1. Data Controller
The Data Controller is the owner of the website, whose full data is: Mundo Estrella Galicia, S.L.U. with Corporate Tax ID B70476676 and an address at Calle José María Rivera Corral 6, 15008 in A Coruña.
2. Data processed, purposes and conservation time
2.1 Data processed
The data processed will be different depending on the different sections or services made available to the user and which they use, as well as the additional processing allowed or authorized by the same.
Data obtained from the user: this is data provided by the user for the purchase and acquisition of the tickets, as well as the subscription to our newsletters or bulletins. This data includes the identification and contact data, such as the name and surname and the email address, although the payment information will also be requested, for making purchases in our store. In the process of purchasing tickets, the buyer could eventually provide a name or a pseudonym for their companions, but in no case will they be able to make that person identified or identifiable.
The forms provided for this purpose will indicate which data is mandatory.
Data not obtained from the user: In case of access to the establishment by minors, an authorization form must be filled out, which will include their names and surnames, as well as that of their parents or guardians, when they are not the ones accompanying them.
While browsing, data such as that sent by the browser, the IP address assigned by your provider, information on the device used, or certain social profiles associated with the user may be provided.
The purposes will be as follows
Contact: The email address or telephone number provided for contact will be used to effectively respond to the questions asked.
Bulletins or newsletters: The email address, which must be verified by the user, or the like, such as telephone numbers, will be used to send the aforementioned bulletins, according to their interests.
Purchase of tickets: The data will be used to formalize and manage the purchase of tickets to the museum or the events held there, as well as to personalize the visitors’ experience.
No payment data is stored, using third party platforms for this purpose. Authorization documents: Identifying data will be necessary both for minors and for parents or guardians who authorize the visit and access to the facilities.
The conservation time will be as follows
Contact: The data will be deleted once the question by the user has been asked and answered.
Bulletins or newsletters: The data will be processed, from the moment the user gives their consent to the withdrawal of the same, which may be granted as many times as they want. In each communication, the user will find a free and accessible procedure to manage it.
Purchase of tickets: The data will be processed throughout the contractual relationship and, once finalized, will be stored for five years, in compliance with tax and accounting regulations, as well as for the management of possible claims
Authorization documents: These will be conserved during the legally established periods, or however long is necessary for the justification of possible claims
3. Legitimization of the Processing
According to the processing carried out on the website, below we lay out the bases of legitimacy of each kind:
Execution of a contract: The data consigned in the purchase process to correctly execute the same will be used.
Consent: This will be duly obtained for authorizations, as well as for the sending of newsletters and news, as well as to give a timely response to all questions or queries asked by the Users. Consent will always be revocable and may be withdrawn at any time.
Legitimate interest: It is the legitimate interest of the owner to conserve the authorizations for the entrance of minors into the establishment. Also according to this basis of legitimacy, commercial communications may be sent, according to the tastes and interests of the users, based on the products purchased and the data obtained from their browsing.
4. Exercise of Rights
Anyone has the right to obtain confirmation about whether or not personal data concerning them is being processed. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, data subjects may request the limitation of the processing of their data or oppose the processing thereof, in which case we will only keep the data for the exercise or defense of claims.
To that end, users may send a message in writing to the Data Protection Committee, c/ José María Rivera Corral, 6 15008 A Coruña or to the email address firstname.lastname@example.org, including in both cases a photocopy of the national ID document or an equivalent accrediting document
If they wish to exercise their right to portability, this data shall be provided to the new Data Controller.
5. Recipients and transfers
The data will not be subject to transfer, unless legally established, nor will international transfers of it be carried out.