Skip to content

Privacy Policy

1. Introduction

1.1. Through this Privacy Policy, users of the platform www.andorra.com (the “Platform” hereinafter) are informed about the collection, processing, and use of their personal data.

1.2. The owner of the Platform and controller of users' personal data is the company indicated below (the “Company” hereinafter):

  • Company name: XERPA TOURIST, S.L.U.
  • Registered office: C/ Pau Casals, 6, 2n 2a, Edifici Emprivat, Andorra la Vella (AD500)
  • Tax Registration Number: L-718342-R
  • Commercial Registry Data: Number 23264, Book S-445, Folio 141-150.

1.3. The Privacy Policy is established with the aim of making known what information we obtain, process, and protect, which is provided by the users of the Platform (the “Users” hereinafter), through their registration as users and/or through the cookies used on this website, so that the User can freely decide whether they wish us to process the aforementioned information.

1.4. This Privacy Policy is not applicable to other third-party websites, even if they are linked to the Platform. We expressly recommend that the User read the Privacy Policies of the third-party websites they visit.

1.5. It is understood that if the User uses the Platform, they expressly accept this Privacy Policy, as well as the Cookie Policy and the Terms of Use thereof. In the event that the User does not agree with any of the aforementioned documents, we ask them to refrain from using the Platform.

2. How is your data obtained?

2.1. The Company obtains information from Users when:

  1. The User creates an account on the Platform, or each time they change the settings of that account;
  2. The User contracts a product or service, as well as throughout the entire service process thereof (including payment and delivery of products or services);
  3. The User contacts the Platform directly via email, phone, by letter, message, or through any means of communication; and
  4. Each time the User browses and uses the Platform (both before and after creating an account).

3. Data obtained

3.1. The personal information that the Company collects about the User includes, by way of example but not limitation, the following data:

  • Full name
  • Email
  • Address
  • Phone
  • Data of purchased products and services
  • Information related to the payment of products and services
  • Technical information about the device or type of connection through which the Platform is accessed.

4. Use and purpose of the data obtained

4.1. The Company uses the personal data collected for lawful and justified reasons, which are indicated below:

  • To provide the service developed by the Platform
  • To manage browsing on the Platform, in accordance with the Cookie Policy.
  • To inform Users about the products and services promoted on the Platform.

4.2. The Company processes Users' personal data with absolute confidentiality and undertakes to adopt the necessary measures to prevent any alteration, loss, or unauthorized processing, in accordance with the applicable regulations in force at all times.

5. Cookies

5.1. The Platform uses Cookies to provide a good experience to Users and implement improvements and updates.

5.2. Users can consult all details about the Platform's use of Cookies in the Cookie Policy.

6. Data retention

6.1. The Company limits itself to retaining User-related information for the strictly necessary time.

6.2. The information obtained will be retained for the period necessary for the purposes provided in Clause 4, in defense of the legitimate interests of the Platform, or for the period expressly established by applicable laws and regulations.

6.3. To establish the appropriate retention periods, the Company will take into account the following criteria:

  1. The Company's contractual obligations and rights in relation to this data;
  2. Legal obligations established in current legislation that require retaining this information for a certain period;
  3. Limitations established by applicable laws;
  4. The legitimate reasons for processing, without prejudice to the Company's obligation to carry out due proportionality analyses of data processing;
  5. Any possible disputes in which the Company may be involved;
  6. The guidelines issued by the competent data protection authorities.

7. Disclosure of your data

7.1. The information obtained about the User will be transferred to the Company's servers and stored there, which are located in the European Union.

7.2. The Company acts with full responsibility and transparency regarding with whom it shares this information.

8. Data exchange with third parties

8.1. Within the framework of the Platform's activity, the Company may exchange data about the User with third-party product and service providers, which are listed below, for informational but not exhaustive purposes:

  • Payment service providers.
  • IT service providers (including cloud service providers) for data storage and analysis;
  • Associated providers (those establishments from which the User contracts a product or service, so that they can process this order, resolve problems or improve their services);
  • Delivery personnel, if necessary, so that they can deliver the products purchased through the Platform;
  • Third parties associated for customer service;
  • Third parties associated for marketing and advertising.

8.2. In the above cases, relationships with providers are regulated by corresponding contracts, in order to ensure that said providers apply sufficient technical and organizational measures to protect personal data.

8.3. It is expressly stated that if the Company undertakes a joint venture, acquires or is sold, or merges with another company, the Company is authorized to transfer and/or disclose information about the User to that company, to the new business partners or owners and/or to their advisors.

8.4. The Company is also authorized to share your information in the following cases:

  • If there is an obligation for the Platform to disclose or share your information to comply with legal or regulatory requirements. This includes cases where the Company is legally obliged to respond to requests for information from the police or to exchange information with other companies or organizations for the purposes of preventing and/or protecting against fraudulent conduct;
  • In order to comply with and enforce the contractual conditions signed with the User and any other contract;
  • To protect the rights of the Platform, providers, delivery personnel and other persons, which includes fraud prevention; and
  • With other third parties whenever reasonably necessary to detect or prevent the commission of crimes.

8.5. In any case, the Platform will adopt all necessary measures to ensure that data is processed securely and in accordance with this Policy, in those cases where it is transferred to third parties.

9. Security

9.1. The Platform follows robust policies and uses the best technology to ensure at all times that the information obtained about the User is duly protected.

9.2. The Company will at all times adopt the necessary measures aimed at protecting information from any unauthorized access and/or against illegitimate processing, loss, destruction or accidental damage.

9.3. Notwithstanding the foregoing, the User is solely responsible for keeping the access name and password assigned to their Andorra.com account secret. The User is expressly advised to refrain from sharing this information with third parties.

9.4. Without prejudice to the foregoing, it is expressly stated that the transmission of information over the Internet is not 100% secure. Although measures are taken to protect your information, the Company cannot fully guarantee the security of data transmitted to the Platform.

10. Modifications to the Privacy Policy

10.1. The Company reserves the right to modify this Privacy Policy, without prior notice to its Users.

10.2. In this context, Users are advised to periodically consult this Privacy Policy.

11. Your rights

11.1. In accordance with data protection legislation, the User enjoys a series of rights in relation to the information processed by the Company, which are defined below:

  • Right of access. The User has the right to know, without undue delay, whether personal data concerning them is being processed, and if so, has the right to access this data, as well as to obtain a copy of the files that the Platform holds in relation to their data.
  • Right to rectification. The User may request that the Platform correct, complete or clarify their personal data, if it is erroneous, incomplete or inaccurate. In this context, the User may ask the Platform to rectify any error in the information and the Platform will inform of the effective modification of the data within the corresponding period.
  • Right to erasure (“right to be forgotten”). The User may request the erasure of personal data concerning them.
  • Right to object to processing. The User has the right to object to certain types of processing, including processing for direct marketing and profiling. To express your objection, change your marketing preferences in your profile or disable the use of cookies.
  • Right to restriction of processing. The User has the right to block or suppress any future use of their information, in the following circumstances:
  1. i. The data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data.
  2. ii. The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use.
  3. iii. The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
  4. iv. The data subject has exercised their right to object, pending the verification whether the legitimate grounds of the controller override those of the data subject.

When these processing limitations occur, the Platform may continue to store it, but without making any use of it.

  • Right to data portability. The User may request the personal data they have provided, having the right to receive it in a structured, commonly used and machine-readable format.
  • Right to lodge complaints. The User has the right to lodge appropriate complaints about the way in which we manage or process information relating to their personal data with the Andorran Data Protection Agency (www.apda.ad), as well as the data protection authority of the European Union member state to which they belong, or any corresponding national authority.
  • Right to withdraw your consent. If the User has given the Platform their consent for any management related to their information, they have the right to withdraw this consent at any time, by contacting the Company. The withdrawal of consent will not imply that the Company has made illegitimate use of their data during the time when such consent was apparent.

11.2. All rights can be exercised by contacting the Company, via email:info@andorra.com, or in writing, at Carrer Pau Casals, número 6, 2-2, Andorra La Vella, AD500, Principality of Andorra. To exercise their rights, the User must provide a copy of their identity document to allow us to verify their identity. The exercise of any right is free of charge.

11.3. When the User exercises the rights of access, rectification, erasure, restriction of processing, objection and data portability, the data controller must provide them with information regarding their actions without undue delay.

11.4. In the case of exercising the aforementioned rights, the maximum response period is one month, starting from the day after the date of receipt of the request by the data controller.

11.5. This period may be extended by two additional months, if necessary, taking into account the complexity and number of requests. The data controller must inform the interested party of any such extensions within one month of receiving the request, stating the reasons for the delay.

12. Account deletion process for Andorra.com

12.1. To request the deletion of your personal data and your Andorra.com account, go to your Profile > Privacy > Close my account.

12.2. Please note that this process is not reversible, so the User will lose access to their data, addresses, payment methods, and any activity they have carried out on Andorra.com.

13. Contact details

13.1. If you wish to contact Andorra.com, you can address info@andorra.com, contact us through the “Contact” section of the Platform, or contact us in writing at the address C/ Pau Casals, number 6, 2nd-2a, Andorra la Vella (AD500).

14. Applicable law and jurisdiction

14.1. This Privacy Policy shall be governed by common Andorran law, as well as by Law 29/2021, of October 28, qualified as personal data protection.

14.2. The courts and tribunals of Andorra la Vella, with exclusive waiver of their own jurisdiction if applicable, shall have exclusive jurisdiction over any claim arising from, or related to, this Privacy Policy.