Privacidad

Privacy Policy and Legal Notice

1. PRIVACY POLICY.

The personal data you provide on this website through any of the means available for the purpose will be processed according to this privacy policy.

1.1.- IDENTITY OF THE DATA CONTROLLER.

Data controller: NAVARRA IMPULSA CULTURA, DEPORTE Y OCIO S.L.
Postal address: Plaza Baluarte s/n CP 31002 – Pamplona, Navarra, Spain
Tax ID: B31931959
Telephone number: +34 948 066066
Email: protecciondedatos@nicdo.es

1.2 - DATA PROCESSING.

Below we inform you about the data processing covered by this privacy policy, indicating both the legal basis of the General Data Protection Regulation (hereinafter, GDPR) and the specific data retention period (to which it is necessary to add the time needed to comply with legal obligations and address any possible responsibilities and/or liabilities which may arise for the Data Controller regarding fulfilment of the purpose for which the data were collected). If at any time your authorisation is requested to process your data for a purpose which requires consent, your failure to grant it (or possible withdrawal of such consent at a later date) will have no consequences for you in any way.

REGARDING OUR RELATIONSHIP WITH YOU

Processing and purposes

Requests for information or enquiries: We will use your data to respond to requests for information, enquiries or complaints which you may send us with the management and scope required.
- Legal basis (GDPR):
  - 6.1.a) The data subject has given consent to the processing of his/her data.
  - 6.1.b) Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.
- Retention period: For the time required to address and manage your request and/or complaint.
Management of registered users (App): We will use your data to process your registration and control and manage your relationship as a customer, manage your interaction with us and process your ticket orders.
We will also use your data to manage this relationship at an administrative level, which may involve dealing with incidents, enquiries, returns and payment collection management for orders placed.
- Legal basis (GDPR):
  - Art. 6.1b) Processing is necessary for the performance of a contract to which the data subject is party.
- Retention period: For as long as the contractual relationship remains in force and the data controller is entitled to process the data.
Management of ticket purchases and sales. We will use your data for the administrative management of the relationship, which may involve dealing with incidents, queries, returns and managing order payments. Purchase statistics are also compiled.
- Legal basis (GDPR):
  - Art. 6.1b) GDPR. Performance of a contract to which the data subject is party.
  - Art. 6.1c) GDPR: Legal obligation to collect statistical data.
    - Regional Law 17/2019 of 4 April on Equality between Women and Men.
    - Programme Contracts signed between NICDO and the Government of Navarre.
- Term: For as long as the contractual relationship remains in force and the Data Controller is entitled to process the data.
Collection and cross-referencing of information, analysis of purchasing behaviour, anonymisation and compilation of statistics
- Legal basis (GDPR):
  - Art. 6.1b) GDPR. Legitimate interest based on internal analysis, service improvement.
- Term: Identifying data: for as long as the relationship exists and once it has been anonymised, permanently.
Conducting voluntary surveys to evaluate the user experience in the sales system, the organisation of events and to learn about their cultural interests for improvement purposes.
- Legal basis (GDPR):
  - Art. 6.1b) GDPR. f) GDPR. Legitimate interest of NICDO. The user may object at any time.
- Term: 12 months from the date of the event or data collection.
Communication to the promoter: in cases where you authorise it, we will communicate your identification details to the event promoter.
- Legal basis (GDPR):
  - Art. 6.1b) GDPR. Express consent of the data subject.
- Term: For the time necessary to process and manage your request.
Classification based on analysis of your browsing habits: We will process the data you generate as a result of your visit to and/or interaction on our websites to classify you and provide you with content of interest.
- Legal basis (GDPR):
  - Art. 6.1.a) The data subject has given express consent to the processing of his/her data.
- Retention period: Until you object and for as long as the data controller is entitled to process the data.
Newsletters and commercial communications: when you request or consent to such communications, we will use your data to send you commercial communications about the data controller´s products or services.

If you have provided us with your date of birth, we may use it to send you birthday greetings and offers or promotions associated with that date, as well as to personalise communications according to your characteristics.
- Legal basis (GDPR):
  - Art. 6.1.a) The data subject has given express consent to the processing of his/her data.
- Retention period: Until you withdraw your consent and object to the processing of the data.
To manage your participation in promotional actions: If you register to participate in any of our promotional actions (contests, prize draws, events, etc.), we will process your data to manage your participation in these and register you as a participant, your participation being subject to the legal bases of the specific action.
- Legal basis (GDPR):
  - Art. 6.1.b) Processing is necessary for the performance of a contract to which the data subject is party (Legal bases/general conditions).
- Retention period: For as long as the contractual relationship remains in force and the data controller is entitled to process the data.
Video surveillance: Security and safety of persons, property and facilities
- Legal basis (GDPR):
  - Article 6.1.e) Processing is necessary for the performance of a task carried out in the public interest.
- Retention period: A maximum of 1 month

ASSOCIATED WITH REGULATORY COMPLIANCE

Processing

To respond to data subjects exercising their rights: If, as data subject, you exercise any of your rights in relation to your personal data, we will use the data you provide us with to evaluate your request and respond to it.
- Legal basis (GDPR):
  - Art. 6.1.c) Processing is necessary for compliance with a legal obligation to which the data controller is subject based on articles 15 to 22 of the GDPR and 12 to 18 of Organic Law 3/2018.
- Retention period: For as long as necessary to respond to the exercise of rights communicated to the data controller.
Compliance with legal obligations related to the products and/or services offered to data subjects. We will use your data to comply with the legal requirements applicable to the relationship between us.
- Legal basis (GDPR):
  - Art. 6.1.c) Processing is necessary for compliance with a legal obligation to which the data controller is subject.
- Retention period: For as long as necessary to comply with the legal obligations of the data controller.
Information systems (channels for complaint). To manage the procedure referred to in Act 2/2023 of 20 February regulating the protection of persons who report regulatory and anti-corruption infringements, and the book-record of the information received and the internal investigations to which it has given rise.
- Legal basis (GDPR):
  - 6.1.c) Legal obligation (Act 2/2023 of 20 February regulating the protection of persons who report regulatory and anti-corruption infringements).
- Retention period: Data will be retained for the time required to achieve the aim for which they were collected and to establish any responsibilities and/or liabilities which may arise from the purpose mentioned above and from processing the data.

If you accept cookies when you open this website, the website’s cookie policy will apply, which you can consult using the following link.

1.3.- TYPE OF DATA WE MAY COLLECT ABOUT YOU.

Identification and contact data will be collected such as name, surname/s, email, telephone, etc. through the different contact channels enabled on our website. If it is not necessary to provide all the data requested on forms, those fields that are required will be identified with an asterisk, the rest being absolutely voluntary. Finally, depending on your cookie preferences, the settings on your device when accessing the page and the communications we send you, we may record your browsing activity on our website, obtaining information about your behaviour and interests, and we may register that commercial communications have been opened.

1.4.-RECIPIENTS. INTERNATIONAL DATA TRANSFERS.

The situations for which it may be necessary to communicate your data to third parties are:

Sending communications and newsletters, measuring their activity, forms and surveys. In this case, your data will be communicated to the company that owns the technological solution used for this purpose, so that it can perform the sending and measurement functions entrusted to it. In the case of the newsletter, this service is currently provided by Nazaries Information Technologies, S.L. (which involves an international transfer of data to the USA) and by SENDIBLUE (Brevo).
Website hosting. The data hosted on our website will be communicated to the company that provides us with web hosting services.
Ticket sales system service provider (Secutix - SECUTIX IBERIA S.L.U.), which involves, as part of the processing, an international transfer of data to Switzerland, covered by the Commission’s decision of 23 July 2000.
CRM service provided by ArenaMetrix.
Grupo CPEN: NAVARRA IMPULSA CULTURA, DEPORTE Y OCIO S.L. is part of the CORPORACIÓN PÚBLICA EMPRESARIAL DE NAVARRA, established by Law 8/2009, of 18 June, Corporación Pública Empresarial de Navarra, S.L. (CPEN) on 4 November 2009 with the mission of being the single instrument for the planning and rationalisation of a substantial part of the heritage of the Regional Community of Navarra. In compliance with the applicable legal framework, data may be communicated within the group, both to CPEN and to other organisations in the group. You can access the list of companies that make up this group here.
Web analytics service called “Google Analytics” provided by Google (Google Ireland Limited): according to the provider´s terms and conditions, the service involves international data transfers outside the EU economic area and, according to the provider´s statement, it complies with the applicable legal framework through the Standard Contractual Clauses established by the European Commission.
Microsoft 0365 and Teams – Email, data hosting and video conferencing services. These services are provided by Microsoft, for which purpose a processing contract has been signed. Microsoft adheres to the instrument "EU-U.S. Data Privacy Framework (EU-U.S. DPF)”, which permits international data transfers.

Except in the cases indicated above, your data will not be communicated or transferred to any third party without your express prior consent unless we are legally obliged to do so. In all events, certain communications and/or data transfers to third parties may be required by certain regulations or to meet obligations with the public authorities, Public Prosecutor’s office, judges, courts and state law enforcement bodies.

1.5.- RIGHTS.

You may exercise the rights of access, rectification, erasure and portability concerning the personal data collected for processing. Furthermore, under certain circumstances, you have the right to request the restriction of or object to the processing of your data, in which case the data controller will stop processing them and will retain them only if legally obliged to do so or until any actions are barred by the statute of limitations. To send any query you may have or exercise your rights, contact us through any of the contact channels indicated in the preamble to this data protection policy in accordance with the provisions of the applicable legislation.

Finally, you may also contact the supervisory authority when you consider it appropriate to file a complaint (for example, in the country where you have your habitual residence, your place of work or where you consider that the alleged infringement has occurred). We inform you that in Spain, the Supervisory Authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos) and that you may exercise your rights using the forms that it provides for the purpose, available on its website. If you would like to find out more about these rights, we recommend that you continue reading or consult the infographic developed by the Spanish Data Protection Agency.

2. LEGAL NOTICE.

2.1. WEBSITE OWNER IDENTIFICATION DETAILS.

In accordance with article 10 of Act 34/2002 of 11 July on information society services and electronic commerce, you are hereby informed that this website belongs to the commercial company NAVARRA IMPULSA CULTURA, DEPORTE Y OCIO S.L., with registered offices at Plaza Baluarte s/n CP 31002 - Pamplona, Navarra, Spain and Tax Identification B31931959, registered in the Commercial Register of Navarra in Tome 1,356, folio 212, sheet number NA-26.983.

2.2. CONTACT

If you need to contact NAVARRA IMPULSA CULTURA, DEPORTE Y OCIO S.L. for any reason, please phone +34 948 066066 or write to protecciondedatos@nicdo.es

Version – Updated on May 25, 2026.