The purpose of this "Personal Data Processing Policy – AQUASPLASH" (hereinafter "Policy") is to inform you:
the processing of personal data carried out in connection with the use of the https://www.aquasplash.fr/en website and its possible subdomains (hereinafter the "Site");
processing of personal data being implemented as part of the operation of the AQUASPLASH park located at 306 Avenue Mozart, 06600 Antibes – France (hereinafter the "Park").
0. CONTENTS
I. Which companies are responsible for processing my personal data?
II. FOR WHAT REASONS AND ON WHAT BASIS DO YOU PROCESS MY PERSONAL DATA?
Management of the contractual relationship for the purchase or reservation of products and services
Management of customer service and possible complaints
Sending of commercial communications, including personalized ones, from the Data Controllers
Sending commercial communications, including personalized ones, from the entities of the Parques Registering Services SA group to which AQUASPLASH belongs
Sending satisfaction surveys
Basket management and retrieval
Prevention and detection of possible fraudulent activities
Compliance with the legal obligations incumbent upon the Data Controllers
III. How are the retention periods for my personal data determined?
IV. TO WHOM IS MY PERSONAL DATA DISCLOSED?
Recipients with the status of subcontractors
Recipients who are separate data controllers
VI. WHAT ARE MY RIGHTS REGARDING PERSONAL DATA?
VII. MINORS
I. Which companies are responsible for processing my personal data?
The companies responsible for processing ("Data Controllers") your personal data are:
The company "AQUASPLASH", which operates the AQUASPLASH water park and the ADVENTURE GOLF mini-golf course, and whose registered office is located at 2 route de la Brague, 06600 Antibes, France; and
The company "Parques Registering Services Centrales, S.A.", with registered office at C/Federico Mompou, 5, Business Park “Las Permanentes”, Building 1 – 3rd floor, 28050, Madrid, Spain
These two companies act as joint data controllers in the context of the data processing detailed in this Policy.
If you wish to obtain information additional to that contained in this Policy regarding the respective roles of the Data Controllers, you may request a copy of the key sections of the agreement concluded between the Joint Data Controllers, by writing to the Data Protection Officer (DPO) of Parques Registering Services Centrales, S.A.:
By mail to the following address: Data Protection Officer - Parques Registering Services, S.A. - C/Federico Mompou, 5, Business Park "Las Ush", Building 1 – 3rd floor, 28050, Madrid, SPAIN; or
II. FOR WHAT REASONS AND ON WHAT BASIS DO YOU PROCESS MY PERSONAL DATA?
The Data Controllers are required to process your personal data in accordance with the purposes defined below:
Management of the contractual relationship for the purchase or reservation of products and services
Description of the processing purpose
If you purchase tickets through the Site, we will process your personal data to manage your purchase, its proper payment and allow you to benefit from the product and/or service purchased. For this purpose, you may receive emails that are strictly necessary for the management of our contractual relationship (example: order confirmation email, email sending the purchased ticket, etc.) as well as any electronic communication aimed at informing you of any circumstances that may affect your visit (for example, weather conditions, safety, public health issues, etc.). During the purchase process, we may ask you for your date of birth to ensure that you are at least fifteen (15) years old. This information is necessary because, in accordance with the European legislation on data protection, if you are not older than fifteen (15) years old, we must obtain the consent of your parents/guardians to process your personal data. If you have purchased any product or service using promotions subject to specific conditions, please note that at the entrance of the parks, we may ask you to provide us with the corresponding documentation in order to verify compliance with these conditions (for example, large family card, identity card, etc.). In these circumstances, this additional information will not be kept by the Data Controllers; but will simply be subject to inspection.
If you subscribe to a Pass (subscription for all or part of the season), we will process your personal data to manage your purchase, issue your nominative card, and ensure the monitoring of our contractual relationship throughout its validity, including for managing any possible theft or loss of the Pass. Please note that in the context of subscribing to certain Passes, you may be required to provide us with the personal data of third parties (other family members, spouses, etc.). In these circumstances, you agree to inform such third parties of the provisions contained in this Policy regarding the processing of their data and obtain their consent for the Data Controllers to process such data.
Categories of processed data
Data collected through the Site’s ticket purchase form: last name, first name, email address, phone number, postal code, date of birth, payment method and transactional details of your purchase.
Specifically for Pass holders: identification data of the holders listed on the Pass (name, surname), age, photograph for issuing the nominative card.
Legal basis for the processing
This processing is based on the execution of the agreement concluded with you following your purchase of the product and/or service concerned (general terms of purchase). If you do not provide the required personal data, we will not be able to finalize your purchase.
This processing is based on the execution of the contract concluded with you following your subscription (general terms and conditions of the Pass).
Management of customer service and possible complaints
Description of the processing purpose
When you contact the AQUASPLASH customer service teams, by any of the available methods (phone, online form or email), the data controllers process your data in order to take your request into account, investigate the latter if necessary (example: incident) and respond to your request by any means, including electronically (by email or phone) to process your personal data. If your inquiry concerns a product, service or event you have purchased, we may also ask you (as part of the customer support process) for specific details about your purchase (transaction information, booking number, purchase date, type of product purchased, etc.) to ensure that your request is processed correctly.
Categories of processed data
As a customer of AQUASPLASH: nature of your request, content of our exchanges, last name, first name, email address, phone number, postal code, date of birth, payment method and transactional details of your purchase. When you are not a client of AQUASPLASH: nature of your request, content of our exchanges, name, first name, email address, phone number.
Legal basis for the processing
As a customer of AQUASPLASH: this processing is based on the execution of the agreement concluded with you following your purchase of the product and/or service concerned (general terms of purchase). When you are not a customer of AQUASPLASH: this processing is based on the legitimate interests of the Data Controllers to respond to your request.
Sending of commercial communications, including personalized ones, from the Data Controllers
Description of the processing purpose
Your data is used for the purpose of sending you by email information about products and services promoted by the Data Controllers. When you are a customer of AQUASPLASH, the data collected as part of the "Management of the contractual relationship for the purchase or reservation of products and services," as well as the data collected through cookies and other trackers (See Cookies Policy for details) may be used to send you personalized communications tailored to your purported interests. In order to determine what types of content you are likely to enjoy, the Data Controllers analyse and predict your personal interests and preferences. This operation is referred to as "profiling" by the GDPR.
Categories of processed data
As a customer of AQUASPLASH: history of your transactions, browsing data, and data processed within the scope of "Management of the contractual relationship for the purchase or reservation of products and services". When you are not a customer of AQUASPLASH: email, last name, first name and navigation data.
Legal basis for the processing
On the basis of your consent, which you can express in different ways: by proactively checking the boxes for receiving commercial information from Data Processors via the ticket purchase form on the Site; By proactively subscribing to the Site’s newsletter; etc.
Sending commercial communications, including personalized ones, from the entities of the Parques Registering Services SA group to which AQUASPLASH belongs
Description of the processing purpose
Your data is transmitted to the entities of the Group Parques Registering Services SA to which AQUASPLASH belongs so that they send you, in their capacity as responsible for separate and autonomous processing, commercial information by email about their products and services.
Categories of processed data
As a client of AQUASPLASH: last name, first name, contact details
Legal basis for the processing
On the basis of your consent, which you can express by proactively checking the box for receiving commercial communications from entities of the Parques Registering Services SA group to which AQUASPLASH belongs, within the ticket purchase process on the Site.
Sending satisfaction surveys
Description de la finalité de traitement
Si vous achetez l'un de nos produits ou services, les Responsables du traitement vous enverront des enquêtes par tout moyen, y compris électronique (courrier électronique, SMS, appels téléphoniques), afin : D’obtenir des informations sur votre degré de satisfaction à l'égard de nos produits et/ou services ; D’obtenir des informations sur votre expérience ; De permettre aux clients de faire des suggestions et de nous permettre de réaliser des études et des analyses de marché (quantitatives et qualitatives) pour connaître notre positionnement dans le secteur et la probabilité que nos clients achètent à nouveau nos produits et/ou services. Les Responsables du traitement traiteront, de manière stricte, les données nécessaires à l'accomplissement de ce processus : adresse électronique ou numéro de téléphone, et toute information non personnelle recueillie dans les enquêtes auxquelles vous avez répondu. À cette fin, les Responsables du traitement traiteront les données à caractère personnel qui sont strictement nécessaires à cet effet, notamment votre adresse électronique ou votre numéro de téléphone que vous avez fournis au moment de votre achat et les informations non personnelles figurant dans les enquêtes auxquelles vous avez répondu.
Catégories de données traitées
Réponses apportées à l’enquête, nom, prénom, coordonnées, code postal, date de naissance, historique de vos achats.
Base légale sur laquelle repose le traitement
Sur la base des intérêts légitimes des Responsables du traitement à obtenir l’avis de ses clients en vue de permettre l’amélioration de la qualité de service et identifier les actions pouvant permettre de mieux répondre aux besoins des potentiels clients des Responsables du traitement. Nous estimons que ce traitement ne porte pas atteinte aux intérêts, aux libertés et aux droits fondamentaux des personnes concernées, dans la mesure où ces enquêtes concernent des produits achetés par nos clients, qu’ils sont informés de ce traitement et que seuls des clients ayant récemment acheté nos produits et/ou services sont concernés ; de sorte à ce que nos clients peuvent avoir des attentes raisonnables concernant le traitement de leurs données personnelles à cette fin.
Basket management and retrieval
Description of the processing purpose
If you use the "save and send cart by email" feature through the pop-up dedicated to this feature that appears during the online purchase process in case of inactivity on your part, your personal data is processed so that, if you do not complete the purchase or reservation of products and services previously selected by you, the Data Processors may send you an email reminder to complete your purchase. If you do not complete the purchase or reservation of these products and services, we will send you a brief inquiry by email to find out why you do not wish to make the purchase or reservation, which will help us improve the experience of our future clients.
Categories of processed data
Email, cart content
Legal basis for the processing
On the basis of your consent, which you can express by voluntarily activating the "save and send shopping cart by email" feature on the Site.
Prevention and detection of possible fraudulent activities
Description of the processing purpose
In the context of online purchases made via the Site, the Data Controllers may process your data to detect and prevent misuse of the Site and/or abnormal activities that could constitute potential fraud. In case of detection of abnormal activities related to the payment of products and services, the Data Controllers may communicate information relating to the transaction in question and the identification data of the person who carried it out to the payment provider used to enable payments on the Site, to the payment provider used to enable payments via the Site and, where appropriate, to the competent public authorities so that the relevant measures can be adopted in each case.
Categories of processed data
Only for people making purchases via the Site: transactional information, payment information and contact details provided during possible fraudulent purchase processes.
Legal basis for the processing
On the basis of the legitimate interests of the Data Controllers to protect the Site against fraudulent or illicit activities. We believe that this processing does not harm the interests, freedoms and fundamental rights of data subjects, to the extent that we implement strict measures aimed at ensuring that only individuals with abnormal and potentially fraudulent or illegal behaviors are affected by this processing. In addition, such processing benefits the company in general in order to ensure better security of data processed via the Site.
Compliance with the legal obligations incumbent upon the Data Controllers
Description of the processing purpose
Your personal data is processed for the purpose of enabling, where justified, compliance with the regulatory obligations incumbent upon the Data Controllers. These may include : Tax and accounting obligations imposed on Data Controllers in the context of the sale of products and services; Respect for the rights of individuals (response to requests to exercise rights) ; Applicable regulations on the protection of users and consumers ; Etc.
Categories of processed data
Only the data strictly necessary for compliance with the relevant regulatory obligation is processed, among the aforementioned data in the previous tables.
Legal basis for the processing
Legal obligation.
In addition to the aforementioned purposes, additional personal data may be collected and processed by the Data Controllers and/or third parties through cookies and other trackers. To understand how these technologies are used and what their effects are, we invite you to visit our Cookie Policy.
III. How are the retention periods for my personal data determined?
The Data Controllers have determined and implemented measures to ensure that your personal data are processed for a period no longer than is necessary in view of the purposes for which they are processed. At the end of these periods, a purge and/or anonymization of the personal data processed is carried out by the Data Controllers, without the need for any proactive action on the part of the persons concerned.
The table below lists the retention periods for personal data determined and implemented by the Data Controllers according to the situation concerned:
Persons affected by the deletion measure
AQUASPLASH customers
Customers of AQUASPLASH who have made a payment by credit card on the Site
Persons not clients of AQUASPLASH who have consented to receive commercial information from the Data Controllers
People responding to surveys and polls
People who have enabled the "save and send cart by email" feature
People who made a request to AQUASPLASH customer service
Personal data concerned by the deletion measure
All the data related to the client
Credit card number used for payment and its expiration date
All the data processed about the person
Survey responses and polls
All the data processed in order to allow the operation of this feature
All data related to the request of the person concerned.
Duration after which the personal data is deleted
5 years from the last purchase made by the customer and/or the expiry date of the Pass. As an exception to the above, invoices for ticket and Pass sales made via the Site are kept for 10 years following their issuance in accordance with the regulatory obligations incumbent on AQUASPLASH.
The bank details required for payment are kept until receipt of the goods ordered, plus the withdrawal period. By way of derogation, the card number and validity date are deleted at the end of a period of 13 months, following the debit date or 15 months in the case of deferred payment cards; for the purpose of processing transaction disputes and complaints. Data processed for "Prevention and detection of potential fraudulent activities" are processed until the identified anomalous activities are resolved.
3 years from the last contact made by the person. Is considered as a "last contact from the person" : A click on a hyperlink contained in an email sent by the Data Controllers to the person; or A proactive request made by the person concerned to the Data Controllers.
1 year after the response to the survey and/or poll
30 days after using the "save and send cart by email" feature
1 year after the closing of the received request.
In the context of certain exceptional situations, your data may be kept beyond these periods (in a non-exhaustive manner: in the context of litigation, when ordinary and extraordinary remedies are no longer available against the decision rendered; for the purpose of complying with certain legal obligations incumbent on Data Controllers; at the request of an authority legal, etc.).
IV. TO WHOM IS MY PERSONAL DATA DISCLOSED?
Recipients with the status of subcontractors
In order to ensure the proper functioning of the Site, the Data Controllers rely on specialized service providers. In this context, your personal data is also processed by these specialized service providers (statutorily qualified as "subcontractors" of Data Controllers), acting only on instructions from the Data Controllers.
These data processors do not determine the essential purposes and means of processing your personal data: they process your personal data only on behalf of the Data Controllers. The main types of processors used by Data Controllers are:
Data Hosts;
Outsourcing and IT security companies;
Software Publishers;
Email and SMS routing providers;
Etc.
In order to protect your personal data, the Data Controllers only use subcontractors who offer robust security and compliance guarantees. A legal act systematically governs the relationship between one of the Data Controllers and its subcontractors.
Recipients who are separate data controllers
The Data Controllers place great importance on not disclosing your personal data to third parties. This is why the transmission of your data to third parties, acting as data controllers, is strictly limited to the following situations:
When you consent to receive personalized commercial communications from the entities of the Parques Registering Services SA group to which AQUASPLASH belongs, your personal data is transmitted to the following entities:
The Spanish companies belonging to the Parques Registering group:
Parque Harris, S.A. (Bono Parques); Parque de Enrique Madrid, S.A.U. (Park of Attractions Madrid); Madrid Theme Park Management, S.L.U. (Park Warner and Park Warner Beach); Parque Warner, S.L.U. (Park Warner and Park Warner Beach); Parque Warner, S.L.U. (Parque Warner and Parque Warner Beach). (Parque Warner and Parque Warner Beach) ; Gestión Parque de Animales Madrid, S.L.U. (Faunia); Zoos Ibericos, S.A. (Zoo Aquarium Madrid); Parques de la Información Selwo, S.L. (Selwo Aventura and Hotel Selwo Lodge); Aquópolis Cartaya, S.L.U. (Aquópolis Cartaya); Leisure Parks, S.A. (Aquópolis de Villanueva de la Frontera) ; Aquópolis de Villanueva de la Frontera, S.A. (Aquópolis de Villanueva de la Frontera); Leisure Parks, S.A. (Aquópolis de Villanueva de la Frontera). (Aquópolis de Villanueva de la Cañada, Aquópolis Costa Dorada - Vilaseca, Costa Dorada-, Delfinario Costa Dorada - Vilaseca, Costa Dorada, Selwo Marina, Aquópolis de Cullera, Aquópolis de Torrevieja, Teleférico de Benalmádena) ; Mall Entertainment Centre Acuario Arroyomolinos, S.L.U. (Atlantis Aquarium); Travelpark Viajes, S.L.U. (products and services related to joint entry packages in parks and leisure centers of the Parques Registering group in Europe and hotel reservations).
Other companies in the rest of Europe of the Parques Registering Group:
Italy - Parco della Standiana S.R.L. (Mirabilandia and Mirabeach) and Travelparks Italy, S.R.L.; Norway - Tusenfryd A/S (Tusenfryd) and Bø Sommarland AS (Bo Sommarland); Belgium - Bobbejaanland, B.V.B. (Bobbejaanland, B.V.B.). A (Bobbejaanland); BonBon-Land A/S (BonBon-Land); Germany - Movie Park Germany GmbH and Movie Park Germany Services GmbH (Movie Park), Nature Park Germany GmbH (Vogelpark Walsrode), Tropical Island Management (Tropical Island) and TI Hotel Asset GmbH (Tropical Island Hotels) ; Netherlands - Attractie- en Vakantiepark Slagharen B.V. (Slagharen and Slagantiepark Slagharen B.V.). (Slagharen and Slagharen Beach) ; AQUASPLASH Resort SAS (SoBlue Hotel); England - Grant Leisure Group LTD (Blackpool Zoo), Real Live Leisure Company LTD (The Bournemouth Aquarium and Aquarium of the lakes) and Lakeside Mall Entertainment Centre Limited (Nickelodeon Adventure-Lakeside).
These companies are all located in the European Union and their main activities are the management and operation of amusement parks, water parks, zoos, aquariums, leisure centres and travel agency activities.
IV. TO WHOM IS MY PERSONAL DATA DISCLOSED?
Under the regulatory provisions, you have rights over your personal data:
A right of access to your personal data (right to obtain from the Data Controllers confirmation as to whether or not your personal data is being processed by us, information relating to the processing carried out and access to said personal data);
A right to rectify your personal data that proves to be inaccurate;
A right to erasure of your personal data. This right is subject to certain grounds detailed within Article 17 of the GDPR;
A right to limit your personal data. This right is subject to certain grounds detailed in Article 18 of the GDPR;
A right to the portability of your personal data (the right to receive the personal data concerning you and/or that you have provided to the Data Controllers in a structured, commonly used and machine-readable format). This right is subject to certain requirements detailed in Article 20 of the GDPR;
A right to object to the processing operations carried out. This right is subject to certain requirements detailed in Article 21 of the GDPR;
A right to determine the fate of your data after your death and to choose whether or not the Data Controllers disclose your data to a third party that you have previously designated.
Finally, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) regarding the processing of your personal data. We encourage you to contact the Data Controllers before submitting any complaint so that we can respond to your requests and expectations.
Exercise your rights by writing to the DPO of AQUASPLASH:
To exercise your rights, you can make a free request at the following contact details:
by postal mail at the following address: AQUASPLASH/ADVENTURE GOLF - Data Protection Officer - 306 av Mozart – 06600 Antibes, FRANCE
You are also informed, in accordance with Article 13-1, b) of the GDPR, that the entity Mon DPO externe is designated as a Data Protection Officer ("DPO") with the National Commission on Informatics and Liberties, on behalf of the entity AQUASPLASH. You can contact the DPO directly via the contact form available on their website.
Exercise your rights by writing to the DPO of Parques Registering Services Centrales, S.A. in:
To exercise your rights, you can make a free request at the following contact details:
by email to the following address: dpo@grpr.com; or
By mail to the following address: Data Protection Officer - Parques Registering Services, S.A. - C/Federico Mompou, 5, Business Park “Las Ush”, Building 1 – 3rd floor, 28050, Madrid, SPAIN
With regard to processing based on obtaining your consent, we inform you that you can at any time withdraw it by writing to the aforementioned contact details and/or by using the opt-out features included in the communications sent to you on the basis of your consent.
VII. MINORS
Minors under fifteen (15) years of age are not allowed to purchase or reserve the products or services offered on the Site.
Notwithstanding the foregoing, if, as a result of purchasing or booking any of the products or services offered on it, you freely and voluntarily decide to provide the personal data of a minor under fifteen (15) years old as the holder of parental authority or legal guardian of the minor, you must give your express and informed consent for the Data Controllers to process the minor’s personal data within the framework of the contractual relationship maintained with you following the purchase or subscription of said products or services, in accordance with the provisions of this Policy.
