1. Data Controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD), users are informed that personal data provided through this website will be processed by:
Data Controller: MULHACEN SKI, S.L.
Spanish Tax Identification Number (CIF): B18372359
Registered Address: Plaza de Andalucía, Edificio Salvia, 18196 Sierra Nevada, Granada, España.
Email: info@mulhacenski.com
Website: www.mulhacenski.com
2. Personal Data We May Process
Depending on the relationship with the user and the services used through the website, MULHACEN SKI may process the following categories of data:
- Identification details, such as first name and surname.
- Contact details, such as email address, telephone number and postal address.
- Information required for invoicing.
- Data relating to orders, bookings, rentals and contracted services.
- Personal data of individuals included in a booking where necessary to provide the contracted service.
- Data associated with the creation and management of a user account.
- Information voluntarily provided by the user in forms, enquiries, communications or comments.
- Data relating to payment transactions and transaction references.
- Technical data resulting from access to the website, such as IP addresses, access logs and information relating to system security.
As a general rule, MULHACEN SKI does not request special categories of personal data unless they are strictly necessary to provide a service and there is a valid legal basis for processing them.
3. Purposes and Legal Bases for Processing
Handling Enquiries and Requests
To manage and respond to enquiries submitted through forms, email, telephone or other available contact channels.
The legal basis will be the implementation of pre-contractual measures requested by the data subject where the enquiry relates to a potential contract and, in all other cases, MULHACEN SKI’s legitimate interest in responding to communications received.
Managing User Accounts
To create, maintain and administer customer accounts, provide access to the private area and manage the features associated with those accounts.
The legal basis is the performance of the contractual relationship or the implementation of pre-contractual measures requested by the user.
Managing Bookings, Rentals, Orders and Services
To process bookings, orders, rentals and other services contracted through the website, including their administration, customer service, modifications, cancellations and any other activities necessary to provide the service.
The legal basis is the performance of the contract entered into with the customer.
Payment Processing
To process payments for products and services purchased and retain the information necessary to provide evidence of the transactions carried out.
Where payment is made through an external payment gateway or payment service provider, certain data may be processed directly by that provider in accordance with its own terms and privacy policies.
MULHACEN SKI will not have access to full payment card details where the payment is processed directly by a financial institution or external provider that does not disclose such information.
Invoicing and Administrative, Accounting and Tax Obligations
To issue invoices, maintain accounting records and comply with the legal, tax and administrative obligations arising from MULHACEN SKI’s business activities.
The legal basis is compliance with applicable legal obligations.
Security and Fraud Prevention
To protect the website, user accounts and information systems against unauthorised access, fraudulent use, cyberattacks and other security threats.
The legal basis is MULHACEN SKI’s legitimate interest in ensuring the security of its systems, services and users.
Marketing Communications
Where the user has given their authorisation, MULHACEN SKI may send marketing information about its products, services, promotions or news.
The legal basis will be the consent of the data subject.
In cases permitted by law, communications concerning products or services similar to those previously purchased by the customer may be sent, always providing a simple and free method of opting out of further communications.
Users may withdraw their consent or unsubscribe from these communications at any time.
4. Mandatory Provision of Data
Fields marked as mandatory in forms must be completed in order to process a request, create an account or complete a booking, order or contract.
Failure to provide the necessary information may prevent MULHACEN SKI from responding to the request or properly providing the requested service.
Users guarantee that the information they provide is truthful, accurate, complete and up to date.
Where users provide personal data relating to other individuals, they declare that they are authorised to do so and undertake to inform those individuals about the processing of their data where necessary.
5. Data Retention Periods
Personal data will be retained only for as long as necessary to fulfil the purpose for which it was collected.
- Data relating to enquiries will be retained for the time necessary to respond to them and carry out any follow-up.
- Data associated with bookings, purchases, rentals and contracted services will be retained for the duration of the contractual relationship and subsequently for the periods necessary to address potential legal liabilities.
- Invoicing and accounting data will be retained for the periods established by tax, commercial and accounting legislation.
- Data used for marketing communications will be retained until the data subject withdraws consent or requests to stop receiving such communications.
- Data associated with a user account will be retained for as long as the account remains active, without prejudice to the retention of information required by law.
Once the applicable retention periods have expired, the data will be deleted or remain duly restricted for the periods required by law.
6. Recipients of Personal Data
As a general rule, MULHACEN SKI will not disclose personal data to third parties unless necessary to provide the contracted service or required by law.
Depending on the circumstances, data may be disclosed or made accessible to:
- Public authorities, the Spanish Tax Agency, judicial bodies or other authorities where there is a legal obligation.
- Banks, financial institutions and payment service providers for the management of financial transactions.
- Tax, accounting or administrative advisers where necessary.
- Service providers whose involvement is necessary to manage or provide the purchased product, booking or contracted service.
- Technology, web hosting, maintenance, email, security and other service providers necessary for the operation of the website.
Where these providers process data on behalf of MULHACEN SKI, they will act as data processors and will be subject to the corresponding contractual and legal obligations concerning data protection.
7. International Data Transfers
Some technology providers used by MULHACEN SKI or by services integrated into the website may be located outside the European Economic Area or use infrastructure situated in third countries.
Where an international transfer of personal data takes place, it will only be carried out where a valid legal basis exists and the safeguards required by data protection legislation have been adopted, such as adequacy decisions, Standard Contractual Clauses or other mechanisms recognised by the GDPR.
Specific information concerning measurement, analytics or other technologies using cookies will be provided, where applicable, in the Cookie Policy.
8. Data Subjects’ Rights
Users may exercise the rights recognised under data protection legislation:
- Access: to find out what personal data MULHACEN SKI processes.
- Rectification: to request the correction of inaccurate or incomplete data.
- Erasure: to request the deletion of personal data where applicable.
- Objection: to object to certain types of processing of their data.
- Restriction: to request the restriction of processing in the circumstances established by law.
- Data portability: to receive their data in a structured format and transmit it to another controller where applicable.
- Withdrawal of consent: to withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.
To exercise these rights, users may contact:
Alternatively, a written request may be sent to:
MULHACEN SKI, S.L.
Plaza de Andalucía, Edificio Salvia
18196 Sierra Nevada
Granada, España
The request must provide sufficient information to identify the data subject and specify the right they wish to exercise.
Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) if they consider that the processing of their personal data does not comply with applicable legislation.
9. Children’s Personal Data
Where a booking or contract includes personal data relating to minors, such data must be provided by their parents, legal guardians or a person duly authorised to enter into the corresponding contract.
MULHACEN SKI will process this data only to the extent necessary to manage and provide the contracted services.
10. Data Security
MULHACEN SKI will adopt the technical and organisational measures reasonably necessary to ensure a level of security appropriate to the risk and to protect personal data against destruction, loss, alteration, unauthorised access, use or disclosure.
Nevertheless, due to the very nature of the Internet, the complete absence of unlawful access or security incidents cannot be guaranteed.
11. Automated Decision-Making
As a general rule, MULHACEN SKI does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them.
12. Cookies and Similar Technologies
This website may use first-party and third-party cookies and similar technologies.
The use of these technologies and, where necessary, the obtaining of user consent are specifically governed by the website’s Cookie Policy.
13. Changes to the Privacy Policy
MULHACEN SKI may amend this Privacy Policy when necessary as a result of legislative changes, guidance issued by supervisory authorities, modifications to the services offered or changes to the personal data processing activities carried out.
Where the changes are significant, users will be informed through the website or by other appropriate means.
The current version will be the one published at www.mulhacenski.com.
