Introduction
Oasis Trails Spain (OTES) is a non-profit sharing care in a holistic way with people walking the Camino de Santiago and people walking in a broader sense with questions through life.
With this aim we operate an albergue offering hostel services, food and beverage. With similar purpose we are working on preparing a monastery for communal living with pilgrims and wanderers. OTES is committed to protecting the privacy of all guests who interact with us at any moment during their OTES experience. We treat all the personal data of our guests with great care and we always act in accordance with the applicable national and international data protection legislation including the General Data Protection Regulation (GDPR).
This privacy statement is designed to fully inform you about our privacy practices including the collection of personal data, how we use it and the rights that exist for you to fully be in control of it. We love to interact with our guests so that we can learn and continue to improve the services we offer to the OTES community, which means data is exchanged and used on many occasions including: when you use our mobile applications, visit our websites, make a reservation or visit us or attend our events.
Who we are
This Privacy Statement applies to the processing of personal data by Fundacion Oasis Trails Spain registered with CIF G71357545 with address
Calle Plaza 4, 31242, Villamayor de Monjardin, Navarra, Spain.
Changes
We may change this Privacy Statement to reflect changes at any time. The most recent version of the Privacy Statement is reflected by the version date located in the top left of this document. All updates and amendments are effective immediately upon notice, which we may give by posting a revised version of this Privacy Statement on the Website www.oasistrails.org as well as www.albergueoasistrails.com
What categories of personal data do we collect and why?
The type of data that OTES collects and what we do with it depends on how it was collected and our relations. For example:
Browsing OTES websites
Data collection on this website
The data processing and collections on this website is carried out by the website operator. As this is more complex and less clear to the physical eye you will find this paragraph has many details that may also appear in other parts of this policy.
Cookies
Our website uses so-called “cookies”. Cookies are small text files and will not damage your device. They will either be temporary for the duration of a session (session cookies) or permanent (permanent cookies) stored on your device. Session cookies are automatically deleted after your visit. Permanent cookies remain on your device stored until you delete them yourself or an automatic deletion takes place through your web browser. In some cases, third-party cookies can also be stored on your device if you enter our site (third party cookies). These enable us or you to use certain third-party services (e.g. cookies for processing payment services).
Cookies have different functions. Numerous cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the advertisement of videos). Other cookies are used to evaluate user behavior or to display advertising.
Cookies that are used to carry out the electronic communication process (necessary cookies) or provision of certain functions you require (functional cookies, e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) are required, based on Art. 6 Para. 1 lit. f GDPR saved, unless another legal basis is given. The website operator has a legitimate interest in storage of cookies in order to provide error-free and optimized services. If consent to the storage of cookies has been requested, the relevant data will be saved on the basis of this consent (Art. 6 Para. 1 a GDPR); and consent is revocable at any time.
You can set your browser so that you are informed about the setting of cookies, to allow cookies only in individual cases, to exclude the acceptance of cookies for certain cases, or to activate the automatic deletion of cookies when the browser is closed. By deactivating cookies you may limit the functionality of this website. Insofar as third-party cookies are used for analysis purposes, we will inform you about them and if necessary ask for consent.
Server log files
The provider of the pages automatically collects and stores information in a server log. The files that your browser automatically transmits to us are:
- Browser type and version
- Operating system
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address
This data is not merged with other data sources.This data is recorded on the basis of Art. 6 Para. 1 lit. f GDPR. The website operator has an interest in the technically flawless presentation and optimization of this website and the server log files must be recorded in order to achieve this.
Request by email or phone
If you contact us by email, phone or fax, your request will include personal data (name, request) for the purpose of processing your request, your data will be stored and processed by us. We will not pass on this data without your consent. This data is processed on the basis of Art. 6 Para. 1 lit. b GDPR. The data you send to us via contact requests will remain with us until you request that we delete it or revoke your consent to personal data storage, or the purpose for data storage no longer applies (e.g. after your request has been processed).
Plugins and tools
A) Google Web Fonts
This page uses web fonts by Google for the uniform display of fonts. When you visit a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.
For this purpose, the browser you are using must connect to the servers that Google uses. This gives Google knowledge that this website has your IP address. Google WebFonts are used on the basis of Art. 6 Para. 1 lit. f GDPR.
The website operator has a legitimate interest in the uniform representation of the typeface of this website. If a corresponding consent was requested (e.g. consent to storage of cookies), processing takes place exclusively on the basis of Art. 6 Para. 1 lit. a GDPR; the consent can be revoked at any time. If your browser does not support web fonts, a standard font will be used by your computer. You can find more information about Google Web
Fonts
https://developers.google.com/fonts/faq
and in Google’s privacy policy:
https://policies.google.com/privacy?hl=de.
B) Google Maps
This site uses the Google Maps map service via an API. The provider is Google Ireland Limited
(“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this page has no influence on this data transmission. Google Maps is used in the interest of an attractive presentation of our physical locations and to provide users an easy way to find the places indicated by us on the website. This poses a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 Para. 1 lit. a GDPR; the consent can be revoked at any time.
You can find more information on the handling of user data in Google’s data protection declaration: https://policies.google.com/privacy?hl=de.
C) IP anonymity
We have activated the IP anonymity function on this website.
D) Browser plugin
You can prevent the storage of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookies and relating to your use of the website (including your IP address) and from processing this data by Google by downloading the browser plug-in available under the following link and install: https://tools.google.com/dlpage/gaoptout?hl=de.
Objection against data collection
You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie is set that prevents the collection of your data on future visits to this website: Deactivate Google Analytics.
You can find more information on handling user data at Google Analytics in Google’s data protection declaration: https://support.google.com/analytics/answer/6004245?hl=de.
How we collect your data
Your personal data is collected by you communicating it to us, for example data that you enter in a contact form.
Other data is collected automatically or with your consent when you visit our website through our IT systems detected. This is primarily technical data (e.g. Internet browser, operating system or time of the page view). This data is recorded automatically as soon as you enter this website.
What we use your data for
Some of the data is collected to ensure that the website is operating correctly. Other data can be used to analyze user behavior.
Analysis tools & third party tools
When you visit this website, your surfing behavior can be statistically evaluated. That happens with cookies and with other analysis programs. Detailed information on these analysis programs can be found below.
A) eTracker
web analysis/ range measurement; Service provider: etracker GmbH, Erste Brunnenstraße 1 20459 Hamburg, Germany; Website: https://www.etracker.com ; Privacy Policy: https://www.etracker.com/datenschutz/ ; Order processing contract: https://www.etracker.com/av-vertrag/ .; Opt-out option: https://www.etracker.de/privacy?et= 489405
Hosting & Content Delivery Networks
A) External hosting
This website is hosted by an external service provider (host). The personal data that is recorded on this website is stored on the host’s servers. This can be for example: IP addresses, contact requests, meta and communication data, contract data, contact details, trade names, website access and other data that is generated via a website. The host is under contract with Oasis Trails (Art. 6 Para. 1 b GDPR) in order to provide potential and existing customers with a safe, fast and efficient online experience offered by a professional provider (Art. 6 Para. 1 lit.f GDPR). Our host will only process your data to the extent that this is necessary to fulfill its performance obligations and is required to follow our instructions regarding this data.
B) SSL or TLS encryption
This site uses SSL or TLS encryption for security measures and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser is from “Http: //” changes to “https: //” and the lock symbol in your browser line. If SSL or TLS encryption is activated, the data that you transmit to us cannot be read by third parties.
C) Contract for other/order? processing
In order to ensure data protection-compliant processing, we have a contract for other processing with our host.
Information about the responsible organization
The responsible organization for data processing on this website is:
Foundation Oasis Trails Spain
Calle Plaza 4
Villamayor de Monjardin
31242
Navarra, Spain
Email: info@oasistrails.org
The responsible organization is the legal entity who makes decisions about the purposes and means of processing personal data (e.g. names, email addresses, etc.).
Your rights
We want to make sure that you are fully in control of your personal data. You have multiple rights and we want to ensure they are respected. If you wish to exercise any of the rights listed below, please make your request by sending an e-mail to:
Please state clearly in the subject heading what type of request you are making including as much detail as you can to assist us complete your request as quickly as possible. Please confirm as a minimum:
- Your relationship with us (Volunteer, guest in the Albergue, visitor, attendee)
- Name and e-mail
Revocation of your consent to data processing
Many data processing operations are only possible with your express consent. You can revoke your consent at any time. A notification by email to us is sufficient. The legality of the data processing carried out before the revocation remains unaffected by the revocation.
Right to lodge a complaint with the supervisory body
If you believe your data request is not being handled correctly you are entitled to contact the national data supervisory body. The appropriate authority in Spain is:
La Agencia Española de Proteccíon de Datos, AEPD, with their website www.aepd.es
Right to data sharing
You have the right to receive data that we have based on your consent. It will be processed automatically and will only take place if it is technically feasible.
Right of access to Information, right to deletion & right to correction
You have the right to (free of charge) at any time, within the framework of the legal provisions, information about your stored personal data, its origin and recipients and the purpose of data processing and, if necessary, a right to correct or delete this data. For this as well for further questions on the subject of personal data you can contact us.
Right to restriction of use
You have the right to request that the use of your personal data be restricted. You can contact us at any time at the address given above. The right to restrict use can be limited in the following cases:
If you contest the accuracy of your personal data stored with us, we usually need time to check this. While we check this, you have the right to request restriction of the use of your personal data.
If the use of your personal data happens unlawfully, you can request restriction of data use instead of deletion.
If we no longer need your personal data, but you need it to defend a legal claim, you have the right to request the restriction of the use of your personal data.
If you have lodged an objection in accordance with Art. 21 Para. 1 GDPR, a balance must be weighed between our interests and yours. As long as it is not yet clear whose interests prevail, you have the right to restrict the use of your personal data.
If you have restricted the use of your personal data, this data will still be stored but not used.
Right to objection to advertising emails
We object to advertising and information material that has not been expressly requested. The operators of the pages reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as spam emails.
1,) When you join as a volunteer, staff member, visitor or attendee
When you apply to join as a volunteer, staff member, visitor or attendee, you will provide us with your name, your (e-mail) address, your home address and mobile phone number.
This information will be used for processing the application and to allow us to communicate with you, including communication to obtain feedback. The data collected may be kept for as long as we believe you may return to OTES or until you communicate your right to be deleted.
We will also use this information to send general OTES e-mails. You can unsubscribe from marketing e-mails at any time by clicking the unsubscribe link contained in the e-mail.
2,)When you join as a board member
When you join as board member, you will provide us with your name, your (e-mail) address, your home address and a copy of your valid passport.
This information will be used to communicate with you, and for sending for informing applicable governing bodies who register board members of a foundation in Spain such as but not limited to the immigration department and a notary.
3,)When you make a reservation to stay or enquire about services or products provided by OTES.
When you make a reservation to stay at the Albergue or enquire about services or products provided by OTES either in written form hardcopy or by email, you will provide us with your name, e-mail address, reservation details and possibly other details such as – but not limited to – dietary preferences / allergies.
This information will be used for processing the reservation and to communicate with you about the reservation.
4,)When you register upon arrival as a guest (´pilgrim´) in our Albergue
When you register as a guest in our Albergue, you are required to provide OTES with some form of ID such as a passport or identity card. We are obligated to scan your ID by the Guardia Civil and are obligated to communicate these data each day with the Guardia Civil. Your data will not be used for any other purpose and will be destroyed from our devices after sending them through to the Guardia Civil at the latest within 48 hrs after your arrival.
5,)When providing services or goods to OTES.
Your personal details or business details may be requested as you provide services or good to OTES. These details may include – but are not limited to – your name, your role within the business, a form of ID and the business name and contact information of the business or yourself.
This information will be used for processing the transaction and to communicate with the context of a business relationship.
Legal grounds for the processing activities identified
Based on the contractual agreement
A) To manage your booking to this effect and to process your registration as a OTES guest, volunteer or visitor, attendee and for the subsequent relationship with you.
B) Managing, maintaining and effectively controlling the relationship resulting from having been a guest, volunteer visitor or attendee.
C) To manage guests stay at OTES, in addition to providing the services requested during their visit, which includes, among other aspects, preparation of the visit and dealing with any requests made during their stay. For this purpose, we may request data, such as, hotel room requests and to prepare the appropriate food menus. This also includes charging for services consumed during their stay.
Based on legal obligations
We may notify the public authorities or regulatory or government bodies in those cases where it is necessary to do so under law, local by-laws or in compliance with regulatory requirements.
A) Legally obligated by law to collect and process personal data (e.g. maintain a hostel guest night register)
B) Legally obligated to keep a record of volunteers for insurance purposes
C) Legally obligated to share data of pilgrims staying with us with the Guardia Civil
Based on OTES legitimate interests
A) Carry out commercial actions and/or advertising communications through any medium including electronic or equivalent communications relating to goods or services like those contracted with OTES.
B) Create profiles based on the personal data available to OTES to ascertain the goods and services most appropriate to your profile, thus maximizing their results and in this way offering you the best of any goods and services of interest to you.
C) To carry out customer satisfaction surveys with the goods and/or services you have contracted to assess your satisfaction so that OTES can improve its processes and services.
D) To manage, process and respond to any possible complaints or claims. To record your voice and/or image and save the telephone conversation and/or video having expressly informed you of this fact. It is in the OTES legitimate interests to maintain the quality of its service and to use the recordings, should it be necessary to protect its legal position in the event of any possible conflict.
E) To send relevant information about the event you have attended.
Based on your explicit consent
Should you so authorize on the cookies banner, OTES may monitor cookies and use that information to advertise products/services that may be of interest to you.
Who has access to your personal data?
We handle your personal data discreetly and will process the personal data only for strictly our own purposes. We will only transfer your personal data to third parties if it is necessary for us to fulfill our contractual obligations towards you, when it is necessary to perform functions you have granted consent for us to do or any other identified legal ground under data protection law. The third parties we work with are bound by the same conditions toward you and your personal data as written in this privacy statement.
Your rights
We want to make sure that you are fully in control of your personal data. You have multiple rights and we want to ensure they are respected. If you wish to exercise any of the rights listed below, please make your request by sending an e-mail to:
Please state clearly in the subject heading what type of request you are making including as much detail as you can to assist us complete your request as quickly as possible. Please confirm as a minimum:
- Your relationship with us (Volunteer, guest in the Albergue, visitor, attendee)
- Name and e-mail
We will complete your request within 2 weeks.
Right of access
If you want to know what personal data we have collected and/or processed from you, you can request OTES to give you an overview.
Rectification
If you believe that the personal data that we process is incorrect, inaccurate or incomplete, you may ask us to change or remove such personal data.
Erasure (‘Right to be forgotten’)
If you want us to remove the personal data we have collected and/or processed from you, you can request OTES to erase your personal data.
Object
You have always the right to object against the processing of your personal data by OTES. If it concerns a processing activity that requires consent you are always entitled to remove your consent.
Limitations of your rights
When a data subject request is made OTES will as a standard policy provide this service free of charge, however in exceptional cases OTES reserves the right to charge a reasonable fee. Data subject requests will only be implemented after the individual making the request has proved their identity, which confirms that they are indeed the subject that the request concerns.
In certain situations OTES may be entitled to legally refuse requests. If OTES believe there are legitimate grounds that override the interest of the data subjects request, then OTES may reasonably refuse to fulfill the request. OTES will always justify in writing why that is the case.
Right to contact the supervisory body
If you believe your data request is not being handled correctly you are entitled to contact the national data supervisory body. The appropriate authority in Spain is:
La Agencia Española de Proteccíon de Datos, AEPD, with their website www.aepd.es
How do we protect your personal data?
OTES takes the security of personal data seriously and has implemented the following security measures:
Physical Access Controls
OTES have taken reasonable measures to prevent physical access, such as securely storing any hardcopy materials relating to your personal data to prevent unauthorized persons from gaining access to personal data or have ensured third party partners operating data centers on our behalf are adhering to such controls.
System Access Controls
OTES have taken reasonable measures to prevent personal data from being used without authorization. The controls are password locked email inbox and cloud storage.
Data Access Controls
OTES take reasonable measures to provide that personal data is accessible and manageable only by properly authorized staff; application access rights are established and enforced to ensure that persons entitled to use a system only have access to the personal data to which they have privilege of access.
Data Backup
Back-ups of the databases are taken on a regular basis, are secured, and encrypted to ensure that personal data is protected against accidental destruction, loss or unauthorized disclosure.
Transfer of personal data to other countries
For many of our business purposes we use cloud-based services. Therefore, for technical and organizational reasons, it may be necessary that your personal data is transferred to servers located in other countries outside of the European Economic Area.
Links to other websites
The websites may contain links to other websites we do not control. Therefore, we will not be responsible for the content of these websites, nor for the processing of personal data that may occur on these websites.
Questions
If you have any questions about this Privacy Policy, please email: