Privacy Policy

The data controllers of the processing your personal data are Zoos Ibéricos, S.A. the company operating Zoo Aquarium Madrid, and the company managing its central services, Parques Reunidos Servicios Centrales, S.A., both with registered office at Calle Federico Mompou 5, Parque Empresarial "Las Tablas," Building 1 - 3rd Floor, 28050, Madrid, Spain. Both companies act individually as data controllers and jointly as joint controllers (hereinafter, the “Controllers”). 

If you have any questions regarding the processing of your personal data or wish to request the essential parts of the joint controllership agreement between the Controllers, you may contact the Data Protection Officer (DPO) by sending your request to the above postal address or via email at dpo@grpr.com.

Customer Service

If you request information about products and services or send us enquiries, suggestions, complaints, claims or incident reports, personal data will be processed in order to manage and respond to your request through the channel enabled by the Controllers for each case, including, among others, a specific form, telephone, email or, where available and appropriate for the requested handling, LiveChat.

Exceptionally, and only where essential to properly manage a request, incident or service provided by the Park, the Controllers may request the additional information or documentation strictly necessary to verify the circumstances described by the user or compliance with the conditions applicable in each case. Such information will be processed solely to carry out that verification.

Specific features of LiveChat

Where assistance is provided through LiveChat, the service is intended to provide information about the Park and its services, as well as support concerning bookings, purchases, contracts, subscriptions, Park products or services and other ordinary customer-service matters.

Assistance through LiveChat will be provided exclusively by human Park agents. During the interaction, no artificial intelligence systems will be used to generate responses, assist agents or otherwise intervene in the conversation with the user.

LiveChat is not an authorised channel for: exercising data-protection rights; filing reports; notifying incidents; processing formal claims; refund requests that must be handled through specific channels; requests requiring supporting documentation; lost property; complex ticket incidents; managing groups, events or bookings for more than 80 people, or matters that must be handled through specialised Park channels; or any other matter which, by its nature, must be dealt with through the channels specifically enabled for that purpose.

When assistance is provided through LiveChat, the Customer Service agent may access the previous conversation history with the Artificial Intelligence (AI)-based Virtual Assistant (you can find the Privacy Policy below), where necessary to ensure continuity of assistance and prevent the user from having to repeat information already provided.

Categories of personal data processed

Depending on the case, the following may be processed: first name, surname, telephone number, email address, transactional information related to the purchase, booking, contracting or subscription of products or services, date of birth where necessary to verify that you are over fourteen (14) years of age, country, and any other information that you voluntarily provide in your request.

Where assistance is provided through LiveChat, data provided during the conversation and the history of that interaction may also be processed where necessary for the proper handling of the enquiry and the continuity of the assistance provided.

LiveChat is intended exclusively to provide information and assist users in relation to Park services. You should therefore provide only the information necessary to handle your enquiry. Where a matter requires documentation or additional information, the channel specifically enabled by the Park for that purpose must be used.

Legal basis

Depending on the case, the legal basis for processing will be the taking of steps at the data subject’s request prior to entering into a contract, or performance of the contract (contracting/subscription terms and conditions) to which the data subject is party as a result of purchasing, booking, contracting or subscribing to products or services offered by the Controllers.

Where additional information or documentation must be requested to verify compliance with the conditions applicable to a service, promotion, request, incident or matter initiated by the user, processing will be based on the Controller’s legitimate interest in verifying that the relevant requirements are met, preventing misuse of Park services and protecting the legitimate interests of the user, the Controller and other customers.

You may nevertheless object to the processing of your personal data at any time or exercise the other rights granted by data-protection legislation in accordance with the procedure described in the section “What rights do you have when you provide us with your personal data?” of this Privacy Policy.

Depending on the purpose for which we process your personal data, the applicable retention criteria are as follows:

• Sending communications for professional placement purposes: unless you object to the processing activity or exercise your right to erasure, personal data will be retained for a period of 12 months and subsequently blocked for a period of 3 years.
• Management of the contractual relationship for the purchase or reservation of products and services: While the contractual relationship with you remains in effect due to the purchase or reservation of products and services.
• Processing of personal data under collaboration agreements with companies and groups: for a maximum period of one year from the user's last request made through the designated portal. This period allows for proper management of access to benefits, resolution of any issues that may arise, and facilitation of discount redemption. Since users may request discounts multiple times while the agreement with the relevant company or group remains in effect, the retention period will reset with each new request. If no new requests are made within one year, the data will be securely deleted, unless there is a legal obligation to retain it for a longer period, in which case it will be temporarily blocked until its definitive deletion.
• Customer service: Data associated with Customer Service will be retained for as long as necessary to manage and respond to the request, enquiry, incident, complaint or claim submitted. Please note that, where assistance is provided by telephone and the call is recorded, the recording will be retained for a maximum of five (5) years from the date on which it was made. Where assistance has been provided through the Virtual Assistant or LiveChat, conversations will be retained for 12 months after their conclusion and will then be deleted, unless they must be retained for a longer period to comply with a legal obligation or for the establishment, exercise or defence of legal claims. This is without prejudice to any blocking and retention periods that may apply in accordance with the provisions at the end of this section.
• Sending commercial communications, including personalized communications, about our own products and services, those of other companies in the Parques Reunidos Group in Europe and other third-party collaborators: Until you withdraw the express and informed consent you previously provided, request to unsubscribe through the means provided in each commercial communication you receive, or exercise your right to erasure, objection, or your right not to be subject to automated decisions, including profiling. In such cases, your personal data will no longer be processed for this purpose.
• Anonymization of Personal Data for Research, Market Analysis, and Customer Experience: The information processed for this purpose is anonymized and cannot be linked to your other personal information. However, if you request the erasure of your data or object to the processing before anonymization, your data will no longer be processed for this purpose.
• Compliance with legal obligations: Personal data will be retained in a blocked state for as long as legal liabilities may arise for the Controllers in relation to their legal obligations.
• Prevention and detection of potentially fraudulent activities: Until any detected fraudulent activities are resolved, after which the data will remain blocked as long as legal liabilities may arise for the Controllers as a result.
• Cart management and recovery: For a maximum of 30 days, unless you withdraw your express consent or request to unsubscribe from abandoned cart reminders beforehand. In such cases, your personal data will no longer be processed for this purpose.
• Dissemination of the content of users who have previously mentioned or tagged the park on social networks: depending on the type of publication, personal data will be retained according to the following criteria: (i) in the case of publications shared on our stories, personal data will be processed for twenty-four (24) hours, being subsequently deleted without the possibility of recovery; (ii) in the case of publications shared on our feed, personal data will be processed until the user withdraws their consent to their data being published, without affecting the lawfulness of the processing based on consent prior to its withdrawal.
• Use of cookies and similar technologies: The information will be processed for as long as the consent granted by users for the installation of cookies on their devices remains valid. If users do not revoke this consent through the mechanisms provided in our Cookies Policy, the information will be retained for the duration of the validity period of the installed cookies or similar technologies.

In any of the above cases, once the personal data is no longer relevant for the collected purposes or, where applicable, you withdraw your consent or exercise your right to erasure or objection regarding the indicated processing activities, the Controllers may retain the data in a blocked state (meaning that the personal data will be identified and reserved, with technical and organizational measures implemented to prevent its processing, including its visualization). This ensures that the data remains available, if necessary, to competent public authorities, particularly the relevant Data Protection Supervisory Authority, Courts, Tribunals, or the Public Prosecutor’s Office, for the duration of the statute of limitations of any legal actions that may arise from the relationship with you or the processing of your personal data, as well as for the legally established retention periods in accordance with European Union law and/or applicable domestic regulations. Once these periods expire, your personal data will be permanently deleted without the possibility of recovery.

Only if necessary to comply with legal retention periods or to address potential legal liabilities, your personal data may be disclosed to the competent Public Authorities, in particular the Data Protection Supervisory Authority, Courts, Tribunals, or the Public Prosecutor’s Office, in accordance with European Union law and/or applicable domestic legal frameworks.

Additionally, the Controllers engage service providers who may process your personal data to deliver services related to the purposes for which you have been informed. By way of example and without limitation, such service providers operate in the following sectors: information security, customer relationship management (CRM), technology, legal advisory, marketing, customer support, multidisciplinary professional services, IT services, among others. These service providers shall only access your personal data to perform their services on behalf of and under the instructions of the Controllers, and under no circumstances may they use such data for their own purposes and/or for unauthorized processing activities.

Among these providers, Salesforce is engaged to provide CRM and marketing cloud services, operating through entities worldwide. This provider shall act on our behalf and under our instructions within the European Economic Area (EEA), in compliance with the applicable European data protection regulations. However, exceptionally, in certain circumstances such as disaster recovery (a process aimed at recovering data and functionalities in the event of a system disruption caused by a natural or human-made disaster), Salesforce may also render its services through entities located outside the EEA. In such cases, it may be necessary to process your personal data in countries that do not offer an equivalent level of data protection to that provided under European data protection law (for example, in the United States).

Nonetheless, even in such scenarios, the Controllers have entered into binding contractual commitments with Salesforce and have ensured the implementation of appropriate security measures to guarantee that your personal data is processed at all times with a level of protection adequate and equivalent to that required within the EEA. These safeguards include the execution of Standard Contractual Clauses approved by the European Commission in accordance with the General Data Protection Regulation (GDPR), the adoption of supplementary security measures, and adherence to recognized certification mechanisms.

For further information or to exercise any of the rights granted to you under data protection law, please do not hesitate to contact the Controllers as described in the section “What are your rights when you provide us with your personal data?” included in this Privacy Policy.

If you expressly consent to receiving commercial communications from the Parques Reunidos Group companies, please note that these companies are located within the European Union and primarily engage in the management and operation of amusement parks, water parks, zoos, aquariums, leisure centers, and travel agency activities, including offering hotel and theme park packages. Specifically, these companies include:

• Spanish Companies of Parques Reunidos Group: Parques Reunidos Servicios Centrales, S.A. (Bono Parques); Parque de Atracciones Madrid, S.A.U. (Parque de Atracciones Madrid); Madrid Theme Park Management, S.L.U. (Parque Warner and Parque Warner Beach); Gestión Parque de Animales Madrid, S.L.U. (Faunia); Zoos Ibericos, S.A. (Zoo Aquarium Madrid); Parques de la Naturaleza Selwo, S.L. (Selwo Aventura and Hotel Selwo Lodge); Aquopolis Cartaya, S.L.U. (Aquopolis Cartaya); Leisure Parks, S.A. (Aquopolis de Villanueva de la Cañada, Aquopolis Costa Dorada - Vilaseca, Costa Dorada Delfinario, Costa Dorada – Vilaseca, Costa Dorada, Selwo Marina, Aquopolis de Cullera, Aquopolis de Torrevieja, Teleférico de Benalmádena); Mall Entertainment Centre Acuario Arroyomolinos, S.L.U. (Atlantis Aquarium); Travelpark Viajes, S.L.U. (products and services related to ticket packages for parks and leisure centres of the Parques Reunidos Group in Europe and hotel accommodation bookings).
• Rest of the Companies of Parques Reunidos Group in Europe: Italy - Parco della Standiana S.R.L (Mirabilandia and Mirabeach) and Travelparks Italy, S.R.L. (products and services related to ticket packages for parks and leisure centres of the Parques Reunidos Group in Europe and hotel accommodation bookings); Norway - Tusenfryd A/S (Tusenfryd) and Bø Sommarland AS (Bo Sommarland); Belgium - Bobbejaanland, B.V.B.A (Bobbejaanland); BonBon-Land A/S (BonBon -Land); Germany - Movie Park Germany GmbH and Movie Park Germany Services GmbH (Movie Park), Nature Park Germany GmbH (Vogelpark Walsrode), Tropical Island Management (Tropical Island) and TI Hotel Asset GmbH (Tropical Island Hotels); The Netherlands - Attractie- en Vakantiepark Slagharen B.V. (Slagharen y Slagharen Beach); France - Aquasplash SAS (Aquasplash y Adventure Golf), SoBlue Hotel SAS (SoBlue Hôtel); England- Grant Leisure Group LTD (Blackpool Zoo), Real Live Leisure Company LTD (The Bournemouth Aquarium and Aquarium of the lakes) and Lakeside Mall Entertainment Centre Limited (Nickelodeon Adventure-Lakeside).

You may exercise your right to access, rectification, erasure, objection, restriction, portability, and, where applicable, not to be subject to automated individual decision-making, including profiling, by submitting a written request addressed to the DPO at the postal address: Calle Federico Mompou 5, Parque Empresarial “Las Tablas,” Edificio 1 – 3rd Floor, 28050, Madrid, Spain, or via email at dpo@grpr.com. If there are reasonable doubts regarding the identity of the data subject, a copy of an official document (ID card, NIE, or passport) may be requested to process the request.

Regarding processing based on your consent, please note that you may withdraw your consent or object to processing at any time by following the procedure described in the previous paragraph. Additionally, if you have expressly consented to receiving commercial communications, we also provide you with the option to unsubscribe using the means available in each commercial communication you receive.

Furthermore, when applicable, you may also request not to be subject to individualized decision-making based solely on automated processing of your personal data for profiling purposes. You may also request human intervention, express your viewpoint, clarify any doubts, or challenge such decisions by submitting your request to the DPO following the procedure described in the previous paragraph.

The personal data processed by the Controllers is provided directly by you as the data subject through this website and/or during your relationship with us.

If you provide personal data from third parties, you must obtain their explicit and informed consent before sharing their personal data with the Controllers, in accordance with the provisions described in this Privacy Policy.

If it is necessary to provide the Controllers with information about allergies and/or intolerances (for example, to configure menus for an event or activity previously booked by you), please ensure that you only provide the number of people and the type of allergy and/or intolerance, without including any personal data that could individually identify the person with the allergy or intolerance.

Minors under fourteen (14) years of age are not permitted to purchase or book any of the products or services offered on this website.

Notwithstanding the above, if, as a result of purchasing or booking any of the products or services offered through this website (e.g., birthday celebrations), you freely and voluntarily decide to provide personal data of a minor under fourteen (14) years of age (e.g., to personalize the space where the contracted services will be provided), you, as the holder of parental authority or legal guardian of the minor, must provide explicit and informed consent for the Controllers to process the minor’s personal data within the contractual relationship established with you as a result of the purchase or booking of such products or services, in accordance with the provisions of this Privacy Policy.

You may file a complaint with the Spanish Data Protection Agency if you believe your rights have been violated. However, we recommend that you first contact the DPO via email at dpo@grpr.com or by post at Calle Federico Mompou, 5, Parque Empresarial "Las Tablas," Edificio 1 - 3rd Floor, 28050, Madrid, Spain, so we can assist you with your request and address any concerns regarding the processing of your personal data.

This Privacy Policy governs the use of the Artificial Intelligence (AI)-based virtual assistant made available to users of the Zoo Aquarium de Madrid website, hereinafter the “Virtual Assistant”.

The controller of any personal data that users may voluntarily enter while using the Virtual Assistant is Gestión Parque de Animales de Madrid S.L.U., the company operating Zoo Aquarium de Madrid, with registered office at  Casa de Campo, s/n, Madrid, 28011  (the “Controller”).

You may contact the Data Protection Officer at: dpo@grpr.com.

We provide users of our website with an AI-based virtual assistant whose purpose is to answer frequently asked questions and provide general information about Zoo Aquarium de Madrid, its opening hours, services, facilities, rides, events, activities and other information available on our website.

The Virtual Assistant generates automated responses using information available on our website, our knowledge base and other information sources configured by the Controller.

Responses are for information purposes only. Although we take reasonable steps to keep information accurate and up to date, AI-generated responses may be incomplete, inaccurate or outdated.

Information provided by the Virtual Assistant must therefore not be regarded as professional, legal or contractual advice, or used as the sole basis for important decisions. If the information is important to you, verify it through the official channels of Zoo Aquarium de Madrid.

The Virtual Assistant is designed to answer general questions about the Park using information on our website and other sources configured by the Controller. You do not need to provide personal data or confidential information for this purpose.

Accordingly, please do not enter into the Virtual Assistant:

• personal data concerning you or third parties that are not strictly necessary to formulate your enquiry;

• health, disability, allergy, intolerance or other particularly sensitive information; 

• payment or bank details, card numbers, security codes, proof of payment or other payment-related information;

• documents, images or confidential information;

• information concerning complaints, claims, refunds, lost property, specific incidents or requests requiring individual handling.

The Virtual Assistant is not designed to process purchases, bookings, booking changes, payments, complaints, claims, refunds, lost property, specific incidents or rights requests. For these matters, use the official channels enabled by the Park. 

In certain cases, if you expressly ask to speak to a person or the Virtual Assistant cannot answer using the available information, the conversation may be transferred to a human agent in the Park’s Customer Service department through LiveChat, where available.

Before the transfer, a specific notice will inform you that the conversation will be handled by a person.

The human agent may access the prior conversation history to ensure continuity, avoid repetition and properly handle your request.

Once transferred to LiveChat, assistance will be provided exclusively by a human agent. LiveChat does not involve artificial intelligence systems for generating responses, decision-making, agent assistance or any other automated intervention in the interaction.

Personal-data processing through LiveChat is governed by the Park’s general Privacy Policy, under Customer Service, available here at this page.

The Virtual Assistant does not require personal data to fulfil its primary purpose. However, because enquiries are entered as free text, users may voluntarily include personal data. Such data may then be incidentally and temporarily incorporated into the conversation. The categories processed depend exclusively on the information the user voluntarily enters.

The Virtual Assistant is designed to respond without using personal data. Please do not voluntarily enter personal information during the conversation.

Personal-data processing through LiveChat is governed by the Park’s general Privacy Policy, under Customer Service, available here at this page.

If users voluntarily enter personal data, those data may be incidentally incorporated into the conversation and processed solely to: manage the conversation technically; apply the relevant technical deletion measures; and, where necessary, enable continuity of assistance by a human agent through LiveChat, including that agent’s access to the conversation history.

Voluntarily entered personal data will not be used to:

• create individual profiles;

• make automated decisions producing legal or similarly significant effects;

• personalise responses provided by the Virtual Assistant;

• train foundation artificial-intelligence models;

• analyse individual user behaviour;

• improve AI models using identifiable personal data;

• handle claims, refunds, incidents, payments or requests that must be processed through the relevant official channels.

Please do not voluntarily enter personal information during the conversation.

The legal basis for this occasional, incidental and limited processing is the Controller’s legitimate interest. That interest consists of properly managing information that users may voluntarily enter into a tool which does not require personal data, applying measures to reduce exposure of such data and, where necessary, enabling continuity of assistance by a human agent.

Personal data voluntarily entered will not be used for profiling, individual behaviour analysis, automated decision-making with legal or similar effects, training foundation AI models, unnecessary personalisation or handling matters that must use official channels.

Where a conversation is transferred to LiveChat and personal data must be processed to manage an enquiry concerning a booking, purchase or contracted service, processing will be governed by the Customer Service section of the Park’s general Privacy Policy.

Conversations through the Virtual Assistant will be retained for 12 months after they end and will then be deleted from the platform. If transferred to a human LiveChat agent, the 12-month period begins after the interaction with the agent ends, to allow continuity of assistance.

Please do not voluntarily enter personal information during the conversation.

Conversations will not be used to train foundation artificial-intelligence models or create individual user profiles. If this purpose changes in future, users will be informed in advance and the measures required by applicable law will be adopted.

The Virtual Assistant does not make decisions producing legal effects for users or similarly significantly affecting them. It is limited to providing general, automated information in response to user enquiries.

The Virtual Assistant is not specifically directed at minors. If you are a minor, use it under the supervision of your parents, guardians or legal representatives and do not provide personal data about yourself or others.

Parents, guardians or legal representatives must supervise minors’ use and prevent them from providing personal data, confidential information, particularly sensitive data or other information unnecessary for a general enquiry.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and any other right recognised by applicable law, by contacting the Data Protection Officer at dpo@grpr.com.

To handle your request, we may need additional information to identify the relevant conversation, such as its approximate date and time and the website or Park from which the interaction occurred.

Where the information has been deleted or the conversation associated with the user cannot be identified, it may not be possible to respond to requests concerning a specific conversation.

If you believe your data have not been processed in accordance with applicable law, you may lodge a complaint with the Spanish Data Protection Agency.

For further information on how the Virtual Assistant operates or on the use of artificial intelligence in this service, contact faunia@faunia.es.

The Virtual Assistant does not replace official Customer Service channels. Where personalised attention is required or an enquiry cannot be resolved, the conversation may be transferred to a human agent, who may access its prior history to ensure continuity. Processing by the human agent is governed by the Customer Service section of the Park’s general Privacy Policy.

Procedures for exercising data-protection rights, claims, complaints, requests requiring supporting documentation and any other matters that must use specific channels must be carried out through the official channels enabled and communicated by the Park, and not through the Virtual Assistant or web chat.

Privacy Policy last updated on October 2026.