1. Data controller

Controller: GONZALO ARCEO BECERRIL
Tax ID: 44141162E
Address: Giuseppe Verdi Plaza 6, 03 A, 20014 Donostia-San Sebastián, Gipuzkoa, Spain
Contact email: gontxu@besansebastian.com
Phone: +34 652 74 65 76

2. Purpose of processing

The personal data provided through this website may be processed for the following purposes:

• To respond to enquiries, information requests or messages sent through contact forms or email.
• To manage booking requests, service requests or participation in tours, activities or experiences.
• To maintain communications related to requested services.
• To comply with legal obligations applicable to the controller.
• [To be completed] To send newsletters or marketing communications, only where the user has previously consented.

3. Legal basis

The legal basis for processing may be, depending on the case:

• The user’s consent.
• The application of pre-contractual measures or the performance of a contract.
• Compliance with legal obligations.
• [To be completed] Legitimate interest, where applicable and properly identified.

4. Categories of data

The website may process identification and contact data provided by the user, such as name, email address, phone number and any other information voluntarily included in the message or request.

[To be completed] If additional data is requested during booking, it should be detailed here.

5. Data retention

Data will be kept for as long as necessary to fulfil the purpose for which it was collected and, afterwards, for the legally required periods in order to respond to possible liabilities.

6. Recipients

As a general rule, personal data will not be disclosed to third parties unless required by law.

However, service providers acting on behalf of the controller may have access to data as data processors, such as web hosting, email, form, analytics, booking management or technical support providers, where applicable.

[To be completed] Relevant providers or at least the real categories used on the website should be identified if applicable: hosting, email, booking engine, payment gateway, Google Analytics, Google Maps, reCAPTCHA, etc.

7. International transfers

[To be completed] If services from providers located outside the European Economic Area are used, or if international data transfers take place, users must be informed accordingly, including the safeguards applied.

8. User rights

Users may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw consent where processing is based on consent, by sending a request to gontxu@besansebastian.com and clearly stating the right they wish to exercise. These rights are recognised by the GDPR and Spanish data protection law.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they believe their rights have not been properly respected.

9. Source of the data

Personal data comes directly from the data subject when they contact Be San Sebastian through the means available on this website.

10. Security measures

The controller applies reasonable technical and organisational measures to protect personal data and prevent loss, alteration, unauthorised access or improper processing, in accordance with applicable law.

11. Changes to this policy

This Privacy Policy may be updated whenever necessary to reflect legal or technical changes. Users are encouraged to review it periodically.