Privacy policy
The purpose of this Privacy Policy (hereinafter, the “Policy”) is to inform you about the processing of your personal data by APGTA.
This Policy will explain how APGTA collects, processes and protects your personal data, so that you can freely and voluntarily decide whether to provide it to APGTA.
APGTA will process your data in accordance with the obligations and guarantees established in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, GDPR), as well as in Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, and in accordance with current data protection regulations.
You should read the Policy carefully and periodically, as it may be subject to change due to new treatments or regulatory modifications.
The personal data that the Data Controller may process are the following:
| Purpose | Personal data | Basis of legitimacy |
| Management of reservations and activities |
|
The application of pre-contractual measures at the request of the interested party (Article 6.1 b) of the GDPR). |
| Pay attention to the exercise of your data protection rights (access, rectification, opposition, erasure, limitation of processing and portability). |
|
Compliance with a legal obligation applicable to the data controller (Article 6.1.c of the GDPR) |
| Sending commercial communications from APGTA: Sending commercial communications from the data controller to the user by various means, including electronic means. |
|
Satisfaction of the legitimate interests pursued by the data controller versus objection to processing (Article 6.1 f) of the GDPR). |
|
User management of APGTA websites: Management of users who enjoy the services offered on APGTA websites (attention to information requests, navigation, etc.). |
|
The application of pre-contractual measures at the request of the interested party (Article 6.1 b) of the GDPR). The satisfaction of the legitimate interests pursued by the controller (Article 6.1 f) of the GDPR).
|
Regarding the data that the user may provide by clicking ACCEPT, the user declares that the information and data provided are accurate and truthful and will be solely responsible for the veracity of all information provided. APGTA is not responsible for the use of false, inaccurate, incomplete, or outdated data provided by the user .
4.- DATA RETENTION
In compliance with the principle of limiting the retention period for personal data, these will be processed and stored in a way that makes it possible to identify the interested party, solely and exclusively for the time necessary for the purposes for which they were collected at each time and for the management of possible liabilities that may arise from said purpose, in addition to the periods established in the applicable regulations.
Once the conservation period has elapsed, the APGTA will block, for the duration of the statute of limitations for any legal actions that may arise, with the sole purpose of addressing any liabilities that may arise.
Once these responsibilities have expired, your personal data will be permanently deleted.
5.- RECIPIENTS OF PERSONAL DATA AND INTERNATIONAL DATA TRANSFERS
The APGTA will only share your personal data with third-party recipients for any of the purposes described in section 3 of this Policy, and these communications may be:
- Necessary for the provision of the service: APGTA has contracted, for the management of some of the functions necessary for the provision of the service, trusted providers who may have access to personal data and who will act as Data Processors and will be contractually obliged to comply with their legal obligations and maintain confidentiality, secrecy of information and guarantee the security of your personal data and the correct exercise of your rights.
- In this case, the data necessary for collection will be transferred through the Cecabank payment gateway of the banking entity Ibercaja Banco SA and will be governed by its Privacy Policy.
- Compliance with a legal obligation: APGTA may also communicate your personal information to duly authorized third parties when necessary to comply with the law, for example, Public Administrations, lawyers and solicitors in the event of a judicial process that requires it.
APGTA does not transfer your personal data to third countries outside the European Economic Area. Should an international data transfer be required, users will be notified and it will be based on compliance with any appropriate safeguards established in the GDPR.
6.- AUTOMATED DECISIONS THAT IMPLY LEGAL CONSEQUENCES FOR THE INTERESTED PARTY
You are hereby informed that the processing of your data for the purposes indicated will not involve the application of automated decisions that produce legal effects for the user.
7.- RIGHTS OF USERS AND DATA SUBJECTS
In accordance with current legislation, APGTA informs you that you have the rights derived from applicable data protection regulations (access, rectification, erasure, limitation, opposition and portability).
In accordance with applicable regulations, the APGTA will process the exercise of these rights within a maximum period of one month. However, depending on the complexity of the request, the full implementation of certain rights may require a longer period, which in no case will exceed an additional two months.
You may exercise your rights of access, rectification, opposition, deletion, limitation and portability at any time by sending a written communication to La APGTA by email to info@guiasoficialesturismoaragon.es, attaching your identity document.
You may also file a complaint with the Spanish Data Protection Agency, C/ Jorge Juan, 6 – 28001 Madrid (Spain), if you believe that LA APGTA has processed your personal data in breach of applicable regulations.
9.- SECURITY MEASURES
The Data Controller will treat your personal data with absolute confidentiality. Furthermore, it has implemented appropriate technical and organizational measures to ensure the security of your personal data and prevent its unlawful destruction, loss, access, or alteration. In determining these measures, criteria such as the scope, context, and purposes of the processing, the state of the art, and the existing risks have been taken into account.
10.- COOKIES
Like other websites, the websites of LA APGTA and those of its suppliers and customers use a technology called “cookies” to collect information about user interaction with the websites and their use, which you can consult in the Cookie Policy .
11.- MISCELLANEOUS
The Data Controller informs that the Data Controller’s Privacy Policy consists of this document, as well as the specific privacy conditions of each of the services that will be completed and interpreted in a coherent and systematic way, respecting, in any case, the wishes of the Interested Party regarding the general processing included herein, without affecting the specific conditions of the contracted services.
If any provision of these conditions, or part of them, is declared illegal, invalid or unenforceable by a competent administrative or judicial body, it shall be deemed not to have been included, without affecting the other provisions.
12.- UPDATES
APGTA may update this Privacy Policy at any time. Any such update will be published by APGTA and communicated directly to the interested party and the user if it affects their rights or freedoms.
The use of our services after this change has been communicated, and browsing the APGTA websites, will imply that the interested party and users are aware of the new Privacy Policy. Therefore, each time you access the websites of APGTA member companies, you should review this Policy to be properly informed about the type of information collected and how it is processed.
This Privacy Policy was last updated on July 7, 2026.
El Responsable del tratamiento tratará sus datos personales de manera absolutamente confidencial. Asimismo, ha implantado medidas técnicas y organizativas adecuadas para garantizar la seguridad de sus datos personales y evitar su destrucción, pérdida, acceso o alteración ilícitos. A la hora de determinar estas medidas, se han tenido en cuenta criterios como el alcance, el contexto y los fines del tratamiento; el estado de la técnica y los riesgos existentes.