1. Introduction & General Overview
Welcome to Carnivalsortsprk Iberian Explorations S.L. ("we", "our", "us", or "the Company"). We respect the privacy of every individual who visits our digital archives, spatial WebGL visualization platforms, and interactive travel chronicles available at carnivalsortsprk.casa (the "Platform"). This Privacy Policy describes how we collect, store, utilize, process, and safeguard personal data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), the Spanish Organic Law on Data Protection (LOPDGDD 3/2018), and international privacy frameworks.
2. Data Controller Details
The data controller responsible for the processing of your personal information collected via this platform is:
Carnivalsortsprk Iberian Explorations S.L.
Company Registration Number: B-45928174
Paseo del Tajo, 14, 45002 Toledo, Spain
Contact & Data Protection Officer: [email protected]
3. Categories of Information We Collect
We may collect and process the following categories of personal information:
- Directly Provided Information: When you complete our contact or expedition dispatch forms, you may voluntarily provide your full name, email address, physical postal address, telephone number, and message inquiries.
- Automated Telemetry & Device Data: Information automatically transmitted by your browser or device, including Internet Protocol (IP) address, operating system, browser type and version, language settings, screen resolution, referral URL, and WebGL hardware capabilities used to render our river simulation engine.
- Session & Interaction Metrics: Pages visited, scroll depth across our visual chapters, dwell time on cartographic nodes, and button clicks.
- Cookie & Local Storage Identifiers: Data stored via technical, analytical, or functional cookies and localStorage keys to remember cookie consent selections and visual preferences.
4. Legal Bases and Purposes for Processing
Under Article 6 of the GDPR, we rely on the following legal bases to process your personal data:
- Consent (Art. 6(1)(a)): When you opt-in to analytical tracking cookies or submit dispatch inquiries requesting customized geographical travel guides.
- Performance of a Contract (Art. 6(1)(b)): To manage, facilitate, and fulfill editorial collaboration agreements or expedition booking requests.
- Legitimate Interests (Art. 6(1)(f)): To maintain web application security, prevent fraudulent bot traffic, optimize WebGL rendering performance, and debug layout responsiveness.
- Compliance with Legal Obligations (Art. 6(1)(c)): To satisfy statutory accounting, tax, and commercial archiving requirements under Spanish and European Union jurisprudence.
5. Third-Party Data Processors & Transfers
We do not sell, rent, or trade your personal data to third parties. We may transmit data strictly on a need-to-know basis to certified third-party service providers acting as Data Processors under strict Data Processing Agreements (DPAs):
- Cloud Hosting & CDN Infrastructure: Hosting providers ensuring low-latency delivery of static assets and interactive scripts.
- Typography & Font Delivery: Google Fonts (served privacy-compliantly).
- Analytical Engine: Self-hosted or privacy-shield compliant telemetry engines utilized purely for aggregated traffic visualization.
If data is transferred outside the European Economic Area (EEA), such transfers are governed by European Commission Standard Contractual Clauses (SCCs) guaranteeing equivalent data protection.
6. Data Retention Policies
We retain personal data only for the duration strictly necessary to fulfill the purposes for which it was gathered. General dispatch inquiries submitted through the contact portal are retained for a maximum period of 24 months, after which they are irreversibly anonymized or destroyed. Technical server log files are automatically purged every 90 days unless subject to active cybersecurity investigation.
7. Your Statutory Rights Under GDPR
As a data subject located in the European Union or other jurisdictions with data protection legislation, you are entitled to exercise the following rights:
- Right of Access (Art. 15 GDPR): Request a copy of all personal data held concerning your person.
- Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete records.
- Right to Erasure ('Right to be Forgotten' - Art. 17 GDPR): Request deletion of your personal records where no overriding legitimate ground exists.
- Right to Restriction of Processing (Art. 18 GDPR): Limit how we process your information under certain dispute conditions.
- Right to Data Portability (Art. 20 GDPR): Obtain your data in a structured, commonly used, and machine-readable format.
- Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.
To exercise any of these statutory rights, please submit a written request with verification of identity to [email protected]. You also have the legal right to lodge a formal complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD, www.aepd.es) or your local supervisory authority.
8. Security Measures
We apply strict physical, organizational, and technical security protocols, including 256-bit TLS/SSL encryption across all endpoints, automated intrusion detection, and restricted internal access permissions to protect against unauthorized access, alteration, or disclosure.
9. Amendments to this Policy
We reserve the right to revise this Privacy Policy periodically to reflect evolving legal frameworks, technological improvements, or operational modifications. Material changes will be noted on this page with an updated effective date.