Privacy Policy

1. Data Controller Identification

This privacy notice applies to all data processing activities conducted through the web domain vauberrypopptly.casa. The responsible data controller is:

• Entity Name: Vauberrypopptly Travel Media S.L.
• Company Identification Number (CIF): B-87941209
• Registered Address: Paseo de la Castellana 142, 4ª Planta, 28046 Madrid, Spain
• Data Protection Officer (DPO) Contact: [email protected]

2. Principles of Data Processing

In adherence to Article 5 of the General Data Protection Regulation (GDPR), we guarantee that all personal information is processed lawfully, fairly, and in a transparent manner. Data collected is limited to what is strictly necessary for our editorial publications and reader correspondence, stored securely, and retained no longer than required.

3. Categories of Information Collected

We collect and process personal data in two primary circumstances:

• Direct Inquiries via Contact Forms: When you communicate with our editorial desk, we collect your full name, email address, chosen inquiry category, and the substance of your message. The legal basis is Article 6(1)(b) of the GDPR (processing necessary for responding to user requests).
• Technical and Analytical Telemetry: When navigating our site, technical server logs record truncated and anonymized IP addresses, browser agent strings, referring URLs, operating system metadata, and timestamp stamps. The legal basis is Article 6(1)(f) (legitimate interest in preserving network security and site stability).

4. Use of Cookies and Tracking Technologies

Our website utilizes strictly essential cookies required for basic navigation, security tokens, and consent preference storage. Non-essential analytical metrics are only activated where prior explicit consent has been granted through our Cookie Banner. Detailed descriptions of each cookie category are provided in our dedicated Cookie Policy.

5. Third-Party Data Processors & International Transfers

We do not sell, rent, or commercialize reader information. Selected technical subcontractors may access data strictly acting under Data Processing Agreements (DPAs) that comply with Article 28 of the GDPR:

• European cloud hosting infrastructure providers maintaining ISO/IEC 27001 certification.
• Transactional email dispatch services operating under standard contractual clauses (SCCs) approved by the European Commission.

6. Data Retention Schedules

Reader contact inquiries submitted through our web forms are retained for a maximum duration of 24 months following the date of final resolution, after which communications are permanently excised from our production databases. Anonymized web server access logs are purged on a rolling 90-day cycle.

7. Rights of Data Subjects (GDPR & CCPA)

Under Chapter III of the GDPR and applicable international frameworks such as the California Consumer Privacy Act (CCPA), you possess enforceable legal rights regarding your personal information:

• Right of Access (Art. 15 GDPR): Request a copy of the personal data held concerning you.
• Right to Rectification (Art. 16 GDPR): Demand the correction of inaccurate or incomplete data.
• Right to Erasure / 'To Be Forgotten' (Art. 17 GDPR): Request deletion of your personal records where legal retention grounds have lapsed.
• Right to Restriction of Processing (Art. 18 GDPR): Limit how your information is utilized during active disputes.
• Right to Data Portability (Art. 20 GDPR): Receive your submitted data in a structured, machine-readable format.
• Right to Object (Art. 21 GDPR): Oppose processing based on legitimate interests at any time.

To exercise any of these statutory rights, submit a written request to [email protected]. You additionally hold the statutory right to file a formal complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.

8. Security Measures

We implement state-of-the-art technical and organizational safeguards, including Transport Layer Security (TLS 1.3) encryption for all HTTP transmissions, automated vulnerability patching, strict role-based access control, and encrypted off-site backup protocols.