7 nights. Portugal, Spain

WEBSITE PRIVACY NOTICE PURSUANT TO ARTICLES 13 AND 14 OF THE EUROPEAN REGULATION 2016/679 (GDPR)

Specific summary information is progressively reported or displayed on the pages of the website prepared for particular services upon request that include data collection forms. We also inform you that, to provide a complete service, our website may contain links to other websites not managed by CARREFOUR SPA. CARREFOUR SPA is not responsible for errors, content, cookies, unlawful moral content, advertising, banners, or files that do not comply with current legal regulations, nor for the privacy practices of sites not managed by the Data Controller. CARREFOUR SPA, as the Data Controller of your personal data pursuant to Articles 13 and 14 of the European Regulation 2016/679, hereby informs you that the aforementioned regulation provides for the protection of data subjects with regard to the processing of personal data and that such processing will be based on principles of fairness, lawfulness, transparency, and the protection of your privacy and rights. The information and personal data you provide or otherwise acquired while using the website will be processed in accordance with the legislative provisions of the regulation mentioned above and with the confidentiality obligations therein.

DATA SUBJECTS AND DATA RETENTION PERIOD

A) Website users (visitors) of web viaggi.carrefour.it

Types of data processed

Browsing Data: IP addresses or domain names of the computers and other devices used by users connecting to the site; URI (Uniform Resource Identifier) addresses of requested resources and any time-related information; parameters related to the user’s operating system and IT environment; referring and exit pages; navigation index and identifiable behaviors during site visits.

Personal data voluntarily provided by the user: Optional, explicit, and voluntary emails sent to the addresses listed on the site and form submissions involve the subsequent acquisition of the sender’s personal data (e.g., name, surname, email address). Specific summaries are provided on the pages with data collection forms.

Purpose of the processing

Your data collected during navigation will be used for the following purposes:

Carrying out operations strictly connected to managing relationships with website users or visitors;

Collecting, storing, and processing your data for statistical analysis, also in anonymized and/or aggregated form;

Statistical analysis to verify the quality of services offered by the site;

Sharing interactions and usage data with social media operators related to pages where cookies integrating software features or products are installed;

Enhancing the browsing experience to send services and advertisements aligned with preferences expressed during navigation.

Processing of data for the purposes in point 1 is necessary to fulfill your request, and any refusal may limit or prevent full use of site features and services. The legal basis is Article 6.1.b) GDPR. Refusing to provide data would make it impossible to browse the site.

Providing data for purposes 2, 3, and 4 is optional and based on consent (Art. 6.1.a) GDPR). Consent is given by clicking "ACCEPT ALL" in the short notice. More info on cookies is available in the cookie policy on the site.

Browsing data are retained for the periods indicated in the cookie policy.

COOKIES AND TRACKING SYSTEM

Your data are also collected through tools and services provided by third parties and stored by them. For more information, refer to the "cookie policy". CARREFOUR SPA acts only as an intermediary for the links provided in the cookie policy and assumes no responsibility for any changes.

B) Open an Agency

By filling out the form in the “Open an Agency” section, your data will be used to evaluate a possible collaboration. Providing data is optional, but refusal will prevent evaluation of your request. Your data will be retained as long as necessary to provide the requested service or until you unsubscribe or object to processing.

C) Contact section users, social media ads, and landing pages

By filling out the forms in the "Contacts" section, landing pages, or social media ads, your data (name, surname, email, phone number) will be used to respond to your request. Providing data is required to fulfill your request (Art. 6.1.b GDPR), and refusal will make it impossible to respond.

With prior consent, your data may be used to send promotional and advertising messages by traditional (e.g., phone, postal mail, individual emails) and automated methods (e.g., automated emails, SMS, calls, instant messaging, social networks), including CRM integration, respecting all applicable legal principles.

You can opt out at any time using the "UNSUBSCRIBE" link in the email footer or by contacting the Data Controller.

Providing data for marketing purposes is optional and refusal will not affect the response to your requests, but will prevent Bluvacanze from informing you about events and offers. Your data will be stored until you withdraw consent or object to processing.

D) Careers

By filling out the form in the "Careers" section, your data will be used for evaluating potential employment. Providing data is optional, but refusal will prevent the acceptance of your application. CVs should only include identification data, relevant to the stated purposes. Do not include special categories of data (Art. 9 GDPR, e.g., health status, ethnic origins, union membership, religious beliefs). If such data is provided, the Controller will decide whether to retain or delete it. Data will be retained for no longer than 2 years.

DATA PROCESSING METHODS

Your personal data will be processed manually, electronically, and/or digitally, using cookies (as outlined in the site’s cookie policy), via computers with third-party software, and automated contact methods (e.g., newsletters, emails, SMS, calls, messaging, social networks) in compliance with Articles 6 and 32 GDPR and by adopting adequate security measures.

To monitor and improve communications, the Data Controller uses newsletter systems with tracking reports (e.g., open rates, clicks, time data, bounce rates, unsubscribes, link tracking).

USE OF SOCIAL MEDIA PLATFORMS

CARREFOUR SPA may provide links to third-party social platforms not under its control. CARREFOUR SPA assumes no responsibility for the accuracy or other aspects of information found there. Linking to a third-party site does not imply endorsement. We recommend reviewing the privacy policies of any third-party sites.

RECIPIENTS AND DISCLOSURE OF PERSONAL DATA

Your data will be processed by authorized personnel and communicated to external companies acting as independent or joint controllers or processors, including:

Cloud service providers;

IT system management services (e.g., hosting, backup).

The full list of recipients is available upon request. Your data will not be publicly disclosed.

DATA TRANSFERS

Your data may be transferred outside the EU, as indicated in third-party cookie providers’ policies. For more information, contact: [email protected]. Data used for business communications is stored within EU countries.

MINORS

This website is not intended for minors, and the Controller does not knowingly collect their data. If such data is provided (e.g., via contact form), it will be immediately deleted. Parents or guardians must provide consent when making requests on behalf of minors.

DATA CONTROLLER

The Data Controller is CARREFOUR SPA, headquartered at Piazzale Lorenzo Lotto, 2 – 20148 Milan (MI), Italy. The Data Protection Officer (DPO) can be reached at [email protected].

You have the right to request deletion (right to be forgotten), restriction, updates, rectification, portability, and objection to data processing, as well as all rights under Articles 15 and following of the GDPR. You may also lodge a complaint with the relevant supervisory authority.

APPLICATION OF THIS NOTICE

For questions regarding this Privacy Notice, contact MEDIAWORLD SPA at [email protected] or using the contact information provided in this document.

CHANGES TO THIS PRIVACY NOTICE

CARREFOUR SPA reserves the right to update this notice to reflect legal changes and feedback from employees, clients, and users. Any updates will be posted on the privacy page and homepage of www.viaggi.mediaworld.it.

DATA SUBJECT RIGHTS – EU REGULATION 2016/679: Articles 15 to 22

The data subject has the right to:

Confirm whether their data is being processed;

Access the origin, purposes, methods of processing;

Receive information about the logic applied, data processors, and recipients;

Request updates, corrections, deletion, transformation into anonymous form, or blocking of unlawfully processed data;

Obtain confirmation of actions taken regarding third parties informed of changes;

Data portability.

You also have the right to object in whole or in part:

For legitimate reasons, to the processing of your data;

To data processing for advertising, direct sales, market research, or commercial communication purposes.

ACCESSIBILITY STATEMENT

OUR COMMITMENT TO ACCESSIBILITY

At Carrefour Viaggi powered by Bluvacanze, we are committed to ensuring an accessible and inclusive experience for all users. We strive to remove access barriers so everyone can enjoy our travel services and solutions.

Accessibility Solutions for Travelers

Alternative contact channels (street agencies, call center)

Trained travel consultants using empathetic communication

Website Accessibility Features

Compatible with all modern browsers and assistive technologies (e.g., Firefox, Chrome, Safari, Edge)

Known limitations:

Some PDF files are not fully accessible.

Interactive maps are not accessible to visually impaired users.

Some videos lack audio descriptions.

Legal References

This site aims to ensure digital content accessibility in compliance with:

Law No. 4 of 9 January 2004 (“Stanca Law”);

Legislative Decree 82/2022 implementing EU Directive 2019/882 (European Accessibility Act);

WCAG 2.1 – AA Level Guidelines;

UNI CEI EN 301549 technical standard.

Conformance status:

The website is currently undergoing updates and is partially compliant with accessibility standards.

Alternative contact channel:

If you experience difficulties using the site, please contact: +39 02 2412‌14‌89

Report to AgID:

If the response is unsatisfactory, you can submit a report to the Agency for Digital Italy (AgID) via: https://www.agid.gov.it

Declaration date:

September 23, 2025

Accessibility Evaluation:

This declaration is based on internal self-assessment and will be updated as the accessibility project progresses.