Privacy Policy

Madrid Web Roll"

Privacy Policy

Terdik Tibor, sole proprietor, operating under the name ROLLIO DE MADRID, registered as a travel agency, offering intermediary services, as well as the organization of day trips and excursions aimed at carrying out various cultural and gastronomic activities, for which it is necessary to process the personal data of users or clients, and in compliance with our information obligations, we have developed the following privacy policy, which aims to provide you with all the information you need to understand the scope and purpose of data processing carried out by us at the travel agency.
All of this is so that the data processing we carry out is based on perfectly informed consent, as required by Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

The obligation to provide data

The data requested on the website's forms are generally mandatory (unless otherwise indicated in the mandatory field) in order to fulfill the purposes for which they are collected.
Therefore, if the User does not provide them, or provides them incorrectly, the User's requests cannot be fulfilled without prejudice to their right to freely view the contents of the Website.

The user's responsibility

The User guarantees that they are over fourteen (14) years of age and that the data provided to ROLLIO DE MADRID is true, accurate, complete, and up-to-date. For this purpose, the User is responsible for the veracity of all data communicated and for keeping the information provided duly updated, so that it corresponds to their actual situation.
Likewise, you guarantee that you have informed any third parties whose data you provide – if you do so – about the considerations set forth in this document. Furthermore, you guarantee that you have obtained their consent to provide their data to ROLLIO DE MADRID for the stated purposes.

What is the source and category of the data?

The personal data we process originate from the information you provide us when you establish any type of contact with us, whether it is directly provided by the User through the various forms on the Website, as well as data obtained from your browsing on the Website through cookies or data storage and retrieval devices, and also information extracted from the User's mobile device, taking into account any consents you have given to ROLLIO DE MADRID.
In cases where a person other than the User provides personal data relating to third parties (for example, to manage reservations, include companions, or make purchases on behalf of others), that person guarantees that they have the necessary authorization to provide this information and that they have previously informed the data subjects of the purpose for which they will be transmitted to ROLLIO DE MADRID. In these cases, the responsibility arising from the veracity, accuracy, and legality of the data lies exclusively with the person who provides it.
The categories of data we process are general, such as your identification data; full name, email/postal address, and telephone number, ID card/passport or any other document proving the traveler's identity, if this is necessary for the provision of the ordered service; economic data after the formalization of the contract.
We handle all personal data confidentially in accordance with the data protection and security policies implemented by ROLLIO DE MADRID.

Who is the controller of your data?

The data controller is TERDIK TIBOR, under the commercial name ROLLIO DE MADRID, with tax identification number (N.I.F.) Z3360877F, and registered office at Calle San Leandro 2, 30383 Murcia, Spain. You can contact us by letter at our postal address indicated in this same paragraph, or via email at info@rolliodemadrid.com and complain@rolliodemadrid.com.

For what purpose do we process personal data?

A ROLLIO DE MADRID ensures the processing of personal data provided by users for the following purposes:
We collect strictly necessary data for the development, implementation, and fulfillment of the ordered service.
Any communication channel provided by the Users for this purpose between the Users and ROLLIO DE MADRID, including email, landline or mobile phone, and instant messaging services, as these are authorized channels for communicating any relevant information, changes, or notifications relating to the services ordered.
To handle the capture, use, and publication of images (photographs and/or videos) on which customers and, where applicable, employees may appear for promotional and corporate communication purposes, in all cases with the prior, express, and informed consent of the individuals concerned.
Handle inquiries received through any contact method permitted by the office. In cases where the individual has contacted ROLLIO DE MADRID solely to request information about the services offered, their data will be processed for the purpose of fulfilling their requests or inquiries regarding the services provided. ROLLIO DE MADRID will only process personal data that is strictly necessary to handle or resolve the request or inquiry.
For commercial purposes, the data subject, who is an actual client of ROLLIO DE MADRID, may receive news about similar products also offered by ROLLIO DE MADRID. However, we inform the client that they may object to this at any time by contacting ROLLIO DE MADRID through the already indicated channels.
To manage the data of website users collected through cookies, which we process to ensure that the website content is tailored to their needs and those of their devices, and to continuously improve the user experience.
A ROLLIO DE MADRID does not perform profiling.
Inclusion in A ROLLIO DE MADRID's own instant messaging application groups: managing contact with the User through their inclusion in instant messaging groups (such as WhatsApp) created to coordinate, inform, or manage activities related to the services ordered.

What is the legal basis for your data processing?

The legal bases for processing your data are as follows:
Management of pre-contractual and, where applicable, contractual measures based on Article 6(1)(b) of the GDPR, as we collect and process your personal data primarily for the fulfillment of contracts, in accordance with the terms and conditions therein. In cases where, directly or through professionals associated with ordering the services, additional personal data that may relate to your health status is provided to ROLLIO DE MADRID for the proper provision of the requested service (e.g., information on allergies, food intolerances, or similar conditions), the legal basis for data processing will be your consent.
Handling questions asked through the communication channels provided for customer communication. This data processing is based on Article 6(1)(f) of the GDPR, which is the legitimate interest of ROLLIO DE MADRID to fulfill incoming information requests.
The legal basis for processing images of customers and, where applicable, employees, as well as images voluntarily provided by customers, is the explicit, informed, and voluntary consent of the data subjects, given before their image is used for promotional and corporate communication purposes. Data subjects may withdraw their consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Sending commercial communications to Users: the legal basis for data processing for this purpose is the consent obtained, which the User can withdraw at any time.
Sending commercial communications to ROLLIO DE MADRID clients' Users: the legal basis for data processing for this purpose is the legitimate interest, based on the exception provided in Article 21.2 of Law 34/2002 of July 11, on information society services and electronic commerce, and what is established in recital 47 of the GDPR. The legitimate interest is based on direct marketing, in order to offer the client's User products and services that may be of interest to them and thus achieve their loyalty. Nevertheless, the User has the right to object to this processing at any time.
For international data transfers, we inform you that these fall under Article 49(1)(b) of Regulation (EU) 2016/679, as they concern transfers necessary for the performance of a contract between the data subject and the data controller, or for the implementation of pre-contractual measures taken at the request of the data subject. Failure to accept this data processing will result in the impossibility of providing the service and fulfilling the contract.
Collecting and storing User data based on their browsing preferences, by relying on their behavior on the Website through cookies or similar storage technologies: the legal basis for data processing for this purpose is the consent given by the User by checking the appropriate box, which can be withdrawn at any time.
Inclusion in ROLLIO DE MADRID's instant messaging application groups: the legal basis for data processing is the explicit consent given by the User to be included in the instant messaging application groups managed by ROLLIO DE MADRID. In the event that the User withdraws their consent, ROLLIO DE MADRID will not be able to include them in the groups created for managing activities.
The contributions obtained for the aforementioned purposes are independent of each other, so the User may withdraw only one of them without affecting the others.

How long do we keep your personal data?

A ROLLIO DE MADRID processes your personal data for as long as necessary to fulfill the purposes established in this Privacy Policy, as well as to retain your personal data in accordance with the provisions of applicable laws and regulations. Specifically:
Commercial relationship and bookings: We retain data as long as the commercial relationship exists, and for the statutory limitation period of possible legal proceedings after its termination, which is generally five years.
Registration and identification on the Website: We will retain your account information as long as it is active, and thereafter for the applicable statutory limitation period.
Inquiries and requests: Information sent through contact channels will be stored until it is necessary to respond to your request, and then for the statute of limitations for possible legal proceedings.
Commercial communication: We retain the data necessary to send commercial information until the User withdraws their consent, and for customers, for a maximum of one year.
Cookies and browsing preferences: Data collected with cookies or similar technologies will be retained until the User objects, but for no longer than one year.
Legal obligations: We retain data necessary for compliance with the law according to legally mandated deadlines.
Reports, statistics, and internal analyses: Data used for service improvement or to detect misuse will only be retained for as long as is necessary for these purposes, and thereafter for the statutory limitation period.
Messaging groups and channels: Data in messaging groups will be retained as long as the User maintains their consent and will be kept locked for the statutory limitation period after its withdrawal.

With whom will we share your data?

A ROLLIO DE MADRID publishes the collected data for the following:
• Administrative authorities, where required by law, based on the fulfillment of a legal obligation.
Courts and Tribunals, based on the fulfillment of a legal obligation as prescribed by law.
Third-party providers in contact with the Data Controller (accommodation providers, transfer providers, transport companies, accounting firms, technical support, etc.) whose intervention is necessary to fulfill the purposes described herein, on the legal basis of contract performance, and who will act as independent data controllers.
For the sake of service efficiency, depending on the country of destination, these service providers may also be located in third countries, which generates international data transfers within this data processing. Furthermore, some service providers may be located in areas outside the European Economic Area that do not provide a level of data protection equivalent to that of the European Union. In such cases, we inform you that we will transfer your data with appropriate safeguards and always maintaining the security of your data.
A ROLLIO DE MADRID applies the guidelines of the European Data Protection Board, taking the necessary measures to ensure that the level of personal data protection complies with current regulations, including the implementation of appropriate technical and organizational security measures. In cases where third parties are involved, it is recorded that these providers act as independent data controllers, and each is responsible for fulfilling its own data protection obligations. Without prejudice to the foregoing, where required by the applicable regulations, appropriate data processing agreements will be entered into in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).
Except in the cases described here, we will not disclose data, except in cases of legal obligation.

Cybersecurity

As a measure to be implemented for security, we inform you through our policy that any request that our users or clients may receive electronically, whether via email or WhatsApp, originating from our office, regarding changes in payment methods, requests for data or contact persons, bank details and/or credit card details and/or other official data, should not be complied with without direct confirmation from our company through alternative means. We are doing this to implement all available tools that allow us, with your cooperation, to avoid possible cybersecurity risk situations in which our company may be used, as well as any potential security risks they may become aware of.

Social networks

ROLLIO DE MADRID appears on social networking sites, and with respect to which it acts solely as controller of the data published by ROLLIO DE MADRID.
Social networks are detailed below:
Instagram: https://www.instagram.com/rolliodemadrid/tagged/
Facebook: https://www.facebook.com/profile.php?id=61582084148546
TikTok: https://www.tiktok.com/@rolliodemadrid?is_from_webapp=1&sender_device=pc
Social network users can adjust the privacy and security settings provided by each social network, and ROLLIO DE MADRID is not responsible for the management of social network user data.

What are your rights when you provide us with your data?

Any person has the right to obtain confirmation as to whether or not personal data concerning them is processed at ROLLIO DE MADRID.
The data subject has the right to withdraw their consent at any time, provided that the data processing is not necessary for the performance of a contract. Withdrawal of consent does not affect the lawfulness of data processing based on consent prior to its withdrawal.
As a data subject, you may exercise your rights of access, rectification, erasure, restriction, data portability, and objection to the processing of your personal data at any time and free of charge, by sending an email to info@rolliodemadrid.com and complain@rolliodemadrid.com, or by postal mail to ROLLIO DE MADRID at the address indicated in the Data Controller section, stating "EXERCISE OF RIGHTS" in the subject of your communication, along with your identifying details and the right you wish to exercise.
We will respond to the exercise of rights within one month of receiving the request, which may be extended by an additional two months as needed, taking into account the complexity and number of requests.
Furthermore, if you believe your rights have not been upheld, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), as the national supervisory and control authority.

Using and Publishing Images

A ROLLIO DE MADRID may use and publish images (photographs and/or videos) that may depict both customers and employees for the promotion of its services and activities, as well as their inclusion on the company website, social networks (such as Instagram or other platforms), and in promotional and corporate materials.
For group trips, the organization may take photos during the execution of activities for promotional purposes. This data processing will only take place if the express, specific, and informed consent of the individuals concerned has been obtained in advance, through appropriate authorization for the processing of their image and, where applicable, the transfer of rights related to their likeness.
Similarly, in cases where customers voluntarily send photos through channels such as WhatsApp or other means, and the organization wishes to use them for publication on the aforementioned channels, their explicit prior consent will be requested for such use, including the appropriate transfer of image rights.
The legal basis for data processing is the consent of the data subject, which can be withdrawn at any time without affecting the lawfulness of the processing prior to withdrawal.
The organization will in all cases take the necessary measures to ensure that the images are used appropriately, respecting the rights and freedoms of individuals, and avoiding any misuse or use contrary to current regulations.

Commercial and Promotional Communication

One of the purposes for ROLLIO DE MADRID to process the personal data provided by Users (if they have authorized or have not objected, in the case of customers) is to send them commercial communications with information about products, services, promotions, offers, events, or news relevant to the Users.
In the event that the User no longer wishes to receive commercial or promotional communications from ROLLIO DE MADRID, they may request to unsubscribe from the service by sending an email to the following addresses: info@rolliodemadrid.com and complain@rolliodemadrid.com, or by clicking on the link provided at the bottom of the commercial communications sent.

Privacy Policy Amendments.

We review and update the privacy information at least once a year, or when changes occur in legislation or in any of our personal data processing procedures.
ROLLIO DE MADRID will be updated in all cases whenever there are changes in specific legislation or its specific application.

Acceptance and consent

The User declares that they have been informed of the terms regarding the protection of personal data and accept the content of this Privacy Policy.
Last updated: April 2026