PRIVACY POLICY

Last updated: January 2026 1. Who is responsible for processing your data? Data Controller details: Company name: VIAJA DESCUBRE VIVE S.L. Trade name: Carriles Travel Insights Address: Calle Henri Dunant 17, 28036 Madrid, Spain Tax ID (CIF): B72496045 Travel Agency License (CICMA): 4369 Contact email: hola@carlacarriles.com 2. What personal data do we process and for what purposes? At VIAJA DESCUBRE VIVE S.L., we process the personal data you provide for the following purposes: Purpose Data processed Legal basis Booking management and travel services Name, surname, ID/passport, date of birth, email, phone, address Contract performance Travel-specific requirements Health information (allergies, reduced mobility, dietary requirements), travel preferences, companion details Explicit consent Invoicing and tax obligations Identification and payment data Legal obligation Responding to enquiries Name, email, phone, enquiry content Consent Marketing communications and newsletters Name and email Consent Service improvement Travel history Legitimate interest About health data: We request health-related information (allergies, medical conditions, mobility needs) only when essential to ensure your safety and well-being during your trip. This data is processed with your explicit consent and shared exclusively with service providers who need it to deliver the contracted services. 3. How long do we retain your data? Contractual data: For the duration of the business relationship and subsequently for the legally required retention periods (5 years for tax obligations, 15 years for contractual liabilities). Health data: Maximum 5 years from the completion of the trip. Marketing communications: Until you unsubscribe. Enquiries: For the time necessary to resolve them and subsequently for 1 year. 4. Who do we share your data with? Your data may be shared with: Tourism service providers: Airlines, hotels, tour operators, transport companies, guides, and other providers necessary to deliver your trip. Public authorities: When legally required (Tax Agency, immigration authorities of destination countries). Financial institutions: For payment processing and invoicing. We do not sell or transfer your data to third parties for commercial purposes. 5. International data transfers As we organise trips to destinations outside the European Economic Area, your personal data may be transferred to providers located in third countries for the proper execution of the contracted service. In such cases, we implement the following safeguards: • We verify that the destination country has an adequacy decision from the European Commission, or • We sign EU-approved Standard Contractual Clauses with the providers, or • We obtain your explicit consent when the transfer is necessary to perform the travel contract. You may request information about the safeguards applied by writing to hola@carlacarriles.com. 6. What are your rights? You may exercise the following rights at any time: Access: Know what data we process about you. Rectification: Correct inaccurate or incomplete data. Erasure: Request deletion of your data when no longer necessary. Objection: Object to processing in certain circumstances. Restriction: Request that processing of your data be restricted. Portability: Receive your data in a structured format to transfer to another controller. Withdraw consent: At any time, without affecting the lawfulness of prior processing. How to exercise your rights? Send an email to hola@carlacarriles.com stating which right you wish to exercise and attaching a copy of your ID or identification document. Not satisfied? You may file a complaint with the Spanish Data Protection Agency (www.aepd.es). 7. Data security We implement technical and organisational measures to protect your data against unauthorised access, loss, or destruction, including: • Encryption of communications • Restricted access to information • Regular backups • Periodic review of security measures 8. Changes to this policy We reserve the right to modify this policy to adapt it to legislative changes or changes in our services. Any modification will be published on this page with an indication of the update date. 9. Consent By providing your personal data through our website or any other means, you declare that you have read and accepted this Privacy Policy. ————————————————————— VIAJA DESCUBRE VIVE S.L. | Carriles Travel Insights Calle Henri Dunant 17, 28036 Madrid, Spain | Tax ID: B72496045 | CICMA: 4369 hola@carlacarriles.com