2. PRIVACY POLICY 2.1. Data controller In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights, users are informed that the personal data provided through www.lockandgoibiza.com will be processed by LE MIRAGE IBIZA S.L., CIF B72448525, Calle Menéndez Pidal 12, 07820 Sant Antoni de Portmany, Ibiza, Balearic Islands, Spain. Privacy contact: info@lockandgoibiza.com. 2.2. Personal data processed For the management of the service, the following data may be processed, among others:  User name and surname.  Email address.  Telephone number.  Booking details: date, duration, type and number of lockers contracted.  Billing details, where applicable.  Technical browsing data, device data, IP address and website usage data.  Images captured by video surveillance systems on the premises. The user guarantees that the data provided is truthful, accurate, complete and up to date, and shall be responsible for any damage caused by providing false, inaccurate or incomplete data. 2.3. Purposes of processing Personal data will be used for the following purposes:  Managing the booking, contracting and payment of the smart-locker service.  Providing access to and use of the contracted service.  Sending operational communications related to the booking, access codes, incidents or support.  Handling queries, complaints and support requests.  Complying with legal, tax, accounting and security obligations.  Managing possible incidents, damage, non-payment, misuse or contractual breaches.  Sending satisfaction surveys and, where appropriate, commercial communications related to similar services, unless the user expressly objects.  Ensuring the security of the premises through video surveillance systems. 2.4. Legal basis for processing The legal basis for processing shall be, as applicable:  Performance of the service contract requested by the user.  Compliance with legal obligations applicable to LE MIRAGE IBIZA S.L.  Legitimate interest in ensuring service security, preventing fraud, managing incidents and protecting the premises.  User consent for certain commercial communications or processing not strictly necessary for contract performance. 2.5. Online payments Payments made through the website will be processed by secure external payment platforms, such as Stripe, Redsys or other authorised providers. LOCK & GO IBIZA does not store complete bank card details or sensitive financial information of the user. LOCK & GO IBIZA - Legal documentation Page 4 2.6. Video surveillance LOCK & GO IBIZA premises have video surveillance systems for the purpose of ensuring the security of the premises, lockers, users and deposited items. Video-surveilled areas shall be duly signposted in accordance with applicable regulations. Images will be kept for the legally permitted period, unless they need to be retained for a longer period to prove events, incidents, damage, misuse or requests from competent authorities. 2.7. Data retention Personal data will be kept for as long as necessary to provide the contracted service, manage the contractual relationship and comply with applicable legal obligations. Once these periods have ended, the data will be deleted, blocked or anonymised in accordance with applicable regulations. 2.8. Recipients and processors Data may be communicated to technology providers, payment platforms, tax or legal advisors, insurance companies, law enforcement agencies, courts, tribunals or public administrations when necessary for service provision, legal compliance or defence of rights and legitimate interests. 2.9. International transfers LOCK & GO IBIZA does not intend to carry out international data transfers outside the European Economic Area, except where such transfers may be necessary due to the use of technology providers offering appropriate safeguards under the GDPR. 2.10. User rights Users may exercise at any time their rights of access, rectification, erasure, objection, restriction of processing and data portability by written request addressed to info@lockandgoibiza.com, attaching identification where necessary to verify their identity. Users may also lodge a complaint with the Spanish Data Protection Agency if they consider that the processing of their data does not comply with applicable regulations.