PRIVACY POLICY

In compliance with the principle of transparency and the duty to provide information established by the applicable European Union and national data protection regulations, BALEÀRIA CANARIAS SHIPPING, S.A. (hereinafter, BALEÀRIA) hereby informs data subjects of the circumstances and conditions governing the processing of their data, as well as the rights available to them.

The Privacy Policy forms part of the General Terms and Conditions governing this website.

Who is the controller of your data?
BALEÀRIA CANARIAS SHIPPING, S.A.
A24997074.
Vía Estación Marítima, Moll de la Pança s/n – 03700 Denia (Alicante).
Telephone: 96-6428600
Email: [email protected]

BALEÀRIA reserves the right to amend or adapt this Privacy Policy at any time. We therefore recommend that you review it regularly to stay informed.

If you belong to any of the following groups, please see the expandable information below:

CUSTOMERS
What personal data do we process?
•    We will process our customers’ personal data in order to manage the contractual relationship we have with them. In this regard, we will process your identification data, national identity card or passport number, gender, contact details (telephone number and email address) and financial data (for example, your payment card number and expiry date) in order to manage the contractual relationship we have with you.
•    If you have a registered profile with BALEÀRIA, we will process your membership number.
•    When you request any type of special assistance, such as a specific diet or wheelchair service, you will need to provide confidential information relating to your health.
•    For the remaining purposes, which are described below, BALEÀRIA may process data relating to commercial interests, consumption data, booking history, habits and preferences, user behaviour data on the BALEÀRIA website, IP address, information about the customer’s device (mobile phone, computer or tablet), as well as any data that the customer voluntarily provides to BALEÀRIA.
•    Any other information that BALEÀRIA requests from you and that you are free not to provide.

For what purposes will we process your personal data?
•    To provide the contracted services and to manage and maintain the commercial relationship with our customers, including keeping you informed about your trips by sending reminders by SMS, WhatsApp and email, and sending notifications about any type of change, such as cancellations or boarding delays.
•    To manage ticket bookings or other services.
•    To provide customer service by telephone, email, postal mail, social media or virtual assistant, in order to handle your requests and provide assistance.
•    To manage the registration of your profile and account as a BALEÀRIA customer/user. In this regard, you will be provided with a personalised user account on our website or mobile applications, which you may access from your computer or other devices. You may manage your personal account at any time by logging in with your email address and password.
•    Account personalisation: to ensure that your experience with BALEÀRIA is adapted to your preferences and personal needs, we use data about how you use our digital services (website, email, applications, etc.) and combine it with other data we hold about you in order to identify the information you would like to receive, how you prefer us to communicate with you, which channels you prefer us to use, how often you would like us to contact you, etc.
When you start a new booking, we may, based on your previous bookings, pre-fill part of the current booking form. This information is obtained from previous booking processes. This includes, for example, the departure port you searched for or travelled from, your name and your contact details. The purpose of this processing is to simplify your booking process, saving you time and effort.
If you wish, you can cancel the personalisation option by disabling the “Automatic use of data” option on your account page. This will stop our data profiling/personalisation processes and delete the data that is only necessary for this type of processing.
•    To detect irregular activity in the customer/user account and take the necessary measures.
•    To invoice the contracted services and carry out the corresponding transactions.
•    To carry out control and debt recovery procedures.
•    To monitor the quality of the service that BALEÀRIA provides to the customer. For this purpose, BALEÀRIA informs you that it may record conversations with its customers.
•    To provide commercial information by electronic means (for example, email, SMS or WhatsApp), as well as to carry out marketing actions and campaigns through those means.
•    To send newsletters about BALEÀRIA products and services.
•    To conduct/send satisfaction surveys in relation to the services provided.
•    To improve the provision of the services provided by BALEÀRIA in order to offer a better user experience the next time you use our services. For this purpose, BALEÀRIA may prepare reports and statistics obtained from the analysis of the data provided by the customer.
•    To send an email to the data subject reminding them that they have not completed their booking (pending booking), providing them with easy access to the unfinished booking process.
•    In order to improve our communications with you, we also carry out market research, which may be conducted using your personal data to connect several datasets. Personal data in analytical datasets is always deleted after the analysis.
If you wish, you can delete your personal data used for marketing purposes by deleting your profile on the account page. User cookies in anonymous format cannot be associated with a specific person, but you can delete them yourself or they will be deleted in accordance with BALEÀRIA’s established practice.
•    To provide access to onboard Wi-Fi on our vessels, as well as entertainment options (for example, films) through our Wi-Fi service.

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties or the application of pre-contractual measures at the request of the data subject.
•    Compliance with a legal obligation applicable to the Data Controller.
•    Consent given by the data subject or by their legal representative.
•    The legitimate interest of the Data Controller.

How long will we keep personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from that relationship.
Personal data processed on the basis of the data subject’s consent will be kept until that consent is withdrawn. Once withdrawn, the data will be deleted, without prejudice to its retention, duly blocked, for the legally required periods in order to address any possible liabilities.

BALEÀRIA CLUB
What personal data do we process?
•    Data collected directly: personal data provided by the data subject through the website, by completing registration forms, contact forms, satisfaction surveys, complaints and/or suggestions, etc. By way of example, the data collected includes: first name, surname, gender (male/female/not specified), date of birth, DNI/NIE/PASS, telephone number, postal address, email address and password, and information about your tastes and preferences.
•    Data collected indirectly through the use of cookies to keep the registered user logged in, provide statistics associated with website use, show the location of our offices and support anti-spam systems (captcha), as well as for interaction with the social media platforms on which we participate.

For what purposes will we process your personal data?
•    To register and manage the user in BALEÀRIA CLUB.
•    To inform BALEÀRIA CLUB users about benefits and/or discounts that best suit their travel preferences and/or travel needs.
•    To inform you of the points you have accumulated as a result of trips made with us.
•    To manage the redemption of your points and any claims arising from such redemption.
•    To carry out satisfaction surveys regarding the services offered by BALEÀRIA CLUB in order to properly manage and improve the quality of the services offered.
•    To process claims, complaints and/or suggestions relating to points redemption or your status as a BALEÀRIA CLUB user.
•    To respond to any requests for information from users.
•    To manage calls from users who contact BALEÀRIA in order, where applicable, to resolve incidents or respond to necessary requests for information.
•    To analyse and study the user, based on the information available, in order to personalise the service according to their characteristics or needs and, where applicable, to send commercial information tailored to their preferences, without carrying out fully automated actions or decision-making.
•    To keep the registered user logged in, provide statistics associated with website use, show the location of our offices and support anti-spam systems (captcha).

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties.
•    Compliance with a legal obligation applicable to the Data Controller.
•    Consent given by the data subject or by their legal representative.
•    The legitimate interest of the Data Controller.

How long will we keep personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from that relationship.
Personal data processed on the basis of the data subject’s consent will be kept until that consent is withdrawn. Once withdrawn, the data will be deleted, without prejudice to its retention, duly blocked, for the legally required periods in order to address any possible liabilities.

CONTACTS THROUGH THE WEBSITE https://www.baleariacanarias.com/es/
What data do we collect through the website?
If you provide us with information through a contact form, we will process your identification and contact details, as well as any other data that you voluntarily share with us through that form.
In addition, we may process your IP address, the type of operating system or browser used, and the duration of your visit, in pseudonymised form.

For what purposes will we process your personal data?
•    To manage the requested service, respond to your request or process your enquiry.
•    To provide information by electronic means and virtual assistants concerning your requests.
•    To provide commercial or event-related information by electronic means.
•    To carry out analyses and improvements to the BALEÀRIA website in relation to the products or services offered, and to improve the commercial strategy.

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties or the application of pre-contractual measures at the request of the data subject.
•    Consent given by the data subject or by their legal representative.

How long will we keep personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from that relationship.
Personal data processed on the basis of the data subject’s consent will be kept until that consent is withdrawn. Once withdrawn, the data will be deleted, without prejudice to its retention, duly blocked, for the legally required periods in order to address any possible liabilities.

VIDEO SURVEILLANCE
What personal data do we process?
We will process your image and, where applicable, your vehicle registration number.

For what purposes will we process your personal data?
To ensure the security of property, facilities and people.

What is the legal basis for processing your data?
The legal basis that legitimises the processing is the performance of a task carried out in the public interest.

How long will we keep personal data?
For a period of 1 month from the time of recording, except in the event of incidents, in which case the data may be kept for a longer period until the incident is concluded or until the recordings are disclosed to the State Security Forces and Corps or competent authorities.

ETHICS CHANNEL
What data will we process?
We may process the following data:
•    Identification data such as first name, surname and national identity card number.
•    Contact details such as email address or telephone number.
•    Professional data such as position in the organisation or group company.
•    Trade union data, such as membership of a works council or trade union group.
•    Health data, such as injuries.
•    Any other personal data, relating to the reporting person or third parties, that is provided voluntarily.

For what purposes will we process your personal data?
•    To manage/process the communications or information received.
•    To send the reporting person the relevant communications about the processing status or the results thereof, unless they have objected to this.
•    To carry out all actions aimed at verifying the plausibility of the reported facts in order to determine whether to close the case, adopt the appropriate measures or refer it to the competent authority in each case.

What is the legal basis for processing your data?
The legal basis that legitimises the processing is compliance with a legal obligation applicable to the Data Controller.

How long will we keep personal data?
The following will be deleted immediately:
•    Any personal data that may have been reported and that refers to conduct not included within the scope of the law. If the information received contains personal data included within special categories of data, it will be deleted immediately and will not be recorded or processed.
•    Information provided, or part of it, where it is proven to be untrue, from the moment this circumstance becomes known, unless such lack of truthfulness may constitute a criminal offence, in which case the information will be kept for the time necessary while the judicial proceedings are processed.

The data subject to processing is kept in the information system only for the time strictly necessary to decide whether an investigation should be initiated regarding the reported facts. This period may not exceed three months from receipt of the information, unless, due to its particular complexity, the period has been extended by a further three months.

BALEÀRIA also informs you that it keeps a register of reports available to the competent judicial authorities in accordance with the requirements and limits established in Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption.

SUPPLIERS
What personal data do we process?
We will process the identification and contact details of our suppliers’ representatives, as well as financial, banking and payment method data, in order to manage the contractual relationship we have with the legal entities they represent.

For what purposes will we process your personal data?
•    To prepare/approve the budget and monitor it through communications between both parties.
•    To monitor the contracted services and manage the commercial relationship.
•    To invoice and declare the relevant taxes.
•    To provide commercial or event-related information by electronic means, provided that express authorisation exists or it falls within our legitimate interest.
•    To carry out the corresponding transactions, as well as control and debt recovery procedures.

What is the legal basis for processing your data?
•    The existence of a contractual relationship between the parties or the application of pre-contractual measures.
•    Compliance with legal obligations applicable to BALEÀRIA.
•    Consent given by a legal representative of the supplier.
•    BALEÀRIA’s legitimate interest.

How long will we keep personal data?
For the duration of the relationship between the parties and, once it has ended, duly blocked for the statutory limitation periods arising from that relationship.

JOB APPLICANTS
What personal data do we process?
We will process the data you share with us within the framework of the selection process or unsolicited application. In general, we will process your identification data, contact details, curriculum vitae and data relating to your professional and/or academic experience.

For what purposes will we process your personal data?
•    To manage candidates’ registration and participation in selection processes.
•    To assess professional profiles and send communications related to those processes by electronic means (email, WhatsApp), telephone or equivalent means.
•    To invite you to job interviews and assess your application.
•    Where applicable, to include the candidate’s profile in the Talent Community for consideration in future processes, when express consent exists.

What is the legal basis for processing your data?
•    The application of pre-contractual measures at the request of the data subject.
•    Compliance with legal obligations applicable to the Data Controller.
•    The data subject’s consent for the inclusion of the candidate’s profile in the Talent Community for consideration in future processes.
•    The legitimate interest of the Data Controller.

How long will we keep personal data?
Personal data will be kept until the end of the selection process and, if we have your authorisation, for a maximum period of twenty-four (24) months. Once the indicated periods have elapsed, the data will remain duly blocked for the legally established limitation periods.

SOCIAL MEDIA
What personal data do we process?
We will use the data available on your user profile, as well as any data you provide when contacting us through our social media profiles.

For what purposes will we process your personal data?
•    To process, handle and respond to your queries, requests or petitions.
•    To manage the requested service.
•    To publish your image on our profiles, subject to your prior consent.
•    To interact with you and create a community of followers.

What is the legal basis for processing your data?
The bases that legitimise the processing are the voluntary consent of the data subject and, where applicable, the acceptance of a contractual relationship within the relevant social network environment. Data processing within the social network will be carried out in accordance with its privacy policies.

As stated in the terms and conditions available on the BALEÀRIA website, by publishing content accompanied by the hashtag #OkBaleària, the user/customer authorises BALEÀRIA to reproduce, publicly communicate and use that content, including any image and/or voice it may contain, for promotional, advertising and corporate purposes related to the brand and its services, on websites, social media and other communication channels owned by BALEÀRIA or by its third-party collaborators. The user/customer may request the removal of any content at any time by sending an email to [email protected] or to [email protected]

How long will we keep personal data?
We can only consult or delete your data in a restricted manner because we have a specific profile. We will process your data for as long as you allow us to do so by following us, being friends with us or clicking “like”, “follow” or similar buttons.
Any rectification of your data or restriction of information or publications must be carried out through the settings of your profile or user account on the social network itself.

ADDITIONAL INFORMATION ABOUT THE PROCESSING OF YOUR DATA:

Do we include personal data of third parties?
No. As a general rule, we only process data provided to us by the data subjects themselves. If you provide us with third-party data, you must first inform those persons and obtain their consent; otherwise, you release us from any liability for failure to comply with this requirement.

What security measures do we apply?
In view of BALEÀRIA’s concern to ensure the security and confidentiality of the personal data processed, the required levels of security for the protection of personal data have been adopted and the technical means available to BALEÀRIA have been installed to prevent the loss, misuse, alteration, unauthorised access and theft of personal data provided through the Website. In any case, you should bear in mind that security measures on the Internet are not impenetrable.

To which recipients will your data be disclosed?
BALEÀRIA does not sell the personal data it processes to third parties.

Accordingly, your data may be disclosed to the competent authorities or public bodies when required by law, regulation, legal process or an applicable governmental request, as well as to banks and financial institutions for the collection of the service provided or product purchased.

When the customer makes payment in dirhams, the data necessary for managing and processing that payment will be transferred to the intermediary in Morocco, EUROMAROC DETROIT SARL; and when the customer makes payment in dinars, the data necessary for managing and processing that payment will be transferred to the intermediary in Algeria, MARDMEDSA BEMARINE SPA. These transfers are based on the performance of the contract and are necessary for the correct processing of the payment, with BALEÀRIA having applied appropriate technical and organisational measures to ensure that such data transfers strictly comply with applicable law.

If part of the booking made by the customer involves a service provided by a third party, BALEÀRIA may share your personal data with that third party.

BALEÀRIA may also share the data collected with its business partners or with different companies belonging to GESTIÓN NAVIERA SL, with tax identification number B57030751, BALEÀRIA being one of the companies that forms part of the group of companies belonging to GESTIÓN NAVIERA, S.L. Such sharing will be carried out for various purposes, such as the proper provision and improvement of the service, ticket marketing, as well as systems administration, statistics, research and analysis. For example, on the website of BALEÀRIA EUROLÍNAS MARÍTIMAS, S.A. (balearia.com/es), tickets issued by BALEÀRIA CANARIAS SHIPPING, S.A. and operated by Grupo ARMAS TRASMEDITERRÁNEA (Compañía Trasmediterránea S.A. and Naviera Armas S.A.) are marketed/sold, with the aforementioned companies forming part of the group of companies belonging to GESTIÓN NAVIERA, S.L.

In order to fulfil the purposes indicated in this Privacy Policy, we will work with service providers who may have access to your personal data. BALEÀRIA has entered into the corresponding data processing agreement with these providers, in accordance with the provisions of Article 28 GDPR. BALEÀRIA informs you that, if access to data by these providers involves an international transfer of personal data outside the European Economic Area, BALEÀRIA applies appropriate mechanisms and safeguards provided for by the applicable regulations (e.g. European Commission adequacy decision, Binding Corporate Rules and/or Standard Contractual Clauses, among others) to ensure that these providers apply a level of security equivalent to that required under European data protection regulations.

What rights do you have?
•    The right to access your personal data.
•    The right to request rectification of your data if it is inaccurate.
•    The right to request deletion of your data when the data is no longer necessary for the purposes for which it was collected, when the statutory retention periods have expired, or when you withdraw the consent given for specific processing activities.
•    The right to withdraw the consents granted.
•    Under the conditions set out in the General Data Protection Regulation, data subjects may request restriction of the processing of their data or its portability.
•    In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data.
•    The right not to be subject to automated decisions (including profiling).
•    The right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with the applicable law. Prior to lodging such complaint, or to communicate any question or concern in relation to the processing of personal data, you may contact the Data Controller at the postal and email addresses indicated.

If you modify any data, we would appreciate it if you informed us so that we can keep it up to date.

To exercise the rights indicated, you must send a request to the email address [email protected] or to the postal address Vía Estación Marítima, Moll de la Pança s/n – 03700 Denia (Alicante), identifying yourself appropriately. In the event of reasonable doubts about the identity of the applicant, BALEÀRIA may request additional information.

BALEÀRIA guarantees accessible and free channels for exercising these rights.

How long do we take to respond to the exercise of rights?
One month from receipt, extendable by a further two months where the exercise of the right requires it due to its complexity, and you will be notified in due time and form.

Data Protection Officer (DPO)
BALEÀRIA has appointed a Data Protection Officer to supervise regulatory compliance and handle privacy-related queries. You may contact the DPO at [email protected]. The DPO acts as a point of reference for resolving doubts, managing requests and coordinating privacy-related actions and regulatory compliance. Their role is to ensure that all processing operations comply with the applicable regulations and the guidelines of the Spanish Data Protection Agency (AEPD).

Do we carry out international data transfers?
BALEÀRIA may carry out international transfers of personal data to countries located outside the European Economic Area. Such transfers will only be carried out where there is a lawful basis under Regulation (EU) 2016/679 (GDPR) and, in particular, where the appropriate safeguards provided for in that regulation are in place, ensuring at all times a level of protection equivalent to that of Europe.

For this purpose, BALEÀRIA will ensure that such transfers are covered by one of the mechanisms recognised by the applicable regulations, such as adequacy decisions adopted by the European Commission, the signing of Standard Contractual Clauses approved by the European Commission or the existence of Binding Corporate Rules, among other valid instruments.

Do we use cookies?
Yes, we use cookies other than those that are strictly necessary. You can consult the Cookie Policy via the corresponding link available on our website.

When you visit our website or use our mobile applications, we collect certain information by automated means through cookies. Cookies are small text files that are stored on your device when you visit a website. When you visit a website for the first time, a cookie file is sent to your device and identifies your browser.

By using cookies, you help BALEÀRIA improve the functionality of its website. Cookies are therefore important for reducing download time and improving the user experience. Cookies collect information about how visitors use our websites and therefore provide us with useful information on how to offer a better customer experience and improve our services.

We also use cookies for authentication processes so that you do not have to provide your credentials every time you visit our website. These cookies are strictly necessary for the correct functioning of the service. If you configure your browser’s technical settings, you may prevent cookies from being stored on and accessed from your device. However, please note that if you disable cookies, you may not be able to use the services on our website or mobile applications.

Finally, we use cookies for marketing purposes. Some of BALEÀRIA’s business partners, acting as intermediaries between us and advertisers, place cookies on our website. We use these cookies to provide more relevant information and personalised advertising offers, measure the effectiveness of our advertising campaigns and limit how often each advertisement is displayed.

If the settings of your mobile device and the permissions granted to our mobile applications allow it, we may access geolocation information provided by that device. This Privacy Policy governs how we use this information when we associate it with your personal data. You may manage location access permissions at any time from the privacy and security settings of your mobile device. You may also consult the instructions of your device manufacturer or operating system provider to modify those settings.

In addition to using your browser settings, you may also choose to stop seeing many of our advertisements. If you see any of the advertisements that appear on our website, you can stop seeing them by clicking the “X” on the blue AdChoice button located in the upper right-hand corner of the advertisement.

If you would like more information about how behavioural advertising works, please consult full information about cookies and the steps you can take to protect your privacy online on the Your Online Choices page: http://www.youronlinechoices.com/.

Third-party privacy policies
This Privacy Policy only refers to the collection, use and disclosure of personal data carried out by BALEÀRIA. However, other entities with which we cooperate and other websites that you may access through this website may have their own privacy policies and practices. We therefore recommend that you familiarise yourself with the privacy policies provided by third parties before providing them with information or taking advantage of any offer or promotion. Although we try to cooperate only with third parties that share our high standards and the same respect for privacy, we are not responsible for the content or privacy practices used by those third parties.