Privacy Policy

01Identity of the Data Controller

• Data Controller: AYNGROUP21 S.L.
• Tax ID No.: B09650573
  Registered in the Mercantile Registry of Asturias, volume 4479, folio 166, section 8, sheet AS-58911, entry 1.
• Address: Avenida Hermanos Menéndez Pidal, 13, puerta D, 33005 Oviedo (Asturias), Spain.
• Email: contacto@redestrail.com
• Website: https://www.redestrail.com

02Principles Applied to Data Processing

When processing your personal data, the Data Controller will apply the following principles, in accordance with the requirements of the new European data protection regulation (GDPR):

• Principle of lawfulness, fairness and transparency: The Data Controller will always require consent for the processing of personal data, which may be for one or more specific purposes, about which the Data Controller will inform the User in advance with full transparency.
• Principle of data minimisation: The Data Controller will request only the data strictly necessary for the purpose or purposes for which it is requested.
• Principle of storage limitation: The Data Controller will keep the personal data collected only for the time strictly necessary for the purpose or purposes of the processing. The Data Controller will inform the User of the applicable retention period depending on the purpose.
  In the case of subscriptions, the Data Controller will periodically review the lists and delete records that have remained inactive for a considerable period of time.
• Principle of integrity and confidentiality: The personal data collected will be processed in such a way as to ensure its security, confidentiality and integrity.
  The Data Controller takes the necessary precautions to prevent unauthorised access to or improper use of its users’ data by third parties.

03Collection of Personal Data

You are not required to provide any personal data in order to browse the Website.

The situations in which you do provide your personal data are as follows:

• When contacting the Data Controller through contact forms or by sending an email.

04Your Rights

The Data Controller informs you that, with regard to your personal data, you have the right to:

• Request access to the stored data.
• Request rectification or erasure.
• Request restriction of processing.
• Object to processing.

You may not exercise the right to data portability.

The exercise of these rights is personal and must therefore be exercised directly by the data subject, by requesting it directly from the Data Controller. This means that any customer, subscriber or collaborator who has provided their data at any time may contact the Data Controller and request information about the data stored and how it was obtained, request rectification, object to processing, restrict its use, or request the erasure of that data from the Data Controller’s files.

To exercise your rights, you must send your request together with a photocopy of your National Identity Document or equivalent to the following email address: contacto@redestrail.com

The exercise of these rights does not include any data that the Data Controller is required to retain for administrative, legal or security purposes.

You have the right to effective judicial protection and to lodge a complaint with the supervisory authority, in this case the Spanish Data Protection Agency, if you consider that the processing of personal data concerning you infringes the Regulation.

05Purpose of the Processing of Personal Data

When you write to the Data Controller through the contact form or by email, you are providing personal information for which the Data Controller is responsible: your first name and surname, your email address and whatever you write in your message. By providing this information, you consent to it being collected, used and kept by the Data Controller solely as described on the following pages:

• Legal Notice
• Privacy Policy

The personal data and the purpose of the processing by the Data Controller vary depending on the method of information collection:

• Contact form: The Data Controller requests your first name, surname, email address and message, for the purpose of responding to Users’ enquiries. The message is sent by email to the organisation’s mailbox (contacto@redestrail.com) and is not stored on the Website.
  For example, the Data Controller uses this data to respond to messages, doubts, complaints, comments or concerns that Users may have regarding the information included on the Website, the processing of personal data, matters relating to the legal texts included on the Website, as well as any other enquiry that the User may have and which is not subject to the conditions of the Website.

There are other purposes for which the Data Controller processes personal data:

• To ensure compliance with the conditions contained in the Legal Notice and with the applicable law. This may include the development of tools and algorithms that help the Website ensure the confidentiality of the personal data it collects.

• To support and improve the services offered by this Website.

• To manage social media. The Data Controller has a presence on social media platforms. If you become a follower on the Data Controller’s social media accounts, the processing of personal data will be governed by this section, as well as by the terms of use, privacy policies and access regulations belonging to the relevant social network and previously accepted by you.
  You can consult the privacy policies of the main social networks at the following links:

  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Instagram

  The Data Controller will process your personal data for the purpose of properly managing its presence on the social network, informing you of its activities, and for any other purpose permitted by the regulations of the social networks.

  Under no circumstances will the Data Controller use the profiles of followers on social media to send advertising on an individual basis.

06Security of Personal Data

To protect your personal data, the Data Controller takes all reasonable precautions and follows industry best practices to prevent its loss, misuse, improper access, disclosure, alteration or destruction.

The Website is hosted by Vercel, and the organisation’s email, where contact form messages arrive, by Hostinger. Both providers take the necessary security measures; you may consult their privacy policies for more information.

The Data Controller informs the User that their personal data will not be transferred to third-party organisations, except where such transfer is covered by a legal obligation or where the provision of a service requires a contractual relationship with a data processor. In the latter case, data will only be transferred to the third party when the Data Controller has the express consent of the User.

However, in some cases, collaborations may be carried out with other professionals. In such cases, the User’s consent will be required after informing them of the identity of the collaborator and the purpose of the collaboration. This will always be carried out under the strictest security standards.

07Content from Other Websites

Some pages show content from other websites: YouTube videos and Google Maps. This content behaves as if you were visiting the other website: it may collect data about you and use cookies. That is why it only loads if you accept cookies or click on it; until then, your browser does not connect to those companies.

The maps on the Where to Eat & Sleep, Redes Natural Park, SOT Skyrace and SST Speed Trail pages are different: the Website draws them itself with the OpenStreetMap base map, the aerial imagery and map of Spain's National Geographic Institute (IGN) and terrain data from Amazon Web Services (Terrain Tiles, open data). None of them installs cookies. To send those images, their servers receive your browser's IP address, as with any website you visit.

08Cookie Policy

This Website does not use its own analytics or advertising cookies. Which cookies are used, who they belong to and how to accept them, reject them or change your mind is explained in the Cookie Policy.

09Legal Basis for Data Processing

The legal basis for the processing of your data is:

• The consent of the data subject.
• The Data Controller's legitimate interest (GDPR, article 6.1.f) in measuring the Website's audience in aggregate form, using an in-house system without cookies that does not identify visitors, and in reporting the reach of their sponsorship to sponsors as aggregate figures.

10Categories of Personal Data

The categories of personal data processed by the Data Controller are:

• Identification data.
• No specially protected categories of data are processed.

11Retention of Personal Data

The personal data provided to the Data Controller will be retained until you request its erasure.

Visit measurement data, which cannot identify any individual, is kept for 13 months and then deleted. The random key used to count distinct visitors each day is destroyed after two days.

12Recipients of Personal Data

No data is disclosed to third parties unless required by law. The following providers are involved in running the Website:

• Vercel Inc. hosts the Website and the service that sends contact form messages; it receives the technical data of the visit (such as the IP address) and may keep technical logs for security purposes.

• Hostinger hosts the organisation's email, where contact form messages are received.

• Google Ireland Limited (YouTube and Google Maps), only if you accept cookies or click on a video or a map. More information in Google's Privacy Policy.

• OpenStreetMap Foundation provides the base map for the Where to Eat & Sleep map; it receives the IP address in order to send it and installs no cookies. More information in its privacy policy.

• National Geographic Institute of Spain (PNOA aerial imagery and map) and Amazon Web Services (terrain), for the maps on the Redes Natural Park, SOT Skyrace and SST Speed Trail pages; they receive the IP address in order to send those images and install no cookies.

• Turso, a database provider contracted through Vercel, stores the visit measurement data on a server in Dublin (European Union).

• Google Ireland Limited (Google Analytics 4), only if you accept cookies, for the organisation's statistics.

Sponsors receive reports with aggregate figures (for example, how many times their logo was seen or how many people clicked on it). Those reports contain no data about individual people and cannot identify anyone.

13Web Browsing

This Website measures its visits without cookies and without storing anything in your browser, using an in-house system. The purpose is to know which pages are of interest, where visitors come from and how many times sponsors' logos are seen, in order to improve the Website and report the reach of their sponsorship to sponsors.

For each page view the following is stored: the page, the language, the type of screen (mobile, tablet or computer), the website you came from (its domain only), the country and region reported by the server, how long the page was in view, how far you scrolled down it, which sponsor logos appeared on your screen and which links to other websites you clicked.

Your IP address is never stored. In order to count distinct people without identifying them, the server briefly combines your IP address and your browser with a random key, different each day, and stores only the result, which cannot be reversed; that key is destroyed after two days, so afterwards the data can no longer be linked to anyone. The next day the same person counts as a different fingerprint: the system does not track you across days or across websites, and it is not shared with anyone.

In addition, only if you accept cookies, the organisation also uses Google Analytics 4 (Google Ireland
Limited) as a second source of statistics: in that case Google installs its own cookies (_ga) and processes
data about the visit on the organisation's behalf. If you do not accept, the Website does not connect to Google
Analytics; if you withdraw consent, those cookies are deleted. More information in the Cookie Policy
and in Google's privacy policy.

If you do not want your visits to be counted, visit redestrail.com/?no-medir once: your browser will be marked and no further visit from it will be counted.

In addition, the server hosting the Website receives technical data about each request (IP address, date and time, page requested and browser), which is needed to display the page and protect it from abuse and is not used to identify you.

The Data Controller is not responsible for the processing of personal data carried out by websites that may be accessed through the various links contained on the Website.

14Accuracy and Truthfulness of Personal Data

You undertake that the data provided to the Data Controller is correct, complete, accurate and up to date, and you agree to keep it properly updated.

As a User of the Website, you are solely responsible for the truthfulness and accuracy of the data submitted to the Website, releasing the Data Controller from any liability in this regard.

15Acceptance and Consent

As a User of the Website, you declare that you have been informed of the conditions regarding the protection of personal data, and you accept and consent to their processing by the Data Controller in the manner and for the purposes indicated in this Privacy Policy.

In order to contact the Data Controller through this Website, you must accept this Privacy Policy.

16Changes to the Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy in order to adapt it to legislative or case-law developments, as well as to industry practices.

These policies will remain in force until they are amended by others duly published.