Privacy Policy

Those responsible for the processing of your personal data are Leisure Parks, S.A. (the company that operates Benalmádena Cablecar) and the company that manages its central services, Parques Reunidos Servicios Centrales, S.A., both with registered offices at C/Federico Mompou, 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain, acting individually as data controllers and jointly as joint controllers (hereinafter, the "Controllers").

If you have any questions about the processing of your personal data or wish to request the key parts of the co-responsibility contract between the Controllers, you can contact the Data Protection Officer (DPO) by sending your request to the postal address at C/Federico Mompou, 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain or by email to dpo@grpr.com.

The Controllers will process your personal data in accordance with the purposes detailed below and in accordance with the purpose of the channel through which you have provided them:

Management of the contractual relationship for the purchase or reservation of products and services

The personal data provided will be processed in order to manage the purchase or reservation of products and services of the Responsible Parties, process the payment of the same and send you by e-mail the confirmation and the corresponding receipt together with the relevant documentation for your visit and access to the park. 

If during the process of purchasing or booking products and services you make use of promotions that are subject to compliance with specific conditions on your part (large family, discount code for certain groups, etc.), please note that at the ticket offices of the park we may ask you for the corresponding documentation to verify compliance with these conditions (large family card, official document accrediting membership of certain groups, DNI/NIE/Passport/Driving Licence, etc.), without this entailing the registration or storage of this information by the Responsible Parties.

Should unforeseen events or circumstances arise that may affect the product or service contracted by you (weather conditions, safety reasons, public health, etc.), the Responsible Parties may contact you by electronic means (e-mail, SMS, telephone calls) to inform you of the possible circumstances that may affect your visit.

Category of personal data processed: name, surname, email, telephone, transactional information derived from the purchase or reservation of products and services, proof and payment details, date of birth (to ensure that you are over fourteen (14) years of age, otherwise, in accordance with European legislation on data protection, we would need to obtain the consent of your legal guardians) and country (to ensure that any communication we send you for the purposes described above is in the language of the country you have provided to ensure that it is understood at all times).

Basis of legitimacy: the basis that legitimates the processing of your personal data is the execution of the contract entered into between you and the responsible parties for the purchase or reservation of products and services (terms and conditions of contract). Without such personal data, the purchase or reservation of products and services from the Controllers could not be formalised.

Customer service

If you request information about products and services or send us queries, suggestions, complaints, claims or incidents through any of the channels that the Controllers make available for this purpose (specific form, telephone or email) the personal data will be processed to manage and respond to your request by email or telephone call depending on the means used by you to send us your request.

Category of personal data processed: first name, last name, telephone, email, transactional information related to the purchase or reservation of products and services, date of birth (to ensure that you are over fourteen (14) years of age, as otherwise, in accordance with European data protection legislation, we would need to obtain the consent of those with parental authority or legal guardianship), country (in order to ensure that we deal with your request in the language of the country you have provided to ensure understanding at all times) and any other information that you voluntarily provide in your request.

Basis of legitimacy: the data processing will be carried out for the implementation, at the request of the data subject, of pre-contractual measures or for the performance of the contract (terms of business) to which you are a party for the purchase or reservation of products or services. Without the personal data indicated, your request could not be fulfilled for this purpose with the same effectiveness.  Likewise, we understand that our customers may have a reasonable expectation regarding the performance of this processing based on the contractual relationship they have with the Controllers for the purchase or reservation of products and services, on the specific information provided by the Controllers during the purchase process and on the fact that this type of processing is carried out within a standard and common practice in the industry of companies providing services. Furthermore, in order to achieve this purpose, we remind you that we only process strictly necessary personal data of a non-sensitive nature, that we do not send surveys to children under fourteen (14) years of age and that we only contact our customers on an ad hoc basis and for a limited period of time.

However, you may at any time object to the processing of your personal data or exercise your other rights under data protection legislation in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.

Sending surveys

If you purchase or book any of our products or services, the Responsible Parties may send you surveys by electronic means (email, SMS, telephone calls) aimed at finding out your degree of satisfaction, your experience and your possible suggestions about the product or service contracted. Your opinion will be used to improve the processes, products and services of the Controllers.

Category of personal data processed: email, telephone, transactional information related to the purchase or reservation of products and services, country (in order to ensure that the survey is sent in the language of the country you have provided during the purchase process to ensure that the survey is understood at all times) and any other non-personal information that you provide through the surveys to which you respond.

Basis of legitimacy: this processing is necessary for the satisfaction of legitimate interests pursued by the Controllers in order to know the opinion of their customers regarding the products and services contracted and their possible suggestions in this regard. The Controllers understand that the rights and freedoms of their customers are not undermined and that there is a balance between the interests of both parties insofar as this processing makes it possible to achieve the purpose pursued (to know the opinion of the customers), which is necessary for the Controllers to improve their products, services and operational processes of the park and for the customers to obtain an improvement in the quality of their experiences. In addition, as a result of the volume of visitors that may visit the park, we understand that sending surveys electronically is necessary for the purpose described and there is no other mechanism that would achieve this purpose with the same effectiveness.  Likewise, we understand that our customers may have a reasonable expectation regarding the performance of this processing based on the contractual relationship they have with the Controllers for the purchase or reservation of products and services, on the specific information provided by the Controllers during the purchase process and on the fact that this type of processing is carried out within a standard and common practice in the industry of companies providing services. Furthermore, in order to achieve this purpose, we remind you that we only process strictly necessary personal data of a non-sensitive nature, that we do not send surveys to children under fourteen (14) years of age and that we only contact our customers on an ad hoc basis and for a limited period of time.

However, you may at any time object to the processing of your personal data or exercise your other rights under data protection legislation in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.

Sending of commercial communications, including personalised communications, of products and services of the Parques Reunidos Group

Only if you expressly consent through the box included for this purpose in the different forms of this website or by clicking on the "send" button of the newsletter form, your personal data will be processed by the Responsible Parties to send you by any means, including electronic means (e-mail, SMS, telephone calls), communications about the European companies of the Parques Reunidos Group (all of them identified below in this Privacy Policy) which may include newsletters, discounts, promotions, relevant information or commercial information about their activities, events, products and services related to the leisure and hotel sector, including personalised communications after profiling and analysis of your preferences through automated decisions so that these communications may be of interest to you. The aforementioned personalisation will be carried out by means of profiling based on automated decisions made in accordance with the configuration and filtering of the parameters detailed below in our email marketing platform: demographic criteria based on the postcode and country provided, self-sourced transactional information related to your purchase history and the type of products and services purchased (tickets, season pass or park pass, experiences, parking or food and beverage related products) and inferred socio-economic parameters based on your age, the type of product or service you purchase and the analysis of your behaviour when you receive a commercial communication from the Controllers (whether or not you activate the purchase of the product or service offered to you through the commercial communication sent).

The indicated profile will not be used to make automated decisions with legal effects on you or that will significantly affect you in a similar way (economic effects, denial of services, discriminatory, disadvantages with respect to other customers, etc.) as it will only be carried out so that you only receive communications with commercial information that we consider to be more in line with your interests.

Category of personal data processed: the e-mail address and telephone number will be processed for sending commercial communications and the country to send these communications in the corresponding language. The personalisation parameters indicated above (demographic criteria, transactional information and inferred socio-economic parameters) will be processed so that you will only receive communications with commercial information that we consider to be most relevant to your interests.

Basis of legitimacy: this processing will only be carried out if you voluntarily give your express consent through the box provided for this purpose in the various forms on this website. We remind you that, in addition to the other rights granted to you by data protection regulations, at any time you may also withdraw your consent and request to unsubscribe from the sending of commercial communications, request not to be subject to automated individual decisions, including the creation of your profile, request human intervention in automated decision-making, express your point of view, resolve any doubts in this regard or contest them in accordance with the provisions of the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.

Market research and analysis

The Controllers will proceed to dissociate the postcode and country provided by you through the forms on this website from the other personal information in order to carry out quantitative and qualitative aggregated statistical reports to carry out market research and analysis that will allow us to evaluate our market positioning based on the geographical area from which the products and services are purchased and to make strategic business decisions (e.g. sales trends).

Category of personal data processed: aggregated information relating to postcode and country and previously dissociated from the other personal data provided.

Basis of legitimacy: this processing is necessary for the satisfaction of legitimate interests pursued by the Controllers to know and understand the geographical area from which their products and services are purchased in order to carry out the described purpose. The Controllers understand that the rights and freedoms of their customers are not undermined and that there is a balance between the interests of both parties (customers and Controllers) insofar as this processing makes it possible to achieve the purpose pursued (to evaluate our positioning in the market), which is necessary for the Controllers to make strategic business decisions and even improve their products, services and operational processes of the park, which would mean providing our customers with a better quality of their experiences.  In addition, we understand that there is no other more moderate mechanism to achieve this purpose with the same effectiveness, as only basic non-sensitive information (postal code and country) is used and previously dissociated from any personal data that would allow the individual identification of customers during the course of this purpose. We also understand that our customers may have a reasonable expectation of this processing based on their contractual relationship with the Controllers for the purchase or booking of products and services, on the specific information provided by the Controllers and on the fact that this type of processing is standard industry practice for service providers.

However, you may at any time object to the processing of your personal data or exercise your other rights under data protection regulations in accordance with the procedure described in the section "What are your rights when you provide us with your personal data" included in this Privacy Policy.

Cart management and recovery

Only if you provide your email address and give your express consent through the pop-up that will appear during the online purchase process in case of inactivity on your part, your personal data will be processed so that, if you do not complete the purchase or reservation of products and services previously selected by you, we can send you by email a reminder to complete the purchase or reservation of them.  If you do not complete the purchase or reservation of such products and services, you will be sent a brief survey by email to find out why you do not wish to complete the purchase or reservation, which will help us to improve the web experience for our customers.

Category of personal data processed: e-mail

Basis of legitimacy: this processing will only be carried out if you voluntarily give your express consent through the pop-up that will appear during the online purchase process in case of inactivity on your part. We remind you that, in addition to the other rights granted to you by data protection regulations, you may also withdraw your consent at any time and request to unsubscribe from the sending of abandoned cart reminders in accordance with the provisions of the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy.

Dissemination of the content of users who have previously mentioned or tagged the park on social networks

If you share content on your social networks and mention the park's user account (for example, you mention us in stories or posts...), we may process your personal data to promote the image of the park on your social network profiles by sharing that publication where you mention the park.

Please note that we do not control the processing of personal data of users of social networks where the park has a registered account (Facebook, Twitter and Instagram). For more information on how and for what purposes the social media provider collects and processes personal data, and on users' rights and options to protect privacy, please refer to the applicable privacy policies of the social media provider.

Category of personal data processed: user account, image and/or voice of the social network user and/or third parties that may appear in your post.

Basis of legitimacy: this processing will only be carried out if you voluntarily give your express consent by replying in the affirmative to the direct message sent from the social network profile of the Controllers. We remind you that, in addition to the other rights granted to you by data protection regulations, you may also withdraw your consent for us to delete the publication at any time, either in accordance with the provisions of the section "What are your rights when you provide us with your personal data" included in this Privacy Policy, or by sending a direct message to our profile on the social network where we have shared said content.

Compliance with legal obligations

When you provide personal data through the various channels established on this website, both personal data and, where applicable, transactional information relating to the purchase and procurement of products, services or events, such processing will be carried out in compliance, where necessary, with the legal obligations applicable to the Controllers as a result of the contractual relationship maintained with you and the processing of your personal data (obligations required by tax regulations, personal data protection regulations, commercial law regulations, user and consumer protection regulations, information society services and e-commerce regulations, civil law regulations, accounting regulations, etc.). In this regard, only if necessary and depending on the type of legal obligation that must be met by the Controllers, personal data provided by you will be processed, such as name, surname, ID card number, email, telephone, post code, country, address, transactional information related to purchases or bookings (reference number, date, means of payment, proof of payment and booking details), browsing and device data in accordance with the provisions of the Cookie Policy, criteria, mechanisms and logic used to make automated decisions for the creation of your profile when appropriate, as well as any other personal data or information that, where appropriate, may have been generated in the event that the Controllers have to meet legal responsibilities as detailed in this purpose.

Legal basis: compliance with legal obligations applicable to Controllers under European Union law and/or the applicable domestic legal framework. Without your personal data, the Controllers would not be able to properly comply with their legal obligations or meet any legal liabilities arising out of their relationship with you or the processing of your personal data.

Prevention and detection of possible fraudulent activities

Activate the necessary mechanisms in order to prevent and detect the improper use of the website or potential fraud related to the purchase or reservation of products and services that could affect the Controllers themselves or their customers. If possible fraudulent activities related to the payment of products and services are detected, the Controllers may communicate the information on the affected transaction and the identification data of the person who carried it out to the owner of the platform used for the payment and, where appropriate, to the competent public authorities so that the relevant measures may be adopted in each case.

Category of personal data processed: transactional information, payment information and contact details provided during possible fraudulent purchase processes.

Basis of legitimacy: this processing is necessary for the satisfaction of legitimate interests pursued by the Controllers. The Controllers understand that the rights and freedoms of natural persons are not infringed and that there is a balance of legitimate interests insofar as this processing makes it possible to achieve the purpose pursued (to prevent and detect possible fraudulent activities) and is beneficial to customers and users of the website, as it allows the necessary measures to be taken to protect them from unlawful activities such as attempted fraud by third parties, for the Controllers themselves in order to prevent the improper use of the website and its products and services, and for society in general in order to ensure that fraudulent activities are discouraged and detected when they occur.

Use of cookies and similar technology

The Controllers use their own and third party cookies and similar technology (HTTP Cookies, Pixel Tracker and Local Shared) on this website and, as a result, process and store the information and personal data of users as they browse through the website, in accordance with the purposes and configuration parameters that are made available to users at all times.

You can read all the information about the use of cookies and similar technology used on this website and the processing of personal data resulting from it in our Cookie Policy.

Depending on the purpose for which we process your personal data, the applicable retention criteria will be those detailed below:

• Management of the contractual relationship for the purchase or reservation of products and services: for as long as the contractual relationship with you for the purchase or reservation of products and services is maintained.
• Customer service: for as long as it is necessary to manage and deal with your request, complaint, incident or claim.
• Sending surveys: for a maximum of 12 months unless, before this period has elapsed, you request the deletion of your personal data or object to this processing, in which case, they will no longer be processed for this purpose.
• Sending of commercial communications, including personalised communications, of products and services of the Parques Reunidos Group: as long as you do not withdraw the express and informed consent you have previously given, do not request to unsubscribe through the means that will be made available to you for this purpose in each of the commercial communications you may receive, exercise your right to suppression, opposition or your right not to be subject to automated decisions, including profiling, since in these cases, your personal data will no longer be processed for this purpose.
• Market research and analysis: the information processed for this purpose is unlinked and cannot be linked to your other personal information. However, if prior to this disassociation you request the deletion of your data or opposition to the processing, the data will no longer be processed for this purpose.
• Compliance with legal obligations: personal data will be kept blocked for as long as the data controllers can be held legally liable for compliance with their legal obligations.
• Prevention and detection of possible fraudulent activities: until the possible fraudulent actions that could be detected are resolved and then they will remain blocked while legal responsibilities can be demanded from those responsible as a result. 
• Cart management and recovery: for a maximum of 30 days, unless you previously withdraw your express consent or request the cancellation of the sending of abandoned cart reminders, in which case your personal data will no longer be processed for this purpose.
• Dissemination of the content of users who have previously mentioned or tagged the park on social networks: depending on the type of publication, personal data will be retained according to the following criteria: (i) in the case of publications shared in our stories, personal data will be processed for twenty-four (24) hours and subsequently deleted without the possibility of recovery; (ii) in the case of publications shared in our feed, personal data will be processed until the user withdraws their consent to their data being published, without affecting the lawfulness of the processing based on consent prior to its withdrawal.
• Use of cookies and similar technologies: The information will be processed for as long as the consent given by users for the installation of cookies on their device remains in force. If the user does not remove this consent by means of the mechanisms offered in our Cookies Policy, the information will be kept for the duration of the cookies or similar technologies installed on their device.

In any of the above cases, when the personal data ceases to be relevant for the purposes collected or, where appropriate, you withdraw your consent or exercise your right of deletion or opposition to the processing indicated, where appropriate, the Controllers may keep them duly blocked (identification and reservation of personal data, adopting technical and organisational measures to prevent their processing, including their visualisation) in order to, if necessary, make them available to the competent Public Administrations and in particular to the competent Data Protection Supervisory Authority, Judges, Courts or the Public Prosecutor's Office during the period of limitation of the legal actions that may arise from the relationship maintained with you or from the processing of your personal data and/or the legally established retention periods in accordance with European Union Law and/or the internal legal system. Once these periods have elapsed, your personal data will be physically deleted without the possibility of recovery. 

Only if it is necessary to meet possible legal liabilities or to comply with legal retention periods, your personal data may be disclosed to competent Public Authorities and, in particular, to the competent Supervisory Authority for Data Protection, Judges, Courts or the Public Prosecutor's Office in accordance with European Union Law and/or the domestic legal framework.

In addition, the Controllers have suppliers who may also process your personal data to provide services related to the purposes about which you are being informed (including, but not limited to, companies operating in the following sectors: information security, customer relationship management and administration (CRM), technology, legal advice, marketing, customer service, multidisciplinary professional services, IT services, etc.). These providers will only access your personal data in order to carry out their services on behalf of and for the benefit of the Controllers, always following their instructions and under no circumstances will they use such data for their own purposes and/or for unauthorised purposes.

One of these providers is Salesforce, which provides services related to the cloud marketing platform and serves companies all over the world. Therefore, if you provide your personal data through any of the forms on this website, with the exception of the online sales form, and agree that we may send you commercial information or that the information contained in the surveys to which you respond may be processed as additional criteria for creating your profile in order to send you this commercial information, this provider will process your personal data in our name and on our behalf within the European Economic Area (EEA) and in compliance with the applicable European Data Protection Regulations. However, by way of exception, for example in the event of a disaster recovery situation (process to recover data and functionalities in the event of a systems disruption caused by a natural or man-made disaster), it may also provide its services through companies outside the EEA, which may require processing your personal data even in countries that do not offer a level of protection comparable to the level offered by the European data protection law (e.g. in the USA). Nevertheless, equally in the latter case, the Controllers have entered into binding contractual commitments with Salesforce and have ensured that appropriate security measures are in place to ensure that their personal data are at all times processed with an adequate level of protection comparable to that required in the EEA (standard contractual clauses approved by the European Commission on data protection in accordance with the European Data Protection Regulations (GDPR), additional security measures in accordance with the European Court of Justice's decision C-311/18 and subject to certification mechanisms). For further information, please do not hesitate to contact the Data Protection Officer at any of the addresses (postal or email) indicated in the section "What are your rights when you provide us with your personal data?" included in this Privacy Policy. Likewise, please note that, you may withdraw your consent and/or exercise your rights at any time in accordance with the provisions of the section indicated in this Privacy Policy or request to unsubscribe from receiving commercial communications through the means that will be made available for this purpose in each of the commercial communications that you will receive if you give your express consent to do so.

Remember that the purpose of "disseminating the content of users who have previously mentioned or tagged the park on social networks" means that any person with a user account on the social network where the publication is shared can view the personal data referred to therein. Apart from these cases, your personal data will not be communicated to third parties or be the subject of international transfers unless it is necessary for compliance with European Union law or domestic law.

If you expressly consent to the sending of commercial information, discounts and promotions for products and services offered by the European companies belonging to the Parques Reunidos Group relating to the leisure and hotel sector, Bono Parques, events and related activities organised by these companies, including prior profiling and analysis of your preferences through automated decisions so that we can suggest information about products and services that we believe may be of interest to you, you should be aware that these companies are located in the European Union and their main activity is&.nbsp; the management and operation of amusement parks, water parks, zoos, aquariums, leisure centres and the performance of travel agency activities in their different forms, offering hotel packages and tickets to the parks and leisure centres belonging to the Parques Reunidos Group. More precisely, these companies are:

• Spanish Companies belonging to Parques Reunidos Group: Parques Reunidos Servicios Centrales, S.A. (Bono Parques); Parque de Atracciones Madrid, S.A.U. (Parque de Atracciones Madrid); Madrid Theme Park Management, S.L.U. (Parque Warner and Parque Warner Beach); Gestión Parque de Animales Madrid, S.L.U. (Faunia); Zoos Ibericos, S.A. (Zoo Aquarium Madrid); Parques de la Naturaleza Selwo, S.L. (Selwo Aventura y Hotel Selwo Lodge); Aquópolis Cartaya, S.L.U. (Aquópolis Cartaya); Leisure Parks, S.A. (Aquópolis in Villanueva de la Cañada, Aquópolis Costa Dorada - Vilaseca, Costa Dorada-,  Delfinario Costa Dorada – Vilaseca, Costa Dorada, Selwo Marina Aquópolis in Seville, Aquópolis in Cullera, Aquópolis in Torrevieja, Benalmádena Cable Car); Mall Entertainment Centre Acuario Arroyomolinos, S.L.U. (Atlantis Aquarium); Mall Entertainment Centre Murcia, S.L.U. (Nickelodeon Adventure Murcia); Travelpark Viajes, S.L.U. ((products and services related to joint entry packages to parks and leisure centres belonging to the Parques Reunidos Group and hotel accommodation bookings).
• Parques Reunidos Group companies in the rest of Europe: Italy - Parco della Standiana S.R.L (Miraiblandia y Mirabilandia Beach) and Travelparks Italy, S.R.L.( (products and services related to joint entry packages to parks and leisure centres belonging to the Parques Reunidos Group and booking of hotel accommodation); Norway - Tusenfryd A/S (Tusenfryd) and Bø Sommarland AS (Bo Sommarland); Belgium - Bobbejaanland, B.V.B.A (Bobbejaanland); BonBon-Land A/S (BonBon -Land); Germany - Movie Park Germany GmbH y Movie Park Germany Services GmbH (Movie Park), Event Park GmbH (Belantis), Nature Park Germany GmbH (Vogelpark Walsrode), Tropical Island Management (Tropical Island) and TI Hotel Asset GmbH (Tropical Island Hotels); The Netherlands - Attractie- en Vakantiepark Slagharen B.V. (Slagharen y Slagharen Beach); France - Marineland SAS (Marineland, Aquaplash Marineland, Marineland Resort y Kids Island) and LB Investissement (Aqualud); UK - Grant Leisure Group LTD (Blackpool Zoo), Real Live Leisure Company LTD (The Bournemouth Aquarium y Aquarium of the lakes) and Lakeside Mall Entertainment Centre Limited (Nickelodeon Adventure-Lakeside). 

You may exercise your right of access, rectification, refusal, limitation, erasure, restriction, portability and, where appropriate, not to be subject to automated individual decision-making, including profiling, by sending your request in writing to the attention of the Data Protection Officer at the postal address C/Federico Mompou, 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain or to the following email address dpo@grpr.com, in either case, together with a copy of your DNI/NIF or equivalent document by which we can verify that you are the owner of the personal data concerned in your request.

For those processing operations that are based on obtaining your consent, be advised that, you may withdraw your consent or object to the processing of your data at any time by means of the procedure detailed in the previous paragraph.

Without prejudice to the foregoing, we remind you that, if you have expressly consented to receive commercial information, discounts and promotions, including prior profiling and analysis of your preferences through automated decisions so that we can suggest products and services that we believe may be of interest to you, we also offer you the option of unsubscribing to stop receiving this type of commercial communications through the means that will be made available to you for this purpose in each of the commercial communications that you receive.

Similarly, we remind you that you can also ask not to be subject to decisions based exclusively on the automated processing described above for the creation of your profile or ask us for human intervention, express your point of view on the matter, resolve any doubts about the automated decisions or contest them by sending your request to the Data Protection Officer at any of the addresses indicated in this section. 

Minors under fourteen (14) years of age are not authorised to purchase or book any of the products or services offered on this website.

Notwithstanding the foregoing, if as a result of the purchase or booking of any of the products or services offered through this website (for example, birthday celebrations or communions), or the sharing of content on social networks mentioned to the park, you freely and voluntarily decide to provide personal data of a minor under fourteen (14) years of age (for example, to theme the space where the contracted services may be carried out), you are not authorized to purchase or book any of the products or services offered on this website, to theme the space where the contracted services may be carried out), you as the holder of the parental authority or legal guardian of the minor, must give your express and informed consent for the Controllers to process the personal data of the minor within the framework of the contractual relationship maintained with you as a result of the purchase or contracting of such products or services in accordance with the provisions of this Privacy Policy. 

You may file a complaint with the Spanish Data Protection Agency to safeguard your rights where you consider it appropriate to do so. Without prejudice to the foregoing, we recommend that you contact the Data Protection Officer beforehand, using the following email address dpo@grpr.com or by writing to the postal address: C/Federico Mompou, 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain, so that we can help you with your request and resolve any incident related to the processing of your personal data.

Privacy Policy updated in November 2022