PRIVACY POLICY

With this Privacy Policy, abarset.com (hereinafter referred to as, we or L'ABARSET) informs you of the personal data that we collect through the services it offers and are reflected through this website (hereinafter referred to as "our Website" or "this Website"), how we process them and the rights that in relation to your personal data and our processing are conferred on you by the personal data protection regulations that are applicable to us.

Applicable regulations

1. Law 29/2021, of 28 October, on the protection of personal data of the Principality of Andorra (hereinafter referred to as, "LQPD"),
2. Decree 391/2022, of 28-9-2022 approving the Regulations for the application of the LQPD,
3. Decree 45/2023, of 25-1-2023, approving the Regulations amending the Regulations implementing the LQPD
4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as, the "RGPD").
 

Summary

While we hope you read this privacy policy in its entirety, here's a brief overview of its contents:

• Our goal is to limit the information we collect to what we need to provide you with our Services. We do not and will never sell your data. We treat them in a way that ensures adequate safety read more.
• We undertake to use your personal data only for the purposes reported read more
• We do not disclose personal data to third parties except where necessary, and we use a small number of trusted providers to help us process it (e.g. by stor-ing it) and to offer our services read more.
• You can exercise your data protection rights at any time read more.

In the following table you will find links to provide you with access to the points of this policy that are of interest to you, however, please read all the sections of the ,Legal Disclaimer, the Cookies Policy and this privacy policy before using this website:

1. Who does this Privacy Policy apply to?
2. Who is responsible for the processing of your personal data?
3. How do we obtain your personal data?
4. What do we use your data for and on what legal basis do we do it?

• To confirm your identity
• To offer you a more personalized service
• To initiate and maintain the relationship with our suppliers
• To initiate and maintain the relationship with our collaborators
• To initiate and maintain the relationship with our customers
• To preserve security through video surveillance
• To select and hire our staff
• To budget and offer our services
• To create a user account
• To manage your bookings
• To extract statistics to help us improve our services
• To deal with your requests, queries or complaints
• To better attend the chat that you will find on our website
• To manage tickets to events that are purchased through our website
• To analyse your assessment of our services and the interest in our marketing campaigns to improve
• To manage your online bookings or purchases
• To send you information, promotions and discounts of interest to you
• To manage any future claims
• To control access to our facilities, events or services through tickets or badges, or by making an appointment
• To safeguard and return to you the objects you lose in our facilities
• To provide media coverage of activities and events
• To publish information of interest on our blog
• To promote our facilities, products and services
• For remarketing actions with Google ADS, Twitter ADS and/or LinkedIn ADSS
• For marketing actions with Facebook ADS
• To ensure the operation of our website (functional cookies)
• To extract aggregate statistics on the use of our website (analytics cookies)
• To use Google services
• To report security breaches to you
• For additional purposes (scientific, historical, statistical or anonymization)

5. Who may we share your personal data with?
6. How long do we keep your personal data?
7. What rights do you have?

• Your rights
• Where and how you can exercise your rights
• Forms for exercising your rights

8. What responsibilities do you have?
9. How do we protect your personal data?
10. Changes to this Privacy Policy

1. Who does this Privacy Policy apply to?

This policy applies to individuals who interact with L'ABARSET through this website, to users of the services that L'ABARSET offers for the purposes described in section 4 of this policy (the services), and to all persons whose personal data (e.g. images) may appear on our website or in the context.

2. Who is responsible for the processing of your personal data?

The sole controller of your personal data in accordance with the provisions of this policy is:

• ENSI, S.A., with NRT D-D-800044-K and with registered office at l'Edifici Obac, El Tarter s/n, AD100, Canillo (Principality of Andorra).

We have an external Data Protection Officer - Win2win, SLU, an Andorran company specialising in privacy and personal data protection to whom you can contact by email DPDextern@win2win.ad.

L'ABARSET is not responsible for the activities carried out by other websites, even if you access them through links on our website. Therefore, we strongly recommend that you carefully read the information provided to you by the managers of these other websites (especially the privacy and cookie policies of each website you visit) before giving them your personal data, and that you contact these managers if you have any concerns or questions.

3. How do we obtain your personal data?

In general, it is you who directly provide us with your personal data – for example, through the forms that exist on this website. The only exceptions to this rule are:

• Your identification data, in case you decide to log in using your Facebook account (which acts as an identity provider) instead of filling out the registration form.
• Your voice and/or your image, when it is eventually picked up by our video surveillance cameras.
• Personal data provided to us by third parties who book or purchase the services on your behalf (as a beneficiary).
• Contact details provided to us by our service and product providers when you represent them.
• The details of the products you buy by showing one of our loyalty cards.
• The last four digits of your credit card, which, together with the purchase amount and the transaction number, is returned to us by our payment service provider in case you wish to consult or revoke the transaction.
• Photographs or videos of events we organise or participate in, and where you may appear
• Photographs, texts or other means of communication that the author may submit to publish on our website or on our social networks, usually within the framework of a participatory process, in accordance with the corresponding terms and conditions and, therefore, with your consent.
• Images or other personal data that correspond to a news item in which we consider that the public interest, our obligation of transparency and the right to information prevail over the possible interests of the people whose image or other personal data is published on our website or on our social networks.
• Images that correspond to any content on the website to which we have the corresponding rights.
• Personal data about you that may appear in emails and instant messaging that we receive, or through forms on our website; and
• The cookies on this website, about which you will find more information in our cookies policy.

4. What do we use your data for and on what legal basis do we do it
 

To confirm your identity

If we do not know you, we may use your personal data to confirm your identity and, if necessary, the entity you work for and your role in that entity. We do this when we are subject to legal obligations that require us to authenticate your identity before further processing your personal data, or where it is in our legitimate interest to ensure that your request is genuine and not made for fraudulent reasons or spam.

To offer you a more personalized service

We collect the optional data that you voluntarily provide us with in the forms (which are not marked with the "*") to offer you a more personalized service in relation to the purpose for which the form is specifically dedicated, and to extract statistics that help us improve our service and our services.

The basis that legitimizes us to process this personal data for this purpose is the consent you express when you provide it to us. As always, you can retract and withdraw your consent from us at any time, with the sole effect that we will no longer use this personal data and, therefore, the services associated with the form will be less personalized from that moment on.

To initiate and maintain the relationship with our suppliers

If you represent a supplier of products or services, we collect your contact details and signature to:

• a) Manage our relationships of all kinds with the supplier you represent.
• b) Manage the corresponding file on our list of authorised suppliers.
• c) Manage the budgets and invoices of the supplier you represent.

Processing linked to the purposes a) and b) are legitimized by the employment or service contract signed with the supplier you represent and our legitimate interest in contacting them. Processing related to the purpose c) are entitled to be necessary for the performance of the contract(s) you have signed with us.

To initiate and maintain the relationship with our collaborators

If you collaborate with us or represent a partner, we collect your contact details to:

• a) Manage our relationships of all kinds with the collaborator.
• b) Manage the corresponding file of our list of collaborators.

This processing is legitimised by the collaboration agreement and our legitimate interest in contacting them.

To initiate and maintain the relationship with our customers

We collect your data that we receive orally or in writing directly from you or from a third party representing you or of which you are a beneficiary, when you contract a service or product from us (e.g. an agreement to book a hotel room, or a contract for the wholesale sale of fuel or other products) for the purpose of preparing the corresponding contract, manage it, provide you with the contracted service and invoice you.

If you make a payment via POS, we collect the last 4 digits of your payment card along with your payment ID, date and amount, so that we can deal with any requests for information or refunds in relation to this payment. This data does not allow us to identify you, and therefore, if you want to request something from us in relation to it, you must provide us with some information that allows us to link it to you.

In addition, we inform you that, as a result of this contractual relationship and based on the provisions of article 19.2 of Law 20/2014, of 16 October, regulating electronic contracting and operators that carry out their economic activity in a digital space, we may communicate to you orally or in writing commercial information related to L'ABARSET's products or services.

The processing of this data is legitimised because it is necessary for the performance of the contract for services or products in which you are an interested party, and because of our legitimate interest in keeping you informed in relation to our products and services.

To preserve security through video surveillance

We collect your image and voice through our video surveillance systems in order to preserve the security of people, property and the facilities themselves, and to have video recordings as evidence of possible crimes.

The basis of legitimacy for the aforementioned processing is the public interest in public security, in accordance with section 3 of article 20 of Law 31/2021, of 22 November, on the qualified consolidated text of public security, the public interest in the safety of people when an alarm is activated, in accordance with section 1 of article 34 of Law 8/2022, of 31 March, on private security (for which there is a security guard who supervises in real time the images collected by the cameras for a reasonable time following the activation of the alarm in the alarm centre), the legitimate interest of L'ABARSET, or of affected third parties, in requesting judicial protection over a crime that can be proven by a few minutes of a recording, and our own legitimate interest in avoiding or reducing losses arising from crimes committed in the facilities and goods that house and protect the integrity and health of our products, protect the integrity of our workers, increase safety at work and speed up the speed of response to serious risks such as fires or theft by third parties.

Finally, the creation of copies and the transfer of these recordings when required by the competent judicial authority or the Police Force of the Government of Andorra for the purposes of investigating criminal or administrative offences is legitimised by the legal obligation imposed on us by section 4 of article 24 of the aforementioned Law 31/2021, public security.

security. To select and hire our staff

We process the CV data that you voluntarily send us, together with the data that appears on your strictly professional social media profile, such as LinkedIn, and those that we may collect during the interviews and tests that you voluntarily agree to carry out, as well as the references that you provide us, if you authorise us, to manage the relationship with you regarding your candidacy to perform a job at L'ABARSET, including the process of searching, filtering and storing the CV as a potential candidate, the personnel selection process and the recruitment process.

To ensure the objectivity and rationality of the selection processes, the above-mentioned tests may be completed with the passing of courses, internships, with the presentation of the curriculum by the candidates, with psychotechnical tests or with the conduct of interviews. Medical examinations may also be required.

The legal basis for the aforementioned processing is your consent, which you express when you send us your CV, fill out a test or attend an interview, to be necessary for the execution of pre-contractual measures if you request them, and if we do not have an open selection process or you are not hired and we consider that you can fit into future CV with the purpose of including it in these future selection processes. The basis that legitimizes us to consult your profile on strictly professional social networks, such as LinkedIn, is our legitimate interest in enriching the professional information of candidates to reduce the time that both you and L'ABARSET will take in the selection process. The basis that legitimises us by the processing associated with the complementary tests mentioned above is that they are necessary for the execution of the participation agreement in the specific selection process in which these tests are part of the participation bases that you have expressly accepted when registering. You may withdraw your consent or object to our legitimate interest as set out in section 7 of this policy, and if you do so, there will be no effect other than the destruction of your CV (if you withdraw your consent from us) or the limitation of its retention to the recruitment process for which you have sent it to us.

To budget and offer our services

We collect your data that we receive orally or in writing directly from you or from a third party representing you or of which you are a beneficiary, in order to prepare the service proposal that best suits the legal situation and, if you accept it, to prepare the corresponding service contract, in order to manage said service contract, provide you with the contracted service, provide services and invoice you.

he basis that legitimises the processing for the management of the budget is the consent you express in giving us the data we need to prepare it, while the one that legitimises the processing associated with the service, if you contract it from us, is the need for the execution of the contract that regulates the terms and conditions of use of this specific service.

To create a user account

We collect the data you provide us with when you register on our website, by filling in the form, to create a personal account to facilitate the management of your reservations or purchases, the shipments and commercial communications you want to receive, and to facilitate the evaluation of our services, as well as to control their access. Among other advantages, the account will save you from having to provide your personal details every time you make a reservation or purchase.

The basis that legitimizes this processing activity is the execution of the user contract that you sign at the end of the registration.

To manage your bookings

We collect the data you provide us in relation to the booking in order to formalise it and communicate to you by email or telephone any related information that may be of interest to you, as well as to manage and issue documents accrediting the booking and any related communication.

The basis that legitimises this processing is the purchase contract or booking agreement that you sign when you fill in the corresponding form, send us an email or a message, or confirm the data you have provided us orally (in person or by telephone).

To extract statistics to help us improve our services

We use the data you provide in the forms on this website in order to extract aggregated statistics (in which it is not possible to identify any specific person) in order to improve the services that we offer you.

The legitimate basis for processing your data for this purpose is our legitimate interest in improving our economic performance and, at the same time, the services we offer you.

To deal with your requests, queries or complaints

We collect the personal data that you voluntarily and freely provide us with in your emails or instant messaging messages, by telephone, through the forms on the website, or through requests to exercise rights, to respond to your requests, queries or complaints in relation to our services or the rights you have over your personal data.

The legal basis for this processing is our legal obligation to respond to your requests to exercise rights, and, for all other purposes, our legitimate interest in serving you. The provision of your personal data is therefore voluntary, although if you do not provide them to us, we will not be able to respond to your request, query or claim. You can object to our legitimate interest at any time, but such opposition will also make it impossible to continue processing your request, query or complaint.

To better attend the chat that you will find on our website

We collect in a request and incident management system the content of the conversation that you voluntarily initiate in the chat (Whatsapp) that exists on our website, including the telephone number with which you contact us. The purpose of the collection and subsequent processing of this data is to manage your request/query from our system, so that you can respond to the first technician who is available, and that all the technicians who analyse your request/query/incident can provide more information. We record the conversation in our management system for 6 months in case you have to refer to it in future contacts, and to manage possible problems if we identify that there are more people who make a query/request/complaint similar to yours.

We delete the conversations from our corporate Whatsapp when they have been resolved for approximately one month, and we have implemented complementary security measures to those of Whatsapp to ensure that neither this conversation in your app, nor the copy that will remain for 6 months in our system, loses its confidentiality, integrity and availability.

The legal basis for this processing is our legitimate interest in improving customer service, and you can object to it at any time, although not responding to your request from our management system may result in a small delay in the response from Whatsapp and we will not be able to relate your conversation with that of other interested parties or reopen a conversation when it has one.

To manage tickets to events that are purchased through our website

We collect the data you provide in connection with the booking or purchase of tickets in order to process your purchase and communicate to you by email or telephone any related information that may be of interest to you, as well as to manage and issue documents accrediting the purchase or sale of tickets and any related communication.

The basis that legitimises this processing is the purchase contract or booking agreement that you sign when you fill in the corresponding form, send us an email or a message, or confirm the data you have provided us orally (in person or by telephone).

To analyse your assessment of our services and the interest in our marketing campaigns to improve

We may process the data you provide us, for example, during the purchase or booking of products or services, to request an assessment of the service received.

We may also extract aggregated statistics (i.e. the statistical result of which does not include personal information of any kind) in relation to the interest in our marketing campaigns.

The basis that legitimises this processing is our legitimate interest in improving the quality of our services and the events we manage or promote, as well as our marketing campaigns.

To manage your online bookings or purchases

We collect the data you provide in connection with the booking or purchase of tickets and other services, products or promotions that combine our services and products with those of our partners, to process your purchase or booking and to communicate to you by email or telephone any related information that may be of interest to you, as well as to manage and issue documents accrediting the booking or booking. We may also use the data you provide to us during your purchase or booking to monitor whether or not the services are used and to extract statistics regarding the interest in our promotions.

The basis that legitimises these treatments is the ticket purchase contract, and our legitimate interest in improving the quality of the events that we manage or promote through the sale or reservation of tickets from our website.

To send you information, promotions and discounts of interest to you

We collect your email address when you subscribe to our commercial communications service (newsletters), or when you purchase our services, to inform you about news, events, exclusive content and advice so that you can make the most of our services.

If you have subscribed through our website, the legal basis for this processing is your consent, and you can withdraw it at any time by exercising your right as indicated below in this policy, or through the link that appears at the bottom of each email. The only consequence of withdrawing consent is that you will no longer receive the catalogues and information that we send you by email, and will be able to participate in promotions, competitions or sweepstakes reserved for our subscribers.

If you receive the information because you have purchased any of our services, the legal basis for this processing is our legitimate interest in keeping you informed about our products and services related to those you have purchased, to which you can object at any time, as in the previous case and with identical consequences, exercising your right as indicated below in this email.

To manage any future claims

We retain data that may be necessary to handle your or our potential complaints based on our legitimate interest in defending ourselves to safeguard our rights.

To control access to our facilities, events or services through tickets or badges, or by making an appointment

We use your booking details, and sometimes your ID or passport and even a document proving your protection status against Covid-19 (the latter, only if we are legally obliged to do so), to authorise, or not, your access to the restricted areas of our events, facilities or services to analyse and control occupancy and control your safety (including the prevention of the spread of disease and the contact tracing of people affected by Covid-19).

The legal basis for this processing is the contract for the sale of your ticket or the service contract to which you are a party, and in the event that we request documents proving your protection status against Covid-19, our legal obligation.

To safeguard and return to you the objects you lose in our facilities

If you have lost a mobile phone or any other object containing personal data and we find it or it is delivered to us, we will safeguard this personal data until the legitimate owner of the lost object successfully claims it at our customer service point or, after a reasonable time, we will hand it over to the police authorities so that they can manage it.

The basis that legitimizes us to process the personal data of mobile phones, wallets, backpacks and other objects that may contain personal data in this way is our legitimate interest in preventing theft and returning it to you.

To provide media coverage of activities and events

If you participate in our activities or attend our events or awards ceremony in person, the independent press and our own professionals may register your image and, at the times previously agreed, your voice, in the context of the event or the award ceremony.

The legal basis for this processing of your image is your express consent whenever we are able to request it or you express it unequivocally by putting it by putting the photo or video. Where it is not possible for us (for example, where time has elapsed since the recording and we do not have your contact details), legitimate interest in media coverage of events we organise or sponsor for the purpose of using the recordings as promotional materials through our communication channels, including our website and social media accounts.

You are not required to appear in a recording. If you wish, you have the right to object to our legitimate interest and ask us to remove material where you are identified. In order to assess your objection to our legitimate interest, and where appropriate to immediately remove the images that identify you, we will ask you to tell us where you have seen them.

To publish information of interest on our blog

We publish and disseminate news, news and informative content of public interest related to the activities, services, initiatives or topics of L'ABARSET, through the blog on our website (press).

The legitimate basis for publishing news and content that includes personal data is our legitimate interest in contributing to the transparency and public dissemination of information that we consider relevant to our users and that is related to our activities and services, and to the interests of visitors.

To promote our facilities, products and services

If you have signed a contract or consent for the assignment of image rights with us, we may collect photographs or videos of our facilities, products or services in which you are identified, and perhaps heard, and then use them in promotional campaigns or publish them in the media such as the national or international press, our website or our social networks. If you have signed a consent for the transfer of image rights, we inform you that you can revoke it at any time so that we can remove your image from our website and/or our networks, without the revocation having any effect on the dissemination that took place before processing it.

In addition, we may graphically record the atmosphere of our premises to promote our premises, its products and services and, from time to time, your image may appear in this graphic material. Unlike what was indicated in the previous paragraph, in this case, the legal basis for the processing of your images is our legitimate interest, which you can object to at any time if you consider that it is contrary to your own interests. In order to assess your objection to our legitimate interest, and if necessary to remove images identifying you immediately, we will ask you to tell us where you have viewed them.

For remarketing actions with Google ADS, Twitter ADS and/or LinkedIn ADS

"Ads" platforms are intended for advertisers who want to advertise on Google, Twitter and/or LinkedIn. L'ABARSET uses these advertising platforms to create campaigns and advertisements that will be displayed on other websites. When generating an ad, we segment the target audience by:

• Place
• Demographics (age, gender, etc.)
• Interests (activities, hobbies, etc.)
• What they buy online and through other channels
• Etc.

The data obtained through the advertising platform is subject to this privacy policy from the moment the user clicks on an advertisement published by L'ABARSET on another website. Under no circumstances will we use information from the advertising platform for any purpose other than to measure the efficiency of our campaigns and to remunerate the service providers who operate the advertising platform on our behalf.

The basis that legitimises this processing is the consent you give us when you accept the terms and conditions of use of the website where you find our advertisement.

For marketing actions with Facebook ADS

Facebook Ads is used on our website; a tool that allows you to segment the audience to target an ad, and about which you can find more information, including how to configure it, here 

Thanks to Facebook's Custom Audiences feature, an audience can be created from data from Facebook users and subscribers, such as email addresses and phone numbers. To do this, it is necessary to share the databases with Facebook and then create custom audiences by directing the ads to people with similar profiles.

Sensitive personal information is not used for the targeting of ads in accordance with Facebook's Policies and is not shared with third parties or other advertisers, being deleted by Facebook when this process is completed. In addition, Facebook will be responsible for ensuring its confidentiality.

The ad system designed by Facebook allows you to show relevant and useful ads without revealing your identity to advertisers, being able to reach groups of people with certain profiles. To do this, Facebook tracks users' actions after clicking on an ad.

To use the Custom Audiences feature, our website uses Facebook's Website Custom Audience tool, which uses the Facebook pixel that marks the visitor to this website in an anonymised form.

The basis that legitimises this processing is the consent you give us when accepting marketing cookies, since without it the Facebook pixel cannot be used. Additionally, if you wish to object to the use of Facebook's Website Custom Audiences, you have the option to do so here. 

At any time as a user, you can revoke your consent via this link, where you can configure the reception of advertisements. You can also opt-out of interest-based ads from Facebook or other companies through the European Interactive Digital Advertising Alliance (EDAA) of Your On-tene Choicesor in the settings on your computer or mobile device.

To ensure the operation of our website (functional cookies)

We use functional cookies to collect, store, consult and process personal information (linked to you by means of unique identifiers or IP addresses), from your device's browser, in order to ensure the proper functioning of our website.

As they are cookies necessary for the proper functioning of the website or personalisation cookies, their use does not require your express consent, and the basis that legitimises us to use them is our legitimate interest in being able to offer you the services of our website in accordance with your preferences.

You can find more information about these cookies in our cookie policy.

To extract aggregate statistics on the use of our website (analytics cookies)

We use analytical or statistical cookies to identify the most and least visited pages, analyse which content is of most interest to our visitors, and measure the success of our information campaigns, all with the aim of improving the services we offer you through the website. All of these purposes provide aggregated results, where it is not possible to identify the interests of any particular person.

The LQPD does not impose specific requirements on this type of cookie, and the European Data Protection Board has noted that, in general, if they are not sent to third parties, the data collected for statistical purposes does not pose an appreciable risk to the data subjects.

However, the law regulating electronic contracting and operators carrying out their economic activity in a digital space requires that, when the website is dedicated, among other things, to carrying out an economic activity in the digital space, or if the data collected by the statistical cookies is shared with third parties, the data controller may only use the data from the statistical cookies or transfer them to third parties with your consent. If this is the case with our website, we will ask for your consent before using your data, and not giving it to us or withdrawing it will have no effect other than to hinder our purpose of improving the website by analysing aggregated statistics of our visitors' browsing.

You can find more information about these cookies in our cookie policy.

To use Google services

In addition, as an obligation imposed by Google LLC, a company of which Google Ireland Ltd is a subsidiary, on entities like us who use Google Analytics tools, we inform you that these two services are operated by Google Inc., domiciled at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and that Google Inc. is a beneficiary of these services.

The information generated by cookies about your use of this website and your advertising preferences is usually transmitted to a Google server in the USA and stored there. For more information, please refer to the page describing how Google uses information on our website and/or Google's privacy policy regarding our website.

Please note that we have enabled the IP anonymization feature in the Google service to add additional safeguards to the standard contractual clauses that protect this international transfer of data to the U.S. This will shorten your IP address before transmitting it to the USA (your identity obfuscation process). Only in exceptional cases is the full IP address sent to a Google server in the USA and abbreviated there. Google guarantees that the IP address transmitted by your browser to Google Analytics will not be processed in conjunction with any other data held by Google.

You can find the categories of personal data processed by these services in privacy.google.com/businesses/adsservices.

To report security breaches to you

L'ABARSET has implemented security measures appropriate to the level of risk to protect personal information against loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in the processing and the nature of the personal information. However, if we determine that your data has been misappropriated (including by an employee or former employee of L'ABARSET), has been exposed by a security breach or has been improperly acquired by a third party, and exposes you to a high risk, we will immediately inform you about this breach and those that we recommend you take so that the breach does not affect you.

The basis that legitimises this processing is the legal obligation set out in Article 37 of the LQPD (35 of the GDPR), and our legitimate interest in preventing this security breach from harming you.

For additional purposes (scientific, historical, statistical or anonymization)

Your personal data may be subject to subsequent (subsequent) processing provided that they are compatible with the original purpose for which they were collected. Specifically, they can be used for scientific, historical or statistical purposes.

These additional purposes include the anonymization of personal data for statistical or research purposes. This processing is based on the legitimate interest of This Entity to improve its public services.

5. Who may we share your personal data with?

We do not transfer your personal data to anyone, unless:

• You are the one who asks us to do so.
• We have a legal obligation to do so.
• It is necessary so that, in accordance with the terms and conditions of use of our cards, a merchant associated with our benefit programs can give you the corresponding benefit for your purchase when you show them our card.
• Is necessary to enforce the terms and conditions of our products and services, including investigation of potential violations.
• Is necessary to detect, prevent, or otherwise address fraud, security, or technical issues.
• We act as an intermediary, for example, when we need to make a booking on your behalf (e.g. at an event).
• You contract our products or services through intermediaries (e.g. a travel agent) to whom we need to deliver products or services that they have purchased on your behalf, either with your consent, to represent you legally, or for you to explicitly authorise us to do so.
• We are jointly responsible for the collection of data, so that, always with your consent, other entities process it on their own behalf. This is the case of:
  • Google Ireland Ltd, with registered office at 4 Gordon House, Barrow - Dublin, Ireland, to which we have entrusted the data processing of the cookies necessary to use its reCAPTCHA and Analytics services. Google Ireland Ltd. acts as an independent controller for all processing carried out on your behalf in accordance with its privacy policy. We transfer data to Google Ireland Ltd. on the basis of the data protection agreement that this company located in the EU includes in the addendum to the standard contract for countries suitable for the GDPR, such as Andorra, to which we add the additional safeguard of activating the anonymization of the IPs that collect cookies. In our cookie policy you will see which analytical and advertising cookies we offer and how to configure them.
  • Other advertising companies that publish their own advertisements in the spaces designated for this purpose on our website. We are jointly responsible for the collection of your personal data through your cookies, provided that you consent to it, since, without our website, this data would not be collected. These third parties use them to display ads that are more personalized to the interests that can be inferred from your internet browsing. In our política de cookies cookie policy you will see which advertising cookies we offer you and how to configure them.
• We need to protect your, our, our employees' rights, or those of third parties (which may require handing over to the police for security reasons or to health authorities to prevent the spread of disease, for example, for contact tracing purposes). For example:
  • If our video surveillance cameras record a theft at our premises, or
  • If a third-party requests video surveillance images from us based on their legitimate interest in requesting effective judicial protection with respect to the commission of a crime or compensation for damages that prove the images transferred, and with the commitment of said third party to use them exclusively for the reporting of this crime or for the transfer of images at the minimum and essential to comply with the purpose pursued.
• A company subcontracted by us needs to process them on our behalf (e.g. the company that provides us with the services of data protection officer, and which must respond to your requests for rights), always under the terms and conditions of the relevant data processor contract.
• If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, judicial accession, purchase or sale of assets, or transition of service to another provider, your personal information may be transferred as part of a transaction as permitted by law and/or contract.
• We need to protect or defend the rights or property of L'ABARSET.

It is not planned to carry out any international transfer of personal data, and, if we eventually need to do so, we inform you that they comply with the provisions of the regulations in force that apply to us at any time, and preferably, selecting providers that guarantee that they only transfer your data when the recipient countries offer a level of protection equivalent to article 43 of the LQPD.

6. How long do we keep your personal data?

In general, L'ABARSET keeps your personal data exclusively for the duration of the processing that requires them and, thereafter, for as long as it takes for the legal responsibilities that apply to us at any given time, derived from the processing in question to expire (including the obligation to be able to demonstrate that we have complied with your request for the destruction of personal data).

The personal data that we process as necessary for the execution of a contract (art. 6.1.b of the LQPD) will be kept for as long as there is a mutual interest in maintaining the purpose of the processing and for the maximum legal period allowed by data protection legislation, including the limitation periods for legal actions to address possible liability that may arise. When it is no longer necessary for any purpose, they will be removed with adequate security measures to guarantee their destruction.

The personal data that we process by legal obligation (art. 6.1.c of the LQPD) will be kept for as long as we are subject.

During the storage periods established to formulate or respond to possible complaints and/or the storage periods provided for by legal obligation, personal data will remain blocked and will only be made available to the competent authorities that require them, upon official request.

When a personal data is no longer necessary for any purpose, it will be destroyed with security measures appropriate to its sensitivity .

For example, we will retain video surveillance recordings for up to 30 days when they do not contain incidents, and, if exceptionally a security incident has occurred during this period or there are indications of a crime (e.g. theft), we will extract a copy of the portion of the recording that collects the incident that is required to prove your request for judicial protection.

We will destroy your CV when it is more than five years old, as we consider it to be outdated in relation to the purpose for which it is dedicated.

We will destroy any unnecessary or disproportionate personal data that may appear in the emails and instant messaging we receive, or through the forms on our website as soon as we receive it.

We will destroy (and rectify) any personal data that we find to be inaccurate as soon as we find it to be inaccurate.

If you send us a copy of an identity document, we will destroy this copy or obfuscate the sensitive data as soon as we have verified that it fulfils the function for which you sent it to us.

In addition, the profiling data we use to personalise the information you receive through our newsletters will be irreversibly anonymised when you unsubscribe.

Where we do not have a legitimate purpose for processing some of your personal data, we will delete or anonymise it, and if this is not possible (e.g. to be backed up), we will securely store it and block it to isolate it from any further processing until it is possible to delete it.

7. What rights do you have?

You have the right to obtain confirmation as to whether or not we hold any personal data about you.

We remind you that when we share personal data with other controllers, you will need to exercise your rights directly against them by following the instructions provided in their own privacy policies. Specifically, in relation to the data that our cookies share with Google, we inform you that you can install it in your Chrome, Internet Explorer, Safari, Firefox and/or Opera browser, the the add-on to not send Google Analytics or Google Ads data to Google Inc.

Below, we explain what other rights you have and how to exercise them.

Your rights

You can ask us to enforce the following rights:

• Access to your personal data.
• Rectification of any of your personal data, specifying the reason.
• Deletion of some or all of your personal data..
• Limitation of the processing of your data, specifying the reason for the limitation.
• Opposition to the processing of your personal data..
• Portability of your data when the basis for legitimizing the collection has been consent or contract.
• Right not to be subject to automated individual decisions..

The consent given, both for the processing and for the transfer of the data of the interested parties, is revocable at any time by communicating it, as well as any other right, as indicated in the following section. This revocation or withdrawal will in no case be retroactive. Therefore, it does not affect the lawfulness of the processing based on consent prior to withdrawal.

Where and how you can exercise your rights

You can exercise your rights:

• 1. By sending a written request to our postal address, indicated in the 2 of this policy, indicating a means of contacting you so that we can respond to your request, or ask you for more information if necessary. We would appreciate it if you could write to us in the envelope "Exercise of personal data protection rights".
• 2. By sending an email or the form associated with the right you wish to exercise at the email address DPDextern@win2win.ad, preferably indicating in the subject "Exercise of Personal Data Protection Rights". You will find these forms below, in this same section of the privacy policy.

In both cases, if we are unable to prove that you are who you say you are, we will ask you to please provide us with proof of your identity, and thus ensure that we respond only to the data subject or their legal representative.

If the sender does so in his capacity as representative of the person concerned, the accreditation of the representative must be carried out by means of documents or legal instruments that correctly identify the person concerned and the representative and specify the assignment or procedure for which the representation is delegated, as well as its scope.

Finally, and especially if you consider that you have not obtained full satisfaction from the exercise of your rights, we inform you that you may file a complaint with the national supervisory authority of your country, or by contacting the Andorran Data Protection Agency (APDA) for this purpose.

Forms for exercising your rights

In order to facilitate the exercise of your rights, we recommend that you use the corresponding application forms from the following and do not fill in the data that you consider is not necessary to authenticate your identity or that of your representative:

• Form for exercising the right of access
• Form for exercising the right of rectification
• Form for exercising the right to object (Model A, and Model B)
• Form for exercising the right to erasure
•  
• Form for exercising the right of portability
• Form for exercising the right not to be subject to automated individual decisions

8. What responsibilities do you have?

By providing us with your details, you warrant that they are accurate and complete. Likewise, you confirm that you are responsible for the veracity of the personal data you have communicated to us and that you will keep them suitably updated so that they correspond to your real situation, making you responsible for false or inaccurate personal data that you may provide us, or that become inaccurate later, as well as for damages, direct or indirect, which could be derived from their inaccuracy.

You may not provide us with personal data of other people unless it is justified in relation to the services you request from us. In any case, if you provide us with the personal data of third parties, you assume the responsibility of informing said third parties prior to providing us with their personal data. This information, which you must provide to the third parties whose data you provide to us, must include all the provisions provided for in this privacy policy, and it is you who is responsible for the lawfulness of this personal data and for transmitting to its owners the rights they have in relation to their personal data.

In cases where you have to provide us with personal data of a child under 16 years of age or of a person whose rights are limited; by doing so you are obliged to have the authorisation of the holders of their parental authority or guardianship. Without this authorization, you are prohibited from providing us with any personal data of these individuals.

9. How do we protect your personal data?

We are fully committed to protecting your privacy and personal data. We have compiled a record of all the personal data processing activities we carry out, analysing the risk that each of these activities may pose to you, implementing the appropriate legal, technical and organisational safeguards to avoid, as far as possible, the alteration of your personal data, its misuse, loss, theft, access or processing. We keep our policies up to date to ensure that we provide you with all the information we have about the processing of your personal data, and to ensure that our staff receive appropriate guidance on how they should process it. We have signed data protection clauses and processor contracts with all our service providers, taking into account the need that each one has to process personal data.

We restrict access to personal data to those employees who really need to know it in order to carry out any of the processing mentioned in this policy, and we have trained and made them aware of the importance of confidentiality and maintaining the integrity and availability of information, as well as the disciplinary measures that any possible infringement in this area would entail.

However, if we determine that your data has been misappropriated (including by an employee of ours), exposed by a security breach, or improperly acquired by a third party, L'ABARSET will immediately inform you of that security breach, misappropriation, or mis acquisition.

In addition, and despite the fact that, once anonymized, personal data falls outside the scope of personal data protection regulations, we are committed to carrying out a periodic review of the emerging risks for anonymous data. This includes monitoring and evaluating new techniques and studies that may jeopardize the robustness of the anonymization processes applied and, eventually, allow the re-identification of affected individuals. If necessary, L'ABARSET will take corrective measures to ensure the effective and continuous protection of your privacy

10. Changes to this Privacy Policy

We may make changes to this policy from time to time (a) where such changes are necessary to comply with data protection regulations applicable to us, or (b) where the changes: (i) are commercially reasonable; (ii) do not entail a material reduction in the level of security provided by L'ABARSET for personal data; and (iii) do not otherwise have a material adverse impact on the rights of data subjects or any entity related to them under this policy.

If the changes are material, we will inform you before they become effective by notifying you or posting a prominent notice on this site, and you will have the option to exercise your rights as we informed you in a previous section. In any case, we recommend that you periodically review this privacy policy to learn how we protect your personal data.

If you have any questions about this policy, please feel free to let us know by emailing dpdextern@win2win.ad.

Last updated: August 18, 2025