PRIVACY POLICY

In compliance with the principle of transparency and the duty to provide information established by the applicable EU and national data protection regulations, BALEÀRIA CANARIAS SHIPPING, S.A. (hereinafter BALEÀRIA) hereby informs data subjects about the circumstances and conditions governing the processing of their data, as well as the rights available to them.

The Privacy Policy forms part of the General Terms and Conditions governing this website.

Who is the controller of your data?
BALEÀRIA CANARIAS SHIPPING, S.A.
A24997074.
Vía Estación Marítima, Moll de la Pança s/n – 03700 Denia (Alicante).
Telephone: _______________________
Email: [email protected]

BALEÀRIA reserves the right to amend or adapt this Privacy Policy at any time. We therefore recommend that you review it regularly to stay up to date.

If you belong to any of the following groups, please refer to the expandable information:

CUSTOMERS
What personal data do we process?
•    We will process our customers’ personal data in order to manage the contractual relationship we have with them. In this regard, we will process your identification data, ID card or passport number, sex, contact details (telephone number and email address) and financial data (for example, payment card number and expiry date) in order to manage the contractual relationship we have with you.
•    If you have a registered profile with BALEÀRIA, we will process your membership number.
•    When you request any type of special assistance, such as a specific diet or wheelchair service, you must provide confidential information relating to your health status.
•    For all other purposes described below, BALEÀRIA may process data relating to commercial interests, consumption data, booking history, habits and preferences, user behaviour data on BALEÀRIA’s website, IP address, customer device information (mobile phone, computer or tablet), as well as any data voluntarily provided by the customer to BALEÀRIA.
•    Any other information that BALEÀRIA requests from you and that you are free not to provide.

For what purposes will we process your personal data?
•    To provide the contracted services, as well as to manage and maintain the commercial relationship with our customers. This includes keeping you informed about your trips by sending reminders via SMS, WhatsApp and email, and sending notifications about any type of change, such as cancellations or boarding delays.
•    To manage ticket bookings or other services.
•    To provide customer service by telephone, email, post, social media or virtual assistant, in order to handle your requests and provide you with assistance.
•    To manage the registration of your BALEÀRIA customer/user profile and account. In this regard, you will be provided with a personalised user account on our website or mobile applications, which you may access from your computer or other devices. You may manage your personal account at any time by logging in with your email address and password.
•    Account personalisation: so that your experience with BALEÀRIA is adapted to your preferences and personal needs, we use data on how you use our digital services (website, email, applications, etc.) and combine it with other data we hold about you in order to identify the information you would like to receive, how you prefer us to communicate with you, which channels you prefer us to use, how often you want us to contact you, etc.
When you start a new booking, we may, based on your previous bookings, pre-fill part of the information in the current booking form. This information is obtained from previous booking processes. This includes, for example, the departure port you searched for or travelled from, your name and your contact details. The purpose of this processing is to simplify your booking process in order to save you time and effort.
If you wish, you may cancel the personalisation option by deactivating the “Automatic data use” option on your account page. This will stop our profiling/personalisation processes involving your data and will delete the data that is only necessary for this type of processing.
•    To detect irregular activities in the customer/user account and take the necessary measures.
•    To invoice the contracted services and carry out the corresponding transactions.
•    To carry out control and debt collection procedures.
•    To monitor the quality of the service provided by BALEÀRIA to the customer. For this purpose, BALEÀRIA informs you that it may record conversations held with its customers.
•    To provide commercial information by electronic means (for example, email, SMS or WhatsApp), as well as to carry out marketing actions and campaigns through those means.
•    To send newsletters about BALEÀRIA products and services.
•    To carry out/send satisfaction surveys in relation to the services provided.
•    To improve the services provided by BALEÀRIA in order to offer a better user experience the next time you use our services. For this purpose, BALEÀRIA may prepare reports and statistics obtained from the analysis of the data provided by the customer.
•    To send an email to the data subject reminding them that they have not completed their booking (pending booking), providing easy access to the incomplete booking process.
•    In order to improve our communications with you, we also carry out market research, which may be conducted using your personal data to connect several datasets. Personal data in analytical datasets is always deleted after the analysis.
If you wish, you may delete the personal data used for marketing purposes by deleting your profile on the account page. As regards anonymous user cookies, these cannot be associated with a specific person, but you may delete them yourself or they will be deleted according to BALEÀRIA’s established practice.
•    To provide Wi-Fi access on board our vessels, as well as entertainment options (for example, films) through our Wi-Fi service.

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties or the application, at the request of the data subject, of pre-contractual measures.
•    Compliance with a legal obligation applicable to the data controller.
•    Consent granted by the data subject or by their legal representative.
•    The legitimate interest of the data controller.

How long will we retain personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from it.
Personal data processed on the basis of the data subject’s consent will be retained until such consent is withdrawn. Once withdrawn, the data will be erased, without prejudice to its retention, duly blocked, for the legally required periods to address any potential liabilities.

BALEÀRIA CLUB
What personal data do we process?
•    Data collected directly: personal data provided by the data subject through the website, by completing registration forms, contact forms, satisfaction surveys, complaints and/or suggestions, etc. By way of example, the data collected includes: first name, surname(s), sex (male/female/not specified), date of birth, DNI/NIE/PASS, telephone number, postal address, email address and password, and information about your tastes and preferences.
•    Data collected indirectly through the use of cookies to keep registered users logged in, provide statistics associated with website use, locate our offices and operate anti-spam systems (captcha), as well as for interaction with the social networks in which we participate.

For what purposes will we process your personal data?
•    Registration and management of the user in BALEÀRIA CLUB.
•    To inform BALEÀRIA CLUB users of benefits and/or discounts that best suit their travel preferences and/or mobility needs.
•    To inform you of the points accumulated as a result of trips made with us.
•    To manage the redemption of your points and any claims arising from it.
•    To carry out satisfaction surveys on the services offered by BALEÀRIA CLUB in order to properly manage and improve the quality of the services offered.
•    To process claims, complaints and/or suggestions relating to points redemption or your status as a BALEÀRIA CLUB user.
•    To respond to any requests for information from users.
•    To manage calls from users who contact BALEÀRIA in order, where appropriate, to resolve incidents or handle requests for information as necessary.
•    To analyse and study the user, based on the information available, in order to personalise the service according to their characteristics or needs and, where appropriate, to send commercial information tailored to their preferences, without carrying out fully automated actions or decision-making.
•    To keep registered users logged in, provide statistics associated with website use, locate our offices and operate anti-spam systems (captcha).

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties.
•    Compliance with a legal obligation applicable to the data controller.
•    Consent granted by the data subject or by their legal representative.
•    The legitimate interest of the data controller.

How long will we retain personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from it.
Personal data processed on the basis of the data subject’s consent will be retained until such consent is withdrawn. Once withdrawn, the data will be erased, without prejudice to its retention, duly blocked, for the legally required periods to address any potential liabilities.

CONTACTS THROUGH THE WEBSITE https://www.baleariacanarias.com/es/
What data do we collect through the website?
If you provide us with information through a contact form, we will process your identification data, contact details and any other data that you voluntarily share with us through that form.
In addition, we may process your IP address, the type of operating system or browser used, as well as the duration of your visit, in a pseudonymised manner.

For what purposes will we process your personal data?
•    To manage the requested service, respond to your request or process your enquiry.
•    To provide information through electronic means and virtual assistants concerning your requests.
•    To provide commercial or event-related information through electronic means.
•    To analyse and improve BALEÀRIA’s website in relation to the products or services offered, as well as to improve the commercial strategy.

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties or the application, at the request of the data subject, of pre-contractual measures.
•    Consent granted by the data subject or by their legal representative.

How long will we retain personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from it.
Personal data processed on the basis of the data subject’s consent will be retained until such consent is withdrawn. Once withdrawn, the data will be erased, without prejudice to its retention, duly blocked, for the legally required periods to address any potential liabilities.

VIDEO SURVEILLANCE
What personal data do we process?
We will process your image and, where applicable, your vehicle registration number.

For what purposes will we process your personal data?
To ensure the security of property, facilities and people.

What is the legal basis for processing your data?
The legal basis that legitimises the processing is the performance of a task carried out in the public interest.

How long will we retain personal data?
For a period of 1 month from the date of capture, except in the event of incidents, in which case the data may be kept for a longer period until the incident has been resolved or until the recordings are disclosed to the State Security Forces and Corps or competent authorities.

ETHICS CHANNEL
What data will we process?
We may process the following data:
•    Identification data such as first name, surname(s) and ID number.
•    Contact details such as email address or telephone number.
•    Professional data such as position within the organisation or group company.
•    Trade union data, such as membership of a works council or trade union organisation.
•    Health data such as injuries.
•    Any other personal data, relating to the reporting person or third parties, that is provided voluntarily.

For what purposes will we process your personal data?
•    To manage/process the communications or information received.
•    To send the reporting person the relevant communications on the processing status or the results thereof, unless they have objected to this.
•    To carry out all actions aimed at verifying the credibility of the reported facts in order to determine whether to close the case, adopt the appropriate measures or refer it to the competent authority in each case.

What is the legal basis for processing your data?
The legal basis that legitimises the processing is compliance with a legal obligation applicable to the data controller.

How long will we retain personal data?
The following will be deleted immediately:
•    Any personal data that may have been disclosed and that refers to conduct not included within the scope of application of the law. If the information received contains personal data included within special categories of data, it will be deleted immediately and will not be recorded or processed.
•    Information provided, or part of it, where it is proven not to be truthful, from the moment this circumstance becomes known, unless such lack of truthfulness could constitute a criminal offence, in which case the information will be kept for as long as necessary while the judicial proceedings are processed.

The data being processed will be retained in the information system only for the time strictly necessary to decide whether to initiate an investigation into the reported facts. This period may not exceed three months from receipt of the information, unless the special complexity of the matter requires the period to be extended by a further three months.

BALEÀRIA also informs you that it keeps a record of information available to the competent judicial authorities in accordance with the requirements and limits established in Law 2/2023 of 20 February regulating the protection of persons who report regulatory infringements and the fight against corruption.

SUPPLIERS
What personal data do we process?
We will process the identification and contact details of our suppliers’ representatives, as well as financial, banking and payment method data, in order to manage the contractual relationship we have with the legal entities they represent.

For what purposes will we process your personal data?
•    Preparation/approval of the budget and follow-up through communications between both parties.
•    Follow-up of the contracted services and management of the commercial relationship.
•    Invoicing and declaration of the relevant taxes.
•    To provide commercial or event-related information by electronic means, provided that there is express authorisation or this falls within our legitimate interest.
•    To carry out the corresponding transactions, as well as control and debt collection procedures.

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties or the application of pre-contractual measures.
•    Compliance with legal obligations applicable to BALEÀRIA.
•    Consent granted by a legal representative of the supplier.
•    BALEÀRIA’s legitimate interest.

How long will we retain personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the limitation periods arising from it.

JOB APPLICANTS
What personal data do we process?
We will process the data you share with us in the context of the selection process or spontaneous application. In general, we will process your identification data, contact details, curriculum vitae and data relating to your professional and/or academic experience.

For what purposes will we process your personal data?
•    Management of candidates’ registration and participation in selection processes.
•    Assessment of professional profiles and communications related to those processes, through electronic means (email, WhatsApp), telephone or equivalent means.
•    To invite you to job interviews and assess your application.
•    Where applicable, inclusion of the candidate’s profile in the Talent Community for consideration in future processes, when express consent has been given.

What is the legal basis for processing your data?
•    The application of pre-contractual measures at the request of the data subject.
•    Compliance with legal obligations applicable to the data controller.
•    Consent of the data subject for inclusion of the candidate’s profile in the Talent Community for consideration in future processes.
•    The legitimate interest of the data controller.

How long will we retain personal data?
Personal data will be retained until the end of the selection process and, if we have authorisation, for a maximum period of twenty-four (24) months, with the data remaining duly blocked for the legally established limitation periods once the indicated periods have elapsed.

SOCIAL MEDIA
What personal data do we process?
We will use the data available on your user profile, as well as the data you provide when contacting us through our social media profiles.

For what purposes will we process your personal data?
•    To process, handle and respond to your queries, requests or enquiries.
•    To manage the requested service.
•    To publish your image on our profiles, subject to your prior consent.
•    To interact with you and create a community of followers.

What is the legal basis for processing your data?
The bases that legitimise the processing are the voluntary consent of the data subject and, where applicable, acceptance of a contractual relationship within the relevant social network environment. The processing of data within the social network will be carried out in accordance with its privacy policies.

As indicated in the terms and conditions available on BALEÀRIA’s website, by publishing content accompanied by the hashtag #OkBaleària, the user/customer authorises BALEÀRIA to reproduce, publicly communicate and use that content, including any image and/or voice it may contain, for promotional, advertising and corporate purposes relating to the brand and its services, on websites, social media and other communication channels belonging to BALEÀRIA or to third-party collaborators of BALEÀRIA. The user/customer may request the removal of any content at any time by sending an email to [email protected] or [email protected].

How long will we retain personal data?
We can only consult or delete your data in a restricted manner because we have a specific profile. We will process it for as long as you allow us to do so by following us, being friends with us or clicking “like”, “follow” or similar buttons.
Any rectification of your data or restriction of information or posts must be carried out through the settings of your profile or user account on the social network itself.

ADDITIONAL INFORMATION ABOUT THE PROCESSING OF YOUR DATA:

Do we include personal data of third parties?
No. As a general rule, we only process the data provided to us by the data subjects. If you provide us with data relating to third parties, you must first inform those persons and obtain their consent, otherwise you release us from any liability for failure to comply with this requirement.

What security measures do we apply?
In view of BALEÀRIA’s concern to ensure the security and confidentiality of the personal data being processed, the required security levels for the protection of personal data have been adopted and the technical means available have been installed to prevent the loss, misuse, alteration, unauthorised access and theft of personal data provided through the website. In any event, you should bear in mind that security measures on the Internet are not impregnable.

To which recipients will your data be disclosed?
BALEÀRIA does not sell the personal data it processes to third parties.

Your data may therefore be disclosed to the competent authorities or public bodies when required by law, regulation, legal process or an applicable government request, as well as to banks and financial institutions for the collection of the service provided or product purchased.

When the customer makes payment in dirhams, the data necessary to manage and process that payment will be disclosed to the intermediary in Morocco, EUROMAROC DETROIT SARL; and when the customer makes payment in dinars, the data necessary to manage and process that payment will be disclosed to the intermediary in Algeria, MARDMEDSA BEMARINE SPA. These disclosures are based on the performance of the contract and are necessary for the correct processing of the payment. BALEÀRIA has applied appropriate technical and organisational measures to ensure that these data disclosures comply strictly with the applicable law.

If part of the booking made by the customer involves a service provided by a third party, BALEÀRIA may share your personal data with that third party.

BALEÀRIA may also share the data collected with its business partners or with various companies belonging to GESTIÓN NAVIERA SL, with tax ID number B57030751, BALEÀRIA being one of the companies forming part of the corporate group belonging to GESTIÓN NAVIERA, S.L. This sharing will be carried out for various purposes, such as the proper provision and improvement of the service, ticket marketing, as well as system administration, statistics, research and analysis. For example, on the BALEÀRIA EUROLÍNAS MARÍTIMAS, S.A. website (balearia.com/es), tickets issued by BALEÀRIA CANARIAS SHIPPING, S.A. and operated by Grupo ARMAS TRASMEDITERRÁNEA (Compañía Trasmediterránea S.A. and Naviera Armas S.A.) are marketed/sold, with the aforementioned companies being included in the corporate group belonging to GESTIÓN NAVIERA, S.L.

In order to fulfil the purposes indicated in this Privacy Policy, we will collaborate with service providers who may have access to your personal data. BALEÀRIA has entered into the corresponding data processing agreement with these providers, in accordance with the provisions of Article 28 GDPR. BALEÀRIA informs you that, if access to data by such providers involves an international transfer of personal data outside the European Economic Area, BALEÀRIA applies appropriate mechanisms and safeguards provided for by the applicable regulations (e.g. European Commission adequacy decisions, Binding Corporate Rules and/or Standard Contractual Clauses, among others) to ensure that such providers apply a level of security equivalent to that required by European data protection regulations.

What rights do you have?
•    The right to access your personal data.
•    The right to request rectification of your data if it is inaccurate.
•    The right to request erasure of your data when the data is no longer necessary for the purposes for which it was collected, once the legal retention periods have been met, or when you withdraw the consent granted for specific processing activities.
•    The right to withdraw the consent granted.
•    Under the conditions provided for in the General Data Protection Regulation, data subjects may request restriction of the processing of their data or its portability.
•    In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data.
•    The right not to be subject to automated decisions (including profiling).
•    The right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with applicable law. Before submitting such a complaint, or to communicate any question or issue regarding the processing of personal data, you may contact the data controller at the postal and electronic addresses indicated.

If any of your data changes, please inform us so that we can keep it up to date.

To exercise the rights indicated, you must send a request to the email address [email protected] or to the postal address Vía Estación Marítima, Moll de la Pança s/n – 03700 Denia (Alicante), providing adequate proof of identity. In the event of reasonable doubts regarding the applicant’s identity, BALEÀRIA may request additional information.

BALEÀRIA guarantees accessible and free channels for the exercise of these rights.

How long do we take to respond to the exercise of rights?
One month from receipt, extendable by two additional months whenever the exercise of the right so requires due to its complexity, with notification provided to you in due time and form.

Data Protection Officer (DPO)
BALEÀRIA has appointed a Data Protection Officer to supervise regulatory compliance and handle privacy-related queries. You may contact the DPO at [email protected]. The DPO acts as a reference point for resolving queries, managing requests and coordinating privacy-related actions and regulatory compliance. Their role is to ensure that all processing operations comply with applicable regulations and the guidelines of the Spanish Data Protection Agency (AEPD).

Do we carry out international data transfers?
BALEÀRIA may carry out international transfers of personal data to countries located outside the European Economic Area. Such transfers will only be carried out where there is a legal basis in accordance with Regulation (EU) 2016/679 (GDPR) and, in particular, where the appropriate safeguards provided for in that regulation are in place, ensuring at all times a level of protection equivalent to that in Europe.

To this end, BALEÀRIA will ensure that such transfers are covered by one of the mechanisms recognised by the applicable regulations, such as adequacy decisions adopted by the European Commission, the signing of Standard Contractual Clauses approved by the European Commission or the existence of Binding Corporate Rules, among other valid instruments.

Do we process cookies?
Yes, we use cookies other than strictly necessary cookies. You may consult the Cookie Policy via the corresponding link available on our website.

When you visit our website or use our mobile applications, we collect certain information through automated means using cookies. Cookies are small text files that are stored on your device when you visit a website. When you visit a website for the first time, a cookie file is sent to your device and identifies your browser.

By using cookies, you help BALEÀRIA improve the functionality of its website. Cookies are therefore important for reducing download time and improving the user experience. Cookies collect information about how visitors use our websites and therefore provide us with useful information on how to deliver a better customer experience and improve our services.

We also use cookies for authentication processes, so that you do not have to provide your credentials every time you visit our website. These cookies are strictly necessary for the proper operation of the service. If you configure your browser’s technical settings, you can prevent cookies from being stored on and accessed from your device. However, please note that if you disable cookies, you may not be able to use the services on our website or mobile applications.

Finally, we use cookies for marketing purposes. Some BALEÀRIA business partners, acting as intermediaries between us and advertisers, place cookies on our website. We use these cookies to provide more relevant information and personalised advertising offers, measure the effectiveness of our advertising campaigns and limit how often each advert is displayed.

If the settings of your mobile device and the permissions granted to our mobile applications allow it, we may access geolocation information provided by that device. This Privacy Policy governs how we use this information when it is associated with your personal data. You may manage location access permissions at any time from the privacy and security settings of your mobile device. You may also consult the instructions of your device manufacturer or operating system provider to modify these settings.

In addition to using your browser settings, you may also choose to stop seeing many of our adverts. If you see any of the adverts displayed on our website, you can stop seeing them by clicking the “X” on the blue AdChoice button located in the upper right-hand corner of the advert.

If you would like more information about how behaviour-based advertising works, please consult full information about cookies and the steps you can take to protect your privacy online on the Your Online Choices website: http://www.youronlinechoices.com/.

Third-party privacy policies
This Privacy Policy only refers to the collection, use and disclosure of personal data carried out by BALEÀRIA. However, other entities with which we cooperate and other websites that you may access through this website may have their own privacy policies and practices. We therefore recommend that you familiarise yourself with the privacy policies provided by third parties before providing them with information or taking advantage of any offer or promotion. Although we try to cooperate only with third parties that share our high standards and the same respect for privacy, we are not responsible for the content or privacy practices used by such third parties.