In compliance with the Personal Data Protection regulations and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), Substantial Leisure Corporation dba OAD Travel (hereinafter, “OAD Travel”) acting as data controller, with DataRep (www.datarep.com) as Data Protection Representative in Europe, we provide you with the following information so that you are aware of relevant details of the processing of your personal data as a user of the services on our website.

1. Who is the Data Controller?

   Identity:	Substantial Leisure Corporation dba OAD Travel with US Tax ID number 92-1265857
   Address:	PO Box 388, Holbrook, NY 11741, USA
   E-mail:	privacy@oadtravel.com

2. What type of personal data do we potentially collect from you?

   • Contact information, including your name, telephone number, postal address, and e-mail address.
   • Billing or payment information (such as your credit card number, cardholder name, expiry date, authentication code, and billing address) through our partnership with a trusted payment service provider.
   • Username and password.
   • Information about your restaurant and hotel reservations and preferences, including your food and beverage orders and your total bill.

3. When do we collect your personal data?

   Personal data can be collected through the following ways:

   • When contracting the services of OAD Travel: We can collect your data through a registration form in order to contract the services of OAD Travel.
   • When subscribing to OAD Travel’s newsletter: to receive the latest news about our services and promotions.

4. What are the main purposes and legal basis for processing your data?

   • For the development, fulfilment, and performance of the service agreement that you have contracted with OAD Travel on our website.

     Legal basis: The processing of your data is necessary for the performance of the service agreement binding us to you.

   • To comply with our legal obligations, possible court rulings and other decisions determined by the authorities, including the communication of personal data to law enforcement agencies, whenever we have suspicions or indications of an action that may constitute a criminal offence.

     Legal basis: The processing of personal data for these purposes is carried out on the basis of compliance with OAD Travel’s legal obligations.

   • Subscription to the OAD Travel’s newsletter.

     Legal basis: the processing is carried out on the basis of your consent given through the subscription form provided on our website (article 6.1.a of GDPR).

5. How long do we store your data?

   Personal data will be processed for the time necessary to fulfill the purposes set out in this Privacy Policy and for the retention of your personal data in accordance with applicable laws and regulations, particularly with regards to statutory limitation periods, and for the establishment, exercise or defense of claims.

6. Who could be the recipients of your data?

   Depending on the purposes for which the personal data have been collected, the following third parties may have access to the personal data:

   • Public administrations when there is a legal obligation.
   • Agencies and/or competent authorities and the relevant law enforcement agencies, in cases where there is a requirement or a legal obligation, or where we consider that there are sufficient indications and/or suspicions of an illicit or criminal offense.
   • Collaborators, partners and third-party service providers who process information as data processors. All our suppliers have entered into a data processing contract with us in accordance with the data protection regulations.
   • Employees and/or partners authorized by OAD Travel, always subject to the applicable data protection regulations.

   We may transfer personal data to countries outside the European Economic Area. In such cases, we would like to inform you that we transfer your data with adequate safeguards in place, always ensuring the security of your data. We employ the most appropriate tools for international data transfers, such as Standard Contractual Clauses or any other relevant supplementary measures. You can review the content of the Standard Contractual Clauses at the following link: https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en.

7. What are your rights when you provide us with your data?

   If we process your personal data, you’ve the following rights:

   • Right to request access to personal data: you may ask OAD Travel if it is processing your data, and if it is, you may have access to the same.
   • Right to request rectification of your data in case they are inaccurate or to request data to be completed if they are incomplete.
   • Right to request the erasure of your data.
   • Right to request the restriction of processing: in this case, we will only keep data for exercising or defending against claims.
   • Right to object to processing: OAD Travel will cease to process personal data, unless they must continue to be processed for legitimate reasons or for exercising or defending against possible claims.
   • Right to the portability of data: in the event that a user would like for their data to be processed by another data controller, OAD Travel will facilitate the transfer of their data to the new controller.
   • Right to not be the object of automated decision-making regarding your personal data.

   To exercise your rights, please send us an e-mail to privacy@oadtravel.com or by writing to our postal address. For additional information, the website of the Spanish Data Protection Agency (AEPD) https://www.aepd.es/derechos-y-deberes/conoce-tus-derechos has available forms and specific indications on the exercise of rights.

   In OAD Travel we process data on the basis of consent, and you should know that you have the right to withdraw that consent whenever you wish, without affecting the lawfulness of the processing based on the consent prior to withdrawal.

   If you consider it warranted, you may file a complaint before the AEPD (https://www.aepd.es).

   Please, remember you are responsible for the data you provide us, so your data shall be truthful, accurate and you must keep them updated.

8. Updates

   We will only use your personal data as set out in this Privacy Policy that is in force at the time we collect your information. If any revision or update is done that affects the processing of your personal data, we will provide the date of the most recent revision or update.