In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018, of December 5 (LOPDGDD), users of this website are informed about the processing of their personal data.
1. Who is responsible for the processing of your data?
This platform encompasses two distinct treatment areas:
a) Datos de navegación, contacto y marketing de la plataforma.
The entity responsible for processing the data collected through web browsing, contact forms, communications subscriptions and cookies is:
- WINECTA DIGITAL TRANSFORMATION GROUP S.L. — Tax ID B19572346 — 16 Doctor Fleming Street, 18012, Granada — Email: soporte@expedicionmedievo.es
b) Datos de los compradores de entradas.
When a user purchases a ticket, the entity responsible for processing their data as the buyer is the owner of the Monument to which the ticket corresponds, whose identity is displayed during the purchase process and in the order confirmation. WINECTA acts as the data processor in this processing, on behalf of and under the instructions of said entity, in its capacity as platform operator and payment agent. The entities that own the monuments are as follows:
PAMPLONA
Cabildo Catedralicio
Dormitalería 5 bis bajo 31001 Pamplona/Iruña
R3100050H
PLASENCIA
Obispado de Plasencia
Plaza de la Catedral s/n, Plasencia 10600 Cáceres
R1000004J
JACA
Obispado de Jaca
C/ Obispo 5. 22700 Jaca (Huesca)
CIF: R2200001B
GRANADA
Parroquia Ntra. Sra. de la Asunción – Monasterio de la Cartuja de Granada,
P.º de Cartuja, s/n, Beiro, 18011 Granada
CIF R1800800C
BILBAO
Ondaregure SL
C/ Virgen de Begoña 38 s/n 48006 Bilbao (Bizkaia)
CIF: B72866965
TOLEDO
Arzobispado de Toledo
C/ Arco de Palacio, 3 45002 Toledo
R4500002C
BARBASTRO
Obispado de Barbastro Monzón
Plaza Palacio 1
22300 Barbastro
CIF R2200028E
BURGOS
THESAURUS BURGENSIS SL.
CALLE EDUARDO MARTINEZ DEL CAMPO,
09003 BURGOS
CIF: B44884815
2. ¿Qué datos tratamos y con qué finalidad?
- Ticket purchase data (name, surname, email, telephone, payment details): purchase management, ticket issuance and delivery, access validation, cancellation and refund management, and compliance with legal obligations. Legal basis: performance of the purchase contract (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR). Payment data is processed through a secure payment gateway; the platform does not store full card details.
- Contact information (forms, email, telephone): handling inquiries and incidents. Legal basis: consent of the data subject (Art. 6.1.a GDPR) and legitimate interest in responding to requests (Art. 6.1.f GDPR).
- Marketing data (email, purchase history): sending commercial communications about the Project Monuments and related experiences, provided the user has consented or there is a prior contractual relationship in accordance with art. 21.2 LSSI. Legal basis: consent (art. 6.1.a GDPR).
- Browsing data and cookies: statistical analysis and advertising. See Cookie Policy. Legal basis: consent (Art. 6.1.a GDPR).
3. How long do we keep your data?
- Contact information: for the time necessary to process the request.
- Contact information: for the time necessary to process the request.
- Marketing data: until the user withdraws their consent or objects to the processing.
4. Who do we share your data with?
- To the entity that owns the Monument corresponding to the tickets purchased (which is responsible for processing the purchase data).
- To service providers necessary for the operation of the platform (hosting, payment gateway, email sending tools), who act as processors or sub-processors of the processing.
- To Public Administrations when there is a legal obligation.
- In the event of taking out optional cancellation insurance (when available), the data will be sent to the corresponding insurance company, which will process the data as an independent controller for the management of the policy and claims.
No international data transfers will be made outside the European Economic Area, except those derived from the use of analysis and advertising tools indicated in the Cookies Policy, which in this case will be covered by the guarantees provided for in articles 44 to 50 of the GDPR (adequacy decisions or standard contractual clauses).
5. What are your rights?
The user may exercise their rights of access, rectification, erasure, objection, limitation of processing and portability:
- For the data for which WINECTA is responsible: by contacting support@expedicionmedievo.es with the reference “Data Protection”, attaching a copy of your identity document if necessary to verify your identity.
- For ticket purchase information: you can contact the entity that owns the corresponding Monument or WINECTA at the address above, who will forward the request to the responsible party and assist in its processing.
Likewise, the user has the right to file a claim with the Spanish Data Protection Agency (www.aepd.es).
6. Security
WINECTA applies appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including encryption of communications (HTTPS/TLS), access control and incident management procedures.
7. Updates
This Privacy Policy may be updated to reflect regulatory or operational changes. The current version will always be available on this page, along with the date of its last revision.
Last revision: 28/07/2026