VACIAR CACHE S.L. is a travel agency specializing in the online sale of nature and adventure tours and activities, for which it needs to process personal data of users or customers. In compliance with our obligation to inform, we have prepared the following privacy policy aimed at providing you with all the information you need to understand the scope of the processing of personal data carried out by the company, so that it is based on fully informed consent as established in Regulation 2016/679, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and in Organic Law 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights.
What is the source and categories of data?
The personal data we process comes from the information you provide us when requesting information or establishing any type of relationship with us, directly through the contact details.
The categories of data we will process are of a general nature, such as your identifying data: full name, email / postal address and telephone number, ID card / passport or any other document verifying the traveler's identity, whenever necessary to provide the contracted service; financial data once the contract has been formalized.
We may also process special categories of data, as defined in Art. 9 of the GDPR, only relating to special diets/allergies or food restrictions, if provided by the client themselves. In these cases, if the user provides this type of data—essential for the proper provision of the requested service—they will expressly authorize its processing, since it may be necessary (and mandatory for the provision of the service) that their data must be communicated to providers such as transport companies, hotels, and other service providers, who will be obligated to use the data solely and exclusively to fulfill the purpose of the contract. These ancillary data will be processed applying all security and confidentiality guarantees reasonably applicable given the technology, and deleted from our systems once the service or trip is completed. Failure to accept this processing implies the impossibility of providing personalized services that require knowledge of special data.
All personal data is processed confidentially in accordance with the privacy and security policies implemented at VACIAR CACHE S.L.
Who is responsible for processing your data?
The data controller is VACIAR CACHE S.L., hereinafter HOWLANDERS, with Tax ID (N.I.F.) B-12983813, registered office at Av. Doctor Clará 16, 12002, Castellón, Spain.
You can contact us by letter addressed to our postal address indicated in this paragraph, or through the contact forms, phone numbers, email, or WhatsApp listed in the “Help” section of our website.
For what purpose do we process personal data?
HOWLANDERS will process the personal data provided by users for the following purposes:
- For the development, execution, and fulfillment of the contracted service, collecting only the strictly necessary data.
- The communication channel with users and HOWLANDERS may be any of those provided by users for this purpose, including email address, landline or mobile phone, and instant messaging services, as authorized channels to inform about any relevant information regarding the contracted services, changes, or notifications.
- To manage inquiries submitted through any of the contact channels enabled with the agency. If the data subject has only contacted HOWLANDERS to request information about the services provided, their data will be processed to respond to the requests or information queries they make regarding the services offered. HOWLANDERS will only process personal data that is strictly necessary to manage or resolve the request.
- For commercial purposes, the data subject who is effectively a HOWLANDERS customer may receive updates about similar products also offered by HOWLANDERS. Nevertheless, the customer is informed that they may object at any time by contacting HOWLANDERS through the aforementioned channels.
- To manage data collected through cookies from website users, which will be processed to ensure that website content is adapted to their needs and those of their device, and to continuously improve the user experience.
- HOWLANDERS does not engage in profiling.
- Where applicable, to manage HOWLANDERS’ recruitment process with future candidates.
What is the legal basis for processing your data?
The legal bases for processing your data are:
- Management of pre-contractual and, where applicable, contractual measures, based on Article 6.1(b) of the GDPR, since we collect and process your personal data primarily to execute contracts under the terms and conditions included in those contracts.
- Under this same legal basis, and to properly develop the provision of the requested service, sometimes data about users’ physical capabilities may be required, either directly by us or by the providers.
- Managing inquiries submitted through the communication channels provided for customer communications. This processing is based on Article 6.1(f) of the GDPR—the legitimate interest of HOWLANDERS in responding to information requests received.
- We may obtain and process your personal data for our legitimate interests, based on Article 6.1(f) of the GDPR (or those of any third party). Such legitimate interests include: offering products and services, which finds its justification in the data controller’s legitimate interest. The Customer may object to this type of processing at any time, and exercising this right will not, under any circumstances, condition the execution of the contract.
- Regarding international data transfers, please note that their legal basis is supported by Article 49.1(b) of Regulation (EU) 2016/679, as they are transfers necessary for the performance of a contract between the data subject and the controller, or for the implementation of pre-contractual measures adopted at the request of the data subject. Failure to accept this processing implies the impossibility of providing the service and fulfilling the contract.
HOWLANDERS is committed to secure data processing, and since some of the countries in which adventure programs are offered have not been declared as providing an adequate level of protection by the European Commission, appropriate safeguards are offered through agreements with those providers using standard data protection clauses adopted by the Commission.
- Management, where applicable, of the recruitment process with future candidates. This processing is legitimized in open processes through legitimate interest, and in the unequivocal consent given by future candidates for inclusion in HOWLANDERS’ database.
We also inform you that failure to provide the required information will make it impossible to subscribe to and fulfill the contract.
- To comply with legal obligations, including providing traveler information to the competent authorities in cases required by applicable regulations, such as Royal Decree 933/2021 on traveler registration, with legitimacy under Art. 6.1(c) of GDPR 2016/679.
How long do we keep your personal data?
HOWLANDERS processes your personal data for the period necessary to fulfill the purposes set forth in this Privacy Policy, as well as to retain your personal information in compliance with relevant legal and regulatory provisions.
Specifically, data will be kept for the entire term of the contract and will be blocked upon its expiration. In this way, the data will be blocked and retained for 5 years, this being the statute of limitations for actions arising from the contractual relationship entered into.
Data for which you have given consent for the sending of commercial information will be kept until you request cancellation, at which point it will be deleted.
Who will your data be shared with?
HOWLANDERS will share the data collected with third-party providers related to the Controller (accommodation providers, transportation companies, activity companies, insurance providers, etc.) whose involvement is necessary to fulfill the purposes described herein.
For service efficiency, depending on the country of destination of the trip, these providers may be located in third countries, generating international data transfers. Likewise, some of the service providers may be located in territories outside the European Economic Area that do not provide a level of data protection equivalent to that of the European Union. In such cases, we inform you that we transfer your data with appropriate safeguards and always maintaining the security of your data.
HOWLANDERS operates using the digital marketing platform Twilio, headquartered in San Francisco, California, whose servers are located outside the European Union, which entails a flow of personal data from Spanish territory to recipients established in countries outside the European Economic Area (international data transfers). However, this is accepted by the European Committee as compliant with European data protection regulations due to Twilio’s adherence to the Data Privacy Framework. Twilio guarantees appropriate security levels. You can consult the platform’s privacy policy here: https://www.twilio.com/en-us/legal/privacy
In the absence of an adequacy decision by the Commission regarding any country to which essential service data is transferred, HOWLANDERS guarantees appropriate security levels by applying the European Data Protection Board’s guidelines on suitable supplementary measures to ensure an equivalent level of protection, through the signing of the standard data protection clauses adopted by the Commission.
Outside the cases described herein, no data will be shared, except under legal obligation.
Cybersecurity
As a measure we wish to apply in favor of security, we inform you through our policy that any request that our users or clients may receive electronically, whether by email or WhatsApp, originating from our agency about changes in payment methods, requests for contact persons’ data, banking and/or credit card details and/or other official data, should not be addressed without direct confirmation from our company through an alternative channel. This is to implement all available means, with your cooperation, to prevent potential risk situations related to cyberattacks in which our company could be impersonated, as well as any other possible security risk of which you may become aware.
Social Media
HOWLANDERS has a presence on social networks and acts as the data controller solely with respect to the data published by HOWLANDERS. The social networks are listed below:
Instagram: https://www.instagram.com/howlanders/
Facebook: https://www.facebook.com/howlanders
LinkedIn: https://www.linkedin.com/company/howlanders/
Users of these social networks may configure the privacy and security options provided by each network, and HOWLANDERS is not responsible for processing users’ data on these platforms.
What are your rights when you provide us with your data?
Any person has the right to obtain confirmation as to whether HOWLANDERS is processing personal data concerning them.
The data subject has the right to withdraw their consent at any time, provided that the processing is not necessary to fulfill the contract. Withdrawal of consent will not affect the lawfulness of processing based on consent prior to its withdrawal.
You may exercise your rights as a data subject—access, rectification, erasure, restriction, portability, and objection to the processing of your personal data—at any time and free of charge by sending an email to hello@howlanders.com indicating in the subject line the right you wish to exercise, or by postal mail to VACIAR CACHE S.L., at the address indicated in the data controller section, stating the right you wish to exercise and your identifying data.
The exercise of rights will be responded to within one month from receipt of the request, which may be extended by an additional two months if necessary, considering the complexity and number of requests.
Additionally, if you consider that your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) as the national supervisory and control authority in data protection matters.
Changes to the privacy policy
We will review and update the data protection information at least once a year or whenever there are changes in legislation or any procedures affecting the processing of your personal information.
Last update: July 2025
*The original version of this document was written in Spanish. In the event of any discrepancy, error, or inconsistency between the translated version and the original, the Spanish version shall prevail for all legal purposes. The original Spanish version is available at https://www.howlanders.com/es/legal/privacidad