Hotel Vibra District

Privacy Notice under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

Dear User,

Below you will find information regarding the processing of personal data collected automatically or provided by you when using our call center or browsing/using the website https://to-travel.agency (hereinafter "Website").

Data Controller

The Data Controller is Agencia To-travel SLU, represented by its legal representative, with registered office at Passeig de Gracia 95, 08008 Barcelona, Spain (hereinafter "Company" or "Data Controller").

Types of Processed Data

To enable you to use the Website and its services, including creating an account, making bookings, and requesting quotes (collectively referred to as the "Services"), the Data Controller needs to process certain personal data.

Data Voluntarily Provided by the User

To create an account, you must provide personal data (name and surname), contact details (email and phone number), and country of residence.

To make bookings, the Data Controller will process your personal data (name, surname, tax identification number), email, phone number, and residential address, along with any other data necessary for invoicing.

To retrieve a booking, you must provide the booking confirmation number and the email used.

Optional, explicit, and voluntary sending of emails results in the collection of your personal data, email address, and any other information provided in your messages or submitted forms. When contacting customer service, you must provide your name, surname, booking number (if applicable), and any additional information necessary to fulfill your requests.

Browsing Data

Information systems and software of the Website automatically collect certain personal data, such as:

• IP addresses
• Domain names of connected computers
• URI addresses
• Connection times
• Methods used to submit requests
• Size of received files
• Numeric status codes of server responses
• Additional details related to the user’s operating system and technical environment

These data are processed for anonymous statistical purposes to ensure proper service operation and are retained for 7 days, after which they are deleted unless legally required otherwise.

Cookie Policy

The Website uses the following types of cookies:

• Technical Cookies: necessary for the website’s operation.
• Analytical Cookies (own and third-party): used for anonymous statistical analysis.
• Profiling Cookies (own and third-party): used to personalize your experience and displayed advertisements.
• Deleting these cookies does not prevent general website use but may limit certain functionalities.

For more information or to disable specific cookies, please contact us.

Cookie Settings via Browser

You can disable all cookies through your browser settings. However, this may render the website unusable if essential cookies are blocked. Please refer to specific instructions for Apple Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox, and Opera browsers.

Purposes, Legal Basis, and Nature of Data Provision

A. Using Website Content and Services, Network, and Information Security: Required to execute contracts, fulfill legal obligations, and legitimate interests of the Controller. Data provision is mandatory, except for sensitive data (optional but necessary for certain requests).

B. Receiving Direct Marketing Communications (newsletters, promotions): Requires explicit consent. Optional, but refusal may limit offered benefits.

C. Receiving Customized Offers based on Profiling: Requires explicit consent. Optional, but refusal may prevent personalized communications.

Data Retention Period

• Browsing data: 7 days.
• Booking data: 10 years.
• Direct marketing data: anonymized after 24 months.
• Profiling data: anonymized after 12 months.
• Other data: minimum retention period according to GDPR, reviewed annually unless legally or judicially obligated otherwise.

Recipients of Personal Data

Data will not be publicly disseminated but may be shared with:

Legal authorities.

Service providers (transportation, accommodation, payments, advertising, marketing, IT, etc.).

Internal personnel authorized under GDPR Article 29.

Data Transfer Outside the EU

Certain data may be transferred outside the EU (especially to the USA for payments), protected by standard contractual clauses approved by the EU. To request a copy of these clauses: dpo@to-travel.agency.

Automated Decisions and Profiling

With your explicit consent, your data will undergo automated profiling processes to personalize your experience and send offers aligned with your browsing habits and preferences.

User Rights

You may withdraw consent at any time, request access to your data, rectification, deletion, limitation, portability, or object to processing. You can also lodge a complaint with a supervisory authority.

To exercise your rights, please contact the Data Controller at Passeig de Gracia 95, 08008 Barcelona, Spain, or via email at dpo@to-travel.agency.