Privacy Policy

Data Processor

Company Name: Kube Ecosystem S.L. (from now on, FLYKUBE)

NIF: B67040998

Postal Address: Gran Via 415, 08015, Barcelona, Spain

Correo electrónico: privacy@flykube.com

FLYKUBE, as the Data Processor for the Website, in accordance with the provisions of Regulation (EU) 2016/679 of April 27, 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and the free movement of this data and other current regulations on the protection of personal data, and by Law 34/2002, of July 11, Services of the Information Society and Electronic Commerce (LSSICE), informs you that we have implemented the measures of necessary security, of technical and organizational nature, to guarantee and protect the confidentiality, integrity and availability of all entered data.

PURPOSE OF PERSONAL DATA PROCESSING

• - We use your information (and that of those who travel with you) to make the reservations that you request through the means that our company enables for this purpose. This is applicable to any of the models offered by our company: Destino sorpresa, Multidestino, Verano Sorpresa, Vipkube, Todo Sorpresa.
• - We also arrange packages so that users may offer access and reservation through our website to third parties.
• - If you choose to receive marketing communications, we will inform you of any special offers that could be of interest. You may unsubscribe from these promotional communications at any time.
• - We use the information we gather, like cookies, to improve the browsing experience with the Online Services; analyze data to generally improve our Services and collect information about the travel destinations that interest you, so that you recieve relevant announcements and offers.
• - From time to time, and normally after an interaction with us, we will ask you to send us feedback to ensure that we are providing services that meet your expectations.

Your personal data will only be used for the following purposes:

• - To carry out the necessary commercial and administrative procedures with Web Users;
• - To respond to queries and/or provide information requested by the User;
• - To carry out the provision of services and/or products contracted or subscribed to by the User
• - To use your data to contact you, both electronically and non-electronically, to obtain your opinion about the service provided and,
• - To notify you about changes, important developments of the privacy policy, legal notices or cookies policy.
• - Analysis of profiles and usability will be carried out.
• - Client and/or suppliers data will be processed, within the contractual relationship that links them with the person in charge, in compliance with the administrative, fiscal, accounting, and working obligations that are necessary under the current legislation.

You can revoke your consent at any time by sending a letter with the subject “UNSUBSCRIBE” to privacy@flykube.com.

In accordance with LSSICE, FLYKUBE does not partake in SPAM practices, therefore, it does not send commercial emails that have not been previously requested or authorized by the User. Consequently, in all the communications that you will receive from the provider, the User has the possibility of canceling his or her express consent to receive our communications.

We will not use your personal data for any other purpose than those described except by legal obligation or judicial requirements.

DATA RETENTION POLICIES

Your data will be kept for the duration of the commercial relationship with us or until you exercise your right to cancellation or opposition, or limitation to processing. However, we will keep certain personal identification and traffic data for a maximum period of 2 years in case it is required by the Judges and Courts or to initiate internal actions derived from the improper use of the website.

Likewise, we inform you that our data retention policies comply with the terms established by the different legal provisions regarding legal expiry terms:

• a) General Rule:

By virtue of the provisions of article 30 of the Commercial Code, and except for other criteria, all the documents and / or information of the company will be kept for 6 years.

This affects all accounting, tax, labor or commercial documentation, including mail.

• b) Specific terms:

Our company must also set a minimum retention time depending on the type of data in question and according to the different legal prescription periods, which must be known by each of the departments.

This table lists the retention terms that affect or may affect our organization:

Your data will not be subject to decisions based on automated processing.

LAWFULNESS OF PERSONAL DATA PROCESSING

• a) Execution of the contract.
• b) Consent of the interested party.
• c) Compliance with legal obligations.
• d) Legitimate interest: sending our own promotions.

COMMUNICATIONS

Any communication sent will be incorporated into the Information Systems of FLYKUBE. By accepting these conditions, terms, and policies, the User expressly consents to FLYKUBE carrying out the following activities and/or actions, unless the User indicates otherwise:

• - The sending of commercial and/or promotional communications by any means enabled informing the Users of the activities, services, promotions, advertising, news, offers, and other information about the services and products related to the activity.
• - In the event that the User has expressly consented to the sending of commercial communications electronically by subscribing the NEWSLETTER, the sending of such communications by electronic means informing the Users of the activities, services, promotions, advertising, news, offers, and other information about the services and products of FLYKUBE equal or similar to those that were originally the aim of the contract or interest by the User.
• - The storage of personal data during the periods provided in the applicable provisions.

OFFICIAL MEANS OF COMMUNICATION

The User is informed that the means enabled by the company to communicate with customers and others affected are the corporate phone, corporate mobile phones, and corporate email.

If you send personal information through a means of communication other than those indicated in this section, the PROVIDER will be exempt from liability in relation to the security measures available regarding the medium in question.

ASSIGNMENTS OR TRANSFERS RECIPIENTS

FLYKUBE will carry out data transferring or communication to third parties that will process data within the EU. Nevertheless, there will not be any international transferring of data outside these boundaries. The User expresses hereby the consent of such transferring of data limited to the purpose stated in this document.

FLYKUBE will hand out data information to the authorities and to the police if there is a need to comply with a legal procedure, legal obligation, without prejudice of blocking or cancelling an account if there are signs of criminal offence. The information handed to the authorities in such an event will only regard the current information stored by the service provider.

The information that you provide us both through this website and through the application will be hosted on the servers of FLYKUBE.

Many tools we use to manage your data are contracted to third parties.

RIGHTS OF CONCERNED INDIVIDUALS

As a concerned User, you can request to exercise the following rights before FLYKUBE by submitting a letter to the postal address located in the letterhead or by sending an email to privacy@flykube.com, indicating as Subject: "GDPR, Rights affected", and attaching a photocopy of your National Identity Document (DNI) or any analogous document, as indicated by law.

Rights:

• Access rights: allows the interested party to acknowledge and obtain information about their personal data submitted to processing.
• Right to rectification or deletion: it allows to correct errors and modify the data that proves to be inaccurate or incomplete.
• Right to cancellation: allows data that turns out to be inadequate or excessive to be deleted.
• Right to opposition: the right of the interested party to not carry out the processing of their personal data or to cease it.
• Limitation of personal data processing: involves the marking of personal kept data, with the purpose of limiting its’ future processing.
• Portability of the data: facilitation of the data subject to processing to the interested party, so that he or she can transmit it to another person in charge, without impediments.
• The right not to be subject to automated individual decisions (including the elaboration of profiles):the right not to be the subject of a decision based on automated processing that produces effects or significantly affects the User.

As a User, you have the right to withdraw consent given at any time. The withdrawal of consent will not affect the lawfulness of the process carried out before the withdrawal of consent.

You also have the right to submit a claim to the supervisory authority if you believe that your rights may have been violated in relation to the protection of your personal data ( agpd.es).

ADDITIONAL INFORMATION

INFORMATION WE COLLECT:

The data collected by data controller is the following:

• - Data provided by the users through the different services offered on the website.
• - Data included in the different forms provided on the website.
• - Data collected through "cookies" to improve the browsing experience as reported in the cookie policy.
• - We engage collected data into profiles and usability analytics to improve the User’s experience through our platform.
• - Data provided by the customers receiving the services, by any means.

Through this Privacy Policy we inform you that the photographs that are posted on the website are property of FLYKUBE, including those of minors, of which, in order to obtain these, prior consent of the parent, tutors, or legal representatives has been obtained by signing the forms made for that purpose by the centers in which matters regarding minors are regulated.

VIDEO SURVEILLANCE

In some vending point footage is captured for the sole purposes indicated in this Privacy Policy and / or at the request of the legal authorities.

We have informational documentation available at the request of anyone interested and a signal warning of the video-monitoring area ,located in a visible place prior entering the surveillance range to inform that the venue is a video-surveilled location.

All footage captured by the surveillance cameras will be limited to the inside of the establishment. No images of public roads will be captured except for a minimum strip of access to the venue.

The recording system will be located in a guarded or restricted access place. The images obtained will be accessed only by authorized personnel and will be kept for a maximum period of one month from their capture.

SOCIAL NETWORKS

We inform you that FLYKUBE may have a presence on social networks. The processing of data that is carried out concerning the people who become followers on social networks (and/or carry out any link or connection action through social networks) of the official pages of FLYKUBE will be governed by this section, as well as those conditions of use, privacy policies, and access regulations that belong to the social network that is appropriate in each case and previously accepted by the User.

FLYKUBE will process your data with the purpose of correctly managing your presence on social networks, informing you of the provider's activities, products, or services, as well as for any other purpose that the regulations of the social networks allow.

The publication of the following content is prohibited:

• - That is unlawful by national, community, or international regulations or that they carry out activities that are presumably unlawful or contravene the principles of good faith.
• - That threaten the fundamental rights of people, lack courtesy in the network, annoy or may generate negative opinions to our Users or third parties and in general whatever the content that FLYKUBE deems inappropriate.
• - In general that contravene the principles of legality, honesty, responsibility, protection of human dignity, protection of minors, protection of public order, protection of privacy, consumer protection, and intellectual and industrial property rights.

Likewise, FLYKUBE reserves the right to remove, without notice from the website or the corporate social network, those contents deemed inappropriate.

Communications sent through social networks will be incorporated into a file owned by FLYKUBE, and may send you information of interest.

You can access more information, as well as consult the companies that are part of FLYKUBE, through the following link: https://www.flykube.com/privacy-policy

In any case, if you send personal information through the social network, FLYKUBE will be exempt from liability in relation to the security measures applicable to this platform, which is the Users’ responsibility to know, by checking the corresponding conditions particular to the network in question.

SECURITY MEASURES:

The information you provide will be processed confidentially. The Provider has adopted all the technical and organizational measures and all the levels of protection necessary to guarantee the security in the processing of the data and to avoid its alteration, loss, theft, processing or unauthorized access, according to the state of technology and nature of the stored data. Likewise, it is also guaranteed that the processing and registration in files, programs, systems or equipment, premises and centers comply with the requirements and conditions of integrity and security established in the current regulations.

LANGUAGE

The language applicable to this Privacy Policy is English. Therefore, in case there is any contradiction in any of the versions provided in other languages, the English version will have prevalence.

SENDING OF CV

In the event that the User submits his or her CV through any means established by FLYKUBE, we inform you that the information provided will be processed to make him or her participant in the selection processes that may exist, carrying out an analysis of the applicant's profile in order to select the best candidate for the vacancy of the Company (Provider). We inform you that this is the only official procedure to accept your CV, so CVs submitted by another procedure will not be accepted. In case of any change in the data provided, please inform us in writing as soon as possible, in order to keep your data properly updated.

The data will be kept for a maximum period of one year, after which the data will be deleted guaranteeing a total respect to confidentiality both in the processing and in its subsequent destruction. In this sense, after the aforementioned deadline, and if you wish to continue participating in the selection processes of the Company (Provider), please re-submit your CV.

The data may be processed and/or communicated to the member companies of our group during the time of conservation of their curriculum and for the same purposes previously reported.

FlyKube Meet

1. Data collected

When you use FlyKube Meet, we may process: display name, biography, vibra tags, date of birth and gender; approximate location data (geohash at neighbourhood or city level - precise GPS coordinates are not stored in the Meet database); plan data you create or join; and chat message ciphertext for user-to-user messages. System messages necessary to operate chat (such as join or leave notices) may be processed in plaintext.

2. Legal bases

We process Meet data on the following bases under the GDPR: consent (Article 6(1)(a)) for presence and location sharing; legitimate interests (Article 6(1)(f)) for operating profiles, plans and safety/moderation features; and performance of a contract (Article 6(1)(b)) for Grupo Sorpresa bookings that proceed to a paid FlyKube travel booking.

3. Retention

Presence pings expire automatically after 15 minutes and are then deleted. Profile data is retained until you delete your account or remove your Meet profile. Chat ciphertext is retained until the relevant conversation or messages are deleted; FlyKube does not operate on the plaintext of end-to-end encrypted user messages. Plan data is retained while the plan is active and for a limited period after completion as needed for safety, customer support and fraud prevention, after which it is deleted or anonymised.

4. Location specifics

Location sharing is opt-in and may be revoked at any time from Meet settings (including off-radar). We do not sell personal data. We do not share precise GPS coordinates from Meet with third parties. Other Meet users see only approximate presence information according to product rules and your settings.

5. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent for presence/location at any time without affecting the lawfulness of processing based on consent before its withdrawal. To exercise Meet-related rights, contact privacy@flykube.com or use account deletion / Meet profile controls where available. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

6. Third parties

Your Meet profile and plan participation may be visible to other Meet users according to the product rules and your settings. Venue search may use Google Places; Google's privacy policy applies to data processed by Google in that context. We do not sell your personal data.

7. Children

FlyKube Meet is strictly for users aged 18 or over. Date of birth is used to enforce the age gate. We do not knowingly allow minors to use Meet.

CHANGES IN THE PRESENT PRIVACY POLICY

FLYKUBE reserves the right to modify this policy to adapt it to new legislation or jurisprudence dispositions (case law).

LEGISLATION

For all purposes, the relationship between FLYKUBE and the Users of its telematic services, present on this Website, are subject to the Spanish legislation and jurisdiction to which the parties expressly submit to.

PRIVACY POLICY FOR FLYKUBE USER ZONE

Introduction

Welcome to FlyKube! We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

Important Information and Who We Are

Purpose of this Privacy Policy

This privacy policy aims to give you information on how FlyKube collects and processes your personal data through your use of this website, including any data you may provide through this site when you sign up, book a trip, or purchase a service.

Controller

FlyKube is the controller and responsible for your personal data (collectively referred to as “FlyKube”, “we”, “us”, or “our” in this privacy policy).

The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier, marital status, title, date of birth, and gender.
• Contact Data: includes billing address, delivery address, email address, and telephone numbers.
• Financial Data: includes bank account and payment card details.
• Transaction Data: includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data: includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
• Usage Data: includes information about how you use our website, products, and services.
• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

How is Your Personal Data Collected?

We use different methods to collect data from and about you including through:

• **Direct interactions:**You may give us your Identity, Contact, and Financial Data by filling in forms or by corresponding with us by post, phone, email, or otherwise. This includes personal data you provide when you:
  • Create an account on our website;
  • Subscribe to our service or publications;
  • Request marketing to be sent to you;
  • Enter a competition, promotion, or survey;
  • Give us feedback or contact us.
• Automated technologies or interactions: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies.
• **Third parties or publicly available sources:**We may receive personal data about you from various third parties and public sources such as:
  • Analytics providers such as Google based outside the EU;
  • Advertising networks;
  • Search information providers;
  • Contact, Financial, and Transaction Data from providers of technical, payment, and delivery services;
  • Identity and Contact Data from data brokers or aggregators;
  • Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register based inside the EU.

How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To register you as a new customer.
• To process and deliver your order including:
  • Manage payments, fees, and charges.
  • Collect and recover money owed to us.
• To manage our relationship with you which will include:
  • Notifying you about changes to our terms or privacy policy.
  • Asking you to leave a review or take a survey.
• To enable you to partake in a prize draw, competition, or complete a survey.
• To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data).
• To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.
• To use data analytics to improve our website, products/services, marketing, customer relationships, and experiences.
• To make suggestions and recommendations to you about goods or services that may be of interest to you.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Legal Rights

You have the right to:

• Request access to your personal data.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.
• Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact us.

Contacting Us

If you have any questions about this privacy policy or our privacy practices, please contact us in the following ways:

• Email: privacy@flykube.com
• Postal Address: Calle Ferrocarriles Catalanes 39, 08038 Barcelona, Spain.

This policy is in line with the General Data Protection Regulation (GDPR) and other relevant legislation. We keep our privacy policy under regular review and place any updates on this web page.

Official version: https://flykube.com/en/privacy-policy