The companies responsible for processing your personal data are Zoos Ibéricos, S.A. the company responsible for operating Zoo Aquarium Madrid, with registered office at Recinto Zoo-Aquarium de Madrid, Casa de Campo, s/n, 28011, de Madrid and Parques Reunidos Servicios Centrales, S.A., with registered office at Calle Federico Mompou 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain each acting individually as controllers and together as joint controllers (the "Controllers").
If you have any questions about the processing of your personal data or if you would like to ask for relevant parts of the Joint Controllers agreement, please contact the Data Protection Officer (DPO) by post at Calle Federico Mompou 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain or by e-mail on firstname.lastname@example.org.
The Controllers will process your personal data for the purposes set out below, and consistently with the purpose of the channel through which you may have provided your personal data:
Managing your contractual relationship arising from your purchase or booking of products and services
Your personal data will be processed to manage the purchase or booking of the products and services of the Controllers, to process your payments, and to email you a confirmation of and a receipt for your purchase, together with any relevant documentation for your visit and access to the park.
If, during the purchase or booking process, you claim any special promotions that require you to fulfl certain conditions (e.g. large family, discount code for certain groups, etc.), please note that we may ask you to produce documentary evidence of your eligibility (e.g. large family card, official document showing your membership to a group, ID card, passport, driving licence, etc.). No information will be recorded or stored by the Controllers.
Should unforeseen events or circumstances arise that may impact on the product or service purchased by you (inclement weather, security or public health concerns, etc.), the Controllers may contact you by electronic means (e-mail, SMS, telephone calls) to inform you of the circumstances that may affect your visit.
Type of personal data processed: your first name, surname, email address, and telephone number; details of your purchase or booking; proof of payment and payment details, your date of birth to ensure that you are over fourteen (14) years of age. Please note that pursuant to European data protection regulations, if you are under fourteen (14) we will be required to obtain the consent from your parents or guardians. The Controllers may also process information about your country to ensure that any communications are sent to you in your chosen language.
Lawful basis: our lawful basis for processing your personal data are the terms and conditions applicable to the purchase of your product or service. Without such personal data, the Controllers would be unable to process your purchase or booking.
If you request information about our products and services or send us any questions, suggestions, complaints or claims or would like to report an incident through any of the channels made available by the Controllers (e.g. a specific form, telephone or email) your personal data will be processed to deal with your request.
Type of personal data processed: your first name, surname, email address, and telephone number; details of your purchase or booking; proof of payment and payment details; your date of birth to ensure that you are over fourteen (14) years of age. Please note that pursuant to European data protection regulations, if you are under fourteen (14) we will need to obtain the consent from your parents or guardians. The Controllers may also process information about your country to ensure that any communications are sent to you in your chosen language and, generally, any other information that you may have voluntarily supplied in your request.
Lawful basis: your data will be processed for implementing, at your request, certain pre-contractual steps or pursuant to the terms and conditions of your agreement for the purchase or booking of products or services. Without the above personal data, your request may not be processed.
If you purchase any of our products or services, the Controllers may send you surveys electronically (e.g. e-mail, SMS, phone, etc.). This is a valuable tool that enables us to find out our customers' degree of satisfaction whilst allowing them the opportunity to make suggestions. Your opinion will also enable the Controllers to improve their processes, and their range of products and services.
Type of personal data processed: your email, telephone, information related to your purchase or booking, your country (to ensure that the survey is sent in your chosen language) and any other non-personal information you provide on the surveys you chose to respond to.
Lawful basis: this processing is based on the Controllers' lawful interest in obtaining customer feedback related to the products and services purchased by them, their needs, and suggestions. The Controllers believe that no rights of their customers are infringed upon as a result of this processing. The Controllers also believe that a proper balance exists between their interests and those of their customers. Processing your personal data allows us to find out your opinion, which is necessary for us to improve our range of products and services and the park's operational processes for a better quality of our customers' experience. Additionally, due to the large number of visitors that may come to the park, sending surveys electronically is necessary for the purpose described and that there is no other effective mechanism to achieve this purpose. Likewise, we understand that our customers may reasonably expect for their personal data to be processed based on their contractual relationship with us, on the specific information provided to them as part of the purchase or reservation process, and on the fact that this type of processing is customary in the services industry. Please note that only strictly necessary non-sensitive personal data is processed, that no surveys are sent to children under fourteen (14) years of age, and that we only contact our customers occasionally and for a limited period of time.
Sending you information (including personalized information) about the products and services of the Parques Reunidos Group
Your profile will not be used to make automated decisions with legal implications for you or that will significantly affect you in a similar way (financial effects, denial of services, discriminatory, disadvantages compared to other customers, etc.), as it will only be used to ensure that you only receive communications with commercial information that we consider most appropriate for you.
Type of personal data processed: your email address and telephone number will be processed for the purpose of sending you marketing communications. Your country will be processed for the purpose of sending you marketing communications in your chosen language. The personalisation parameters indicated above (demographic criteria, transactional information and inferred socio-economic criteria) will be processed to ensure that you only receive communications with commercial information that we consider most relevant to your interests.
Market research and analysis
The Controllers will disassociate your postcode and country as supplied by you on the forms available on this website from any other personal data to produce quantitative and qualitative aggregated statistical reports for market analysis and research. This allows us to assess our market positioning based on the geographic area from which products and services are purchased and to make strategic business decisions (e.g. sales trends).
Type of personal data processed: your postcode and country information dissociated from any other personal data provided.
Lawful basis: this processing is required to satisfy our legitimate interests in knowing and understanding the geographical area from which our products and services are purchased. The Controllers believe that no rights of their customers are infringed upon as a result of this processing. The Controllers also believe that a proper balance exists between their interests and those of their customers. By processing our customers' personal data, we are in a position to evaluate our positioning in the market, which in turn is necessary for us to make strategic business decisions and to improve our products, services and operational processes in our parks, resulting in a better quality experience for our customers. We also believe that there is no less invasive method to effectively achieve this purpose, as only basic, non-sensitive information (postcode and country) is used, as previously dissociated from any personal data that would allow the individual identification of customers. our customers may reasonably expect for their personal data to be processed based on their contractual relationship with us, on the specific information provided to them as part of the purchase or reservation process, and on the fact that this type of processing is customary in the services industry.
Your personal data will be processed for this purpose only if you provide your email address and give your express consent by clicking on the pop-up that will appear during the online purchase process, and provided you remain inactive for some time. If you do not complete the purchase or reservation process, we may e-mail you a reminder inviting you to complete your purchase or booking. If you do not complete your purchase or booking we will email you a short survey to find out your reasons for not doing so, which in turn will help us improve our customers' experience on our website.
Type of personal data processed: your e-mail address.
Compliance with statutory obligations
Your personal data will be processed to allow us to comply with certain statutory duties imposed on us as a result of our relationship with you by European Union and/or domestic tax, personal data, business, consumer protection, information society services, e-commerce, civil and accounting regulations.
Lawful basis: compliance with legal duties applicable to Controllers under relevant European Union and/or domestic laws and regulations. Without your personal data, the Controllers would not be able to properly comply with such statutory duties or fulfil any statutory liabilities arising out of the relationship with you or the processing of your personal data.
Fraud prevention and detection
To put in place any measures as may be required to prevent and detect website misuse or potential fraud related to the purchase or booking of products and services involving the Controllers or their customers. Where potentially fraudulent activity is detected, the Controllers may give details of the relevant transaction, including the purchaser's identity, to the payment platform's owner and, where appropriate, to the competent authorities.
Type of personal data processed: information related to your purchases and bookings, your payment details and contact details provided in the course of potentially fraudulent purchases.
Lawful basis: we require to process your personal data to satisfy our lawful interests as Controllers. We believe that no rights of their customers are infringed upon as a result of this processing. We also believe that there is a right balance between our of legitimate interest to prevent and detect potentially fraudulent activity and the legitimate interests of our customers and website users, as it allows us to take the required measures to protect them from such unlawful activities such as attempted fraud. This processing is also beneficial for us, as it allows us to avoid misuse of their website, products and services and for society at large, ensuring that fraudulent activities are discouraged and detected when they do occur.
We use proprietary and third-party cookies and similar technologies (HTTP Cookies, Pixel Tracker and Premises and Premises Shared) on our website. As a result, we process, store and share user information and personal data when you browse this website, in accordance with the purposes and settings made available to users at all times.
Based on the purpose for which we process your personal data, different retention periods apply as follows:
When your personal data are no longer relevant for the purposes for which they were collected or if you otherwise withdraw your consent or exercise your right of erasure or objection to the processing, the Controllers will keep your personal data duly blocked (identification and reservation of the personal data, adopting technical and organizational measures to prevent processing and viewing) strictly (and only to the extent necessary), to make such data available to the competent Public Administrations and in particular to the Supervisory Authority competent in data protection, Judges, or the Public Prosecutor's Office during the statute of limitations period for legal actions that may arise from the relationship maintained with you or from the processing of your personal data and/or the legally established retention periods in accordance with European Union Law and/or domestic regulations. Upon the expiry of these time limits, your personal data will be physically and irretrievably deleted.
Pursuant to European Union Law and/or domestic regulations Your personal data may be disclosed to the Public Authorities including, in particular, data protection authorities, the courts or the Public Prosecutor's Office to meet possible legal liabilities or to comply with statutory retention periods.
The Controllers rely on third party suppliers who may also process your personal data to provide services related to the purposes for which you are being informed, including, but not limited to, information security, customer relationship management (CRM), technology, legal consulting, marketing, customer service, professional services, and IT companies. These providers will only access your personal data to perform their services on behalf of the Controllers, following at all times the Controllers' instructions and without ever being authorized to use such data for their own purposes and/or unauthorized purposes.
If you expressly agree to receive marketing information about any of the companies of the Parques Reunidos Group, please note that these are based in the European Union and are primarily engaged in the management and exploitation of fun parks, aquatic parks, zoos, leisure centres and travel agency services (e.g. sale of ticket+hotel packages). The European companies of the Parques Reunidos Group are:
You may exercise your right of access, rectification, objection, limited processing, portability and, where appropriate, your right not to be subject to automated individual decisions, including profiling, by sending your request by post to the attention of the Data Protection Officer at Calle Federico Mompou 5, Parque Empresarial “Las Tablas”, Edificio 1 – Planta 3ª, 28050, Madrid, Spain or electronically at email@example.com. If we have reasonable grounds to doubt the identity of the data subject, we may require a copy of an official Id. document (Spanish National or Foreign Id. Card/Passport) before processing your request.
For consent-based processing operations, please note that you can withdraw your consent or object at any time to the processing of your data following the procedure described in the previous paragraph. Also, we would like to remind you that if you have expressly authorized us to send to you marketing information or information about discounts and promotions, including subject to prior profiling and analysis of your preferences via automated decisions for relevance, you may also unsubscribe from this type of communications by using the methods that will be made available to you for this purpose in each commercial communication that you will receive. Finally, please note that you can also tell us not to be subject to decisions based exclusively on the automated processing described above, or ask us for human intervention, express your point of view, raise any queries about or object to automated decisions by sending your request to the Data Protection Officer at any of the addresses indicated in this section.
The personal data processed by the Controllers are provided directly by you as the data subject through this website and/or during the relationship with you.
If information on allergies and/or intolerances must be provided to the Controllers (e.g. to design the menus that may be served during an event or reception), please remember that you must only provide the number of people and the type of allergy and/or intolerance and not personal data that would allow the person with such allergy and/or intolerance to be individually identified.
Children under fourteen (14) years of age are not authorized to purchase or book our products, services or events on this website.
You may lodge a claim with the Spanish Data Protection Agency to protect your rights at any time you deem appropriate. However, we advise you to approach first our Data Protection Officer on firstname.lastname@example.org or at Calle Federico Mompou, 5, Parque Empresarial "Las Tablas", Edificio 1 - Planta 3ª, 28050, Madrid, Spain to seek assistance with your request and to resolve any incident related to the processing of your personal data.