Prado Museum Privacy and Cookie Policy

Privacy and Cookie Policy

Privacy and Data Protection Policy (RGPD)

In CANDLE TOURS (Candle Tours, S.L.) we believe in the importance of guaranteeing the security and identity of our clients and users, as well as the correct treatment of the data they give us for the performance of our functions as managers and organizers of tourist and leisure tours. As a consequence of the application of the European regulation on personal data protection – Regulation (EU) 2016/679 – and Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights we put at your disposal everything you need to understand it. In addition, we have provided security measures to ensure compliance based on the type of data we use and its correct processing through risk analysis techniques.

Among others, the legislative framework to which we refer is the following:

Organic Law on Personal Data Protection and guarantee of digital rights 3/2018 – LOPDGDD.
European Regulation (EU) 679/2016 – RGPD
Law 34/2002, of July 11, 2002, on Information Society Services and Electronic Commerce.
Following the principle of layered information contained in the regulation, we provide you with the most relevant information that may be of interest to you:

Who is the Data Controller of your data?

Razón Social: CANDLE TOURS, S.L.

CIF: B75296913

Dirección: AVENIDA SAN CRISPIN, 86 Fuensalida – TOLEDO

Marca Comercial: CANDLE TOURS

E-mail de contacto: info@candletours.es

Teléfono de contacto: +34 636 242 999

What are we going to use your data for?

In CANDLE TOURS we use your data for the proper execution of the tourist services offered by our website.

The processing of your data as a customer for the development of the actions described above is based on your express consent, which is granted by providing the data requested, filling out and accepting this legal notice in the registration process in any of our areas, through the contact form of this website or in the process of purchase and online booking.

In no case, automated individualized actions and/or profiling will be carried out, which produce legal effects or significantly affect you in a similar way, except for those specific to the selection processes in those job offers in which you register.

The personal data provided will be kept for the duration of the binding contractual relationship or unless you request their deletion and provided that they are adequate, relevant and limited to what is necessary for the purposes for which they are processed.

The client/user is solely responsible for the completion of forms with false, inaccurate, incomplete or outdated data.

Who will your data be communicated to?

Your data will not be disclosed to any entity or professional or third party outside their own to ensure compliance with regulations on data protection and are necessary for proper service by CANDLE TOURS, such as those involved in the process of booking routes and access.

Where do we obtain your data from?

The data that we use and process have been provided by the clients in a conscious way and by means of express consent when filling in the initial data collection forms.

We have records of processing activities according to the obligations described by the European Regulation, which defines the types of data we have and the treatment we practice on them.

What are your rights and how can you exercise them?

Any customer/user has the right to obtain confirmation as to whether or not CANDLE TOURS is processing personal data concerning them.

Also, as provided by the General Data Protection Regulation (GDPR), we inform you that you have the following rights:

Access to your data
As a customer/user, you have the right to access your data to know what personal data we are processing concerning you.

Request the rectification or deletion of your data.
In certain circumstances, as a customer/user, you have the right to rectify inaccurate personal data concerning you that is processed by us or even to ask us to delete it when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Request the limitation of the processing of your data
In certain circumstances, as a customer/user you have the right to ask us to limit the processing of your data, in which case we inform you that we will only keep them for the exercise or defense of claims as provided for in the General Data Protection Regulation.

To the portability of your data
In certain circumstances, as a customer/user, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and to transfer it to another data controller.

Object to the processing of your data
In certain circumstances and for reasons related to your particular situation, as a customer/user you have the right to object to the processing of your data in which case, we will stop processing them except for compelling legitimate reasons, or the exercise or defense of possible claims.

The user has the right to withdraw consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. However, if consent is withdrawn, the user will not be able to use our services.

Where should you go to exercise your rights?

For the exercise of the recognized rights, the interested party may contact through 2 main ways:

Through the email address of CANDLE TOURS, is admin@candletours.es
By writing to CANDLE TOURS located at AVENIDA SAN CRISPIN, 86 45510 Fuensalida TOLEDO.
We will respond to your requests as soon as possible and, in any case, within the deadlines required by current legislation.

How long do we keep your data?

Your data will be kept for the duration of the relationship in which we provide our tourism and reservation management services. After the end of the contractual relationship, your data will be stored for the time periods in which the law requires us to carry out fiscal and administrative tasks.

Intellectual Property and Content

The intellectual property rights of the website, its source code, design, navigation structure, databases and the various elements contained therein (images, files, logos and any other element subject to protection) are owned by CANDLE TOURS to whom corresponds the exclusive exercise of the rights of exploitation thereof in any form and, in particular, the rights of reproduction, distribution, public communication and transformation.

Reproduction, transformation, distribution, public communication, making available to the public and, in general, any other form of exploitation, partial or total of the elements referred to in the preceding paragraph are prohibited. These acts of exploitation may only be carried out by virtue of express authorization and that, in any case, must make explicit reference to the ownership of the aforementioned intellectual property rights of CANDLE TOURS.

Who we are

Suggested text: Our website address is: https://museopradotickets.es.

Comments

Suggested text: When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

Suggested text: If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

Suggested text: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Suggested text: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

Suggested text: If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

Suggested text: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

Suggested text: If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Suggested text: Visitor comments may be checked through an automated spam detection service.