique identifiers or IP addresses) from your device’s browser, in order to ensure the proper functioning of our website.
As these cookies are necessary for the proper functioning of the website or personalisation cookies, their use does not require your explicit consent, and the basis for our legitimate interest in using them is our legitimate interest in being able to offer you the services on our website according to your preferences.
You can find more information about these cookies in our cookie policy.
STATISTICAL COOKIES: To obtain aggregated statistics on the use of our website (analytical cookies).
We use analytical or statistical cookies to identify the most and least visited pages, analyse what content is of most interest to our visitors and measure the success of our information campaigns, all with the aim of improving the services we offer you through the Web. All these purposes provide aggregated results, in which it is not possible to identify the interests of any specific person.
As for analytical cookies, we will not use them until we have your consent, and not giving or withdrawing your consent will have no effect other than to hinder our aim of improving the website by analysing aggregated statistics of our visitors’ browsing.
You can find more information about these cookies in our cookie policy.
We download advertising cookies from third parties. These files help us infer your interests based on the pages you visit, the content you click on and other actions you take online.
As these cookies are not necessary, we will not use them until we have your consent, and your failure to give or withdraw your consent will have no effect unless your visit to our website cannot be used to improve the interest of the advertising you receive.
You can find out more about these cookies in our cookie policy.
In addition, as an obligation that Google LLC, a company of which Google Ireland Ltd is a subsidiary, imposes on entities that, like us, use Google Analytics tools, we inform you that these two services are operated by Google Inc., with registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and that Google Inc. is a beneficiary of these.
The information generated by the cookies about your use of this website and your advertising preferences is generally transmitted to a Google server in the USA and stored there. For more information, please refer to the page describing how Google uses the information on our website and/or Google’s privacy policy in connection with the aforementioned services.
Please note that we have activated the IP anonymisation function in the Google service to add additional safeguards to the standard contractual clauses protecting this international transfer of data to the USA. This means that Google will shorten your IP address before transmitting it to the USA (obfuscation of your identity). Only in exceptional cases is the full IP address sent to a Google server in the USA and shortened there. Google guarantees that the IP address transmitted by your browser to Google Analytics will not be processed together with any other data held by Google.
You can see the categories of personal data processed by these services at privacy.google.com/businesses/adsservices.
OUTNORDTRAVEL takes security measures appropriate to the level of risk to protect personal information against loss, misuse and unauthorised access, disclosure, alteration and destruction, taking into account the risks involved in processing and the nature of personal information; however, if we determine that your data has been misappropriated (including by an employee or former employee of OUTNORDTRAVEL), has been exposed by a security breach or has been improperly acquired by a third party, exposing you to a high risk, we will immediately inform you of this security breach, misappropriation or misacquisition, and of the steps we have taken and the steps we recommend you take to ensure that the breach does not affect you.
The basis that legitimises this processing is the legal obligation set out in article 37 of the LQPD, and our legitimate interest in preventing this security breach from harming you”.
We may use your personal data (such as for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) where permitted by applicable data protection laws and, of course, acting in accordance with these and all other applicable laws.
We do not give your personal data to anyone, except:
- If you ask us to do so yourself.
- We are legally obliged to do so.
- It is necessary so that, in accordance with the terms and conditions of use of our cards, a merchant associated with our benefit programmes can give you the benefit you are entitled to for your purchase when you show them our card.
- As necessary to enforce the terms and conditions of our products and services, including investigation of possible violations.
- Is necessary to detect, prevent or otherwise address fraud, security or technical problems.
- We act as an intermediary, for example, when we need to make a booking on your behalf (for example, at a hotel).
- You contract our products or services through intermediaries (for example, a travel agency) to whom we must deliver products or services they have purchased on your behalf, either with the consent you have given them, because they legally represent you, or because you have explicitly authorised us to do so.
- We are jointly responsible for the collection of data because, with your consent, other entities process the data on our behalf. This is the case for Google Ireland Ltd, with registered office at Gordon House 4, Barrow – Dublin, Ireland, which we have commissioned to process the cookie data necessary to use its Analytics services. Google Ireland Ltd acts as a third party controller for all processing it carries out on your behalf in accordance with its privacy policy. We transfer data to Google Ireland Ltd on the basis of the data protection agreement that this EU-based company includes in the appendix to the standard contract for GDPR compliant countries, such as Andorra, to which we add the additional safeguard of activating the anonymisation of IPs that collect cookies. In our cookies policy you will see which analytical and advertising cookies we offer you and how to configure them.
- We need to protect your rights, ours, those of our employees or those of third parties (which may require disclosure to the police for security purposes or to health authorities to prevent the spread of disease, e.g. for contact tracing purposes). For example: – If our video surveillance cameras record a theft from our premises, or. – If a third party requests video surveillance images from us on the basis of their legitimate interest in seeking legal protection in respect of the commission of a criminal offence or compensation for damages evidenced by the transferred images, and with a commitment by the third party to use them exclusively for the reporting of this offence or for the claim for damages suffered, and reducing the transfer of images to the minimum and indispensable to fulfil the intended purpose.
- A company subcontracted by us needs to process them on our behalf (for example, the company that provides us with the services of the Data Protection Officer, and that must deal with your requests for rights); always under the terms and conditions of the corresponding data processor contract.
- A company subcontracted by us may have access to personal data held on our site or in our systems from time to time, even though they do not need to process it on our behalf. This is the case, for example, of the web development and maintenance company or some of the services of our IT service providers. Because they may have access to OUTNORDTRAVEL data, they have signed a service contract that obliges them to maintain the same level of privacy that we have in OUTNORDTRAVEL.
- We need to protect or defend the rights or property of OUTNORDTRAVEL.
OUTNORDTRAVEL retains your personal data only for the duration of the processing that requires it and, thereafter, for as long as it takes to prescribe the legal responsibilities that correspond to us at all times, arising from the processing in question (including the obligation to be able to demonstrate that we have complied with your request for the destruction of personal data).
For example, we will retain video surveillance records for a maximum of 30 days where they contain no incidents, and, if exceptionally a security incident has occurred during this period or there is evidence of a criminal offence (e.g. theft), we will extract a copy of the part of the record of the incident which will be retained until it is provided to the police or to the data subject concerned who requires it to prove their request for legal protection.
We will destroy your CV if it is more than five years old, on the grounds that it is out of date for the purpose for which it is intended.
We will destroy any unnecessary or disproportionate personal data about you that may appear in emails and instant messaging we receive, or through forms on our website as soon as we receive them.
We will destroy (and rectify) any personal data that we find to be inaccurate as soon as we are satisfied that it is inaccurate.
If you send us a copy of an identity document, we will destroy this copy as soon as we have checked that it fulfils the purpose for which you sent it to us.
In addition, the profiling data we use to personalise the information you receive through our newsletters will be irreversibly anonymised when you unsubscribe.
Where we do not have a legitimate purpose for processing some of your personal data, we will delete or anonymise it, and if that is not possible (for example, because it is backed up), we will store it securely and block it to isolate it from further processing until such time as it can be deleted.
You have the right to obtain confirmation as to whether or not we hold any of your personal information.
Please note that where we share personal information with other data controllers, you should exercise your rights directly with them by following the instructions provided in their own privacy policies. Specifically, in relation to the data that our cookies share with Google, we inform you that you can install in your Chrome, Internet Explorer, Safari, Firefox and/or Opera browser, the add-on to not send data from Google Analytics or Google Ads to Google Inc.
Below, we explain what other rights you have and how to exercise them.
You can request the execution of the following rights:
- Access to your personal data.
- Rectification of any of your personal data, specifying the reason.
- Deletion of any or all of your personal data.
- Limitation of the processing of your data, specifying the reason for the limitation.
- Opposition to the processing of your personal data.
- Portability of your data when the legitimate basis for the collection has been consent or a contract.
- The right not to be subject to automated individual decisions.
You can exercise your rights:
- By sending a written request to OUTNORDTRAVEL, addressed to our postal address indicated in section 2 of this policy, indicating a means of contacting you so that we can respond to your request, or ask you for further information if necessary. We would appreciate it if you would mark on the envelope “Exercise of Personal Data Protection Rights”.
- By sending an e-mail or the form associated with the right you wish to exercise to the e-mail address DPDextern@win2win.ad, indicating “Exercise of Personal Data Protection Rights” in the subject line. You will find these forms further on in this section of the privacy policy.
In order to facilitate the exercise of your rights, we recommend that you use the corresponding application forms of the following:
Form for exercising your right of access
Form for exercising the right to rectification
Form for exercising the right of objection (form A and form B)
Form for exercising the right to erasure
Form for the exercise of the right to restriction of processing
Form for exercising the right to portability
Form for exercising the right not to be subject to automated individual decisions.
By providing us with your details, you guarantee that they are accurate and complete. Likewise, you confirm that you are responsible for the veracity of the personal data that you have provided us with and that you will keep them suitably updated so that they correspond to your real situation, being responsible for any false or inaccurate personal data that you may provide us with, as well as for any damages, direct or indirect, that may derive from your inaccuracy.
You may not provide us with other people’s personal data unless it is justified in relation to the services you request from us. In any case, if you provide us with the personal data of third parties, you are responsible for informing such third parties prior to providing us with their personal data. This information that you must provide to third parties whose data you provide to us must include all the provisions set out in this privacy policy, and it is you who is responsible for the lawfulness of this personal data and for conveying to the data subjects the rights they have in relation to their personal data.
In cases where you are required to provide us with personal data of a child under the age of 16 or of a person whose rights are restricted, in doing so you are obliged to obtain the consent of the holders of parental or guardianship rights. Without this authorisation, it is prohibited for you to provide us with any personal data of these persons.
We are fully committed to protecting your privacy and your personal data. We have drawn up a register of all the personal data processing activities that we carry out, we have analysed the risk that each of these activities may pose and we have implemented the appropriate legal, technical and organisational safeguards to prevent, as far as possible, the alteration of your personal data, its misuse, loss, theft, unauthorised access or unauthorised processing. We keep our policies appropriately updated to ensure that we provide you with all the information we have about the processing of your personal data and to ensure that our staff receive appropriate guidance on how they should handle your personal data. We have signed data protection clauses and processor contracts with all our service providers, taking into account the need for each service provider to process personal data.
We restrict access to personal data to those employees who really need to know them to perform any of the processing referred to in this policy and we have trained and made them aware of the importance of confidentiality and maintaining the integrity and availability of the information, as well as the disciplinary measures that any possible infringement in this matter would imply.
However, if OUTNORDTRAVEL determines that your data has been misappropriated (including by an OUTNORDTRAVEL employee), exposed by a security breach or improperly acquired by a third party, OUTNORDTRAVEL will immediately inform you of this security breach, misappropriation or misacquisition.
You may not provide us with other people’s personal data unless it is justified in relation to the services you request from us. In any case, if you provide us with the personal data of third parties, you assume responsibility for informing such third parties prior to providing us with their personal data. This information that you must provide to third parties whose data you provide to us must include all the provisions set out in this privacy policy, and it is you who is responsible for the lawfulness of this personal data and for conveying to the data subjects the rights they have in relation to their personal data.
In cases where you are required to provide us with personal data of a child under the age of 16 or of a person whose rights are restricted, in doing so you are obliged to obtain the consent of the holders of parental or guardianship rights. Without this authorisation, it is prohibited for you to provide us with any personal data of these persons.
We will update this policy as necessary to reflect any changes in the law or our processing. If the changes are material, we will notify you before they take effect by sending you a notice or posting a prominent notice on this website, and you will have the option to exercise your rights as set out in a previous section. In any event, we encourage you to periodically review this privacy policy to learn how we are protecting your personal information.
If you have any questions about this policy, please let us know by emailing us at DPDextern@win2win.ad.
Last updated: 1 March 2023
