Canary Lofts

PRIVACY POLICY

Last updated: May 30, 2026

By using the following “Website” and/or by communicating electronically with Vueling Holidays, personal data of users may be collected and processed.

Such processing is governed by this Privacy Policy.

________________________________________

BASIC INFORMATION ON DATA PROTECTION

Data Controller

VIAJES TU BILLETE, S.L.U. (“Vueling Holidays”)

Website

https://holidays.vueling.com

Purpose

• Manage your travel request

• Maintain the contractual relationship

• Handle inquiries (forms, telephone or other means)

• Manage participation in events/promotions

• User registration

• Send commercial communications

• Improve the website

• Comply with legal obligations

Legal basis

• Explicit consent

• Performance of a contract

• Legitimate interest

• Legal obligations

Recipients

Your personal data will not be disclosed to third parties unless required by law. However, the following may have access:

• Hotels

• Car rental companies

• Transport providers or airlines

• Service providers and cloud storage providers

International transfers

Transfers may take place outside the EEA under Article 49(1)(b) GDPR.

User rights

Access, rectification, erasure, objection, restriction, data portability, and not to be subject to automated decisions.

Additional information

• Legal Notice

• Cookie Policy

________________________________________

I. DATA CONTROLLER

VIAJES TU BILLETE S.L.U.

Tax ID (NIF): B-38723904

Address: Calle Fernando Beautell, 15, 38009 Santa Cruz de Tenerife

DPO contact:

dpo@avoristravel.com

________________________________________

II. SCOPE OF THIS POLICY

Applicable to all data collected through:

• Website

• Forms

• Applications

• Blogs

• Related contact channels

________________________________________

III. PURPOSES OF PROCESSING

Data may include:

• Identification data

• Contact details

• Payment information

• Preferences

• Online registration data

• Image

Main processing activities

• Commercial communications

Retention: until the user objects

• Newsletter and promotions

Retention: until unsubscribed

• Inquiry management

Retention: statutory periods

• Complaints

Includes call recording

• Booking / contracted services management

Retention: contractual relationship + statutory periods

• Quality surveys

Based on legitimate interest

• Communications related to booking status

Operational service information

• Events/promotions

Retention: duration of the promotional action

• User registration

Retention: until the user requests account deletion

• Other purposes

o Personalized advertising

o Legal compliance

o Fraud prevention

o Market research

Important

• Mandatory fields must be completed

• Information provided must be accurate

________________________________________

IV. RECIPIENTS

Data may be shared with:

• Companies within the Ávoris Group

• Public authorities

Service providers, such as:

• Airlines

• Hotels

• Transport providers

• Technology service providers

• Legal advisory services

________________________________________

V. INTERNATIONAL TRANSFERS

International transfers will be carried out in accordance with the GDPR when necessary for:

• Performance of the contract

• Provision of the service

________________________________________

VI. LINKS

We are not responsible for the privacy practices of external websites.

________________________________________

VII. SECURITY

Measures applied include:

• Encryption and pseudonymisation

• System protection

• Data restoration

• Periodic assessments

• Access controls

________________________________________

VIII. CONFIDENTIALITY

An absolute commitment to confidentiality and data protection.

________________________________________

IX. RESPONSIBILITY

The user is responsible for incorrect or false information.

________________________________________

X. COOKIES

Please consult the Cookie Policy on the website.

________________________________________

XI. RIGHTS

You may exercise your rights via:

• Postal mail

• Email: proteccion.datos.tubillete@avoristravel.com

• DPO Email: dpo@avoristravel.com

You may also lodge a complaint with:

www.aepd.es