Privacy Policy

PRIVACY POLICY

Last updated: 23/07/2026

1. PURPOSE AND SCOPE OF APPLICATION

This Privacy Policy aims to inform users of the website www.picnegre.com, as well as of the applications, booking platforms, customer service channels and other digital services managed by PIC NEGRE, S.A. and SHUSSKI SPAIN, S.L.U., about how their personal data is collected, used, stored and protected.

This Policy applies to all personal data processing carried out in connection with:

• browsing the website;
• making bookings or contracting services;
• the rental of sports equipment;
• the purchase of products;
• participation in sports or tourist activities;
• the use of contact forms;
• subscription to commercial communications;
• handling enquiries, incidents or complaints;
• any other interaction with the responsible entities through electronic or in-person means.

Use of the website implies awareness of this Privacy Policy, without prejudice to the fact that certain processing activities may require the express consent of the data subject in accordance with the applicable regulations.

2. DATA CONTROLLERS

Depending on the service contracted or the activity carried out, the controller of the personal data processing may be one of the following entities:

2.1 PIC NEGRE, S.A.

• Registered office: Ctra. Vila – Obaga de Notari – AD200 Vila – Encamp (Principality of Andorra)
• NRT: A-701388-A
• Email address: info@picnegre.com
• Phone: +376 737 720

PIC NEGRE, S.A. shall be the data controller for services provided from the Principality of Andorra or when expressly indicated during the contracting process.

SHUSSKI SPAIN, S.L.U.

• Registered office: Travesía Juan Montes no. 2–4, 27001, Lugo.
• NIF: B19460328
• Email address: info@picnegre.com
• Phone: +34 982 729 946

SHUSSKI SPAIN, S.L.U. shall be the data controller for services provided from Spain or when so indicated during the contracting process.

When this Policy refers jointly to “the Company”, it shall be understood as referring to the entity responsible for the processing in each case, depending on the service actually contracted.

When the same service involves the intervention of both companies, each shall act as data controller with regard to the data whose management falls under its responsibility, without prejudice to any legally required cooperation obligations.

The entity responsible for the processing shall be identified during the contracting process, in the booking confirmation, on the invoice or in any other contractual documentation provided to the customer.

3. DATA PROTECTION OFFICER

PIC NEGRE, S.A. has appointed a Data Protection Officer (DPO).

Communications addressed to the Data Protection Officer shall be handled with full independence in accordance with the applicable regulations.

Enquiries related to the processing of personal data may be addressed to:

Data Protection Officer email address:

mailto:protecciodades@picnegre.com

Address

Ctra. Vila – Obaga de Notari

AD200 Vila – Encamp

Principality of Andorra

4. WHAT PERSONAL DATA DO WE PROCESS?

Depending on the requested service, we may process the following categories of personal data:

Identification data

• first name and surname;
• identification document where necessary;
• date of birth;
• nationality when necessary for certain activities.

Contact details

• Address
• email address;
• Telephone

Financial data

• billing details;
• payment method;
• purchase or booking history.

Under no circumstances does the Company store full bank card details when payment is made through secure platforms managed by specialized providers.

Data derived from contracting

• bookings made;
• rentals;
• purchases;
• contracted services;
• incidents;
• complaints.

Browsing data

When the user browses the website, data relating to the following may be processed:

• IP address;
• browser;
• device used;
• operating system;
• language;
• date and time of access;
• cookies and similar technologies.

 Images or audiovisual recordings

When the participant expressly authorizes their capture and use.

Geolocation data

When necessary for the provision of certain services or activities.

Information relating to the use of cookies can be consulted in the corresponding Cookie Policy.

5. HOW DO WE OBTAIN THE DATA?

Personal data may be obtained:

• directly from the data subject;
• through website forms;
• during the booking process;
• through the contracting of services;
• during telephone assistance;
• by email;
• through applications or booking platforms used by the Company;
• through social media when the user voluntarily contacts the Company.

The Company does not obtain personal data from unlawful sources or carry out processing that is incompatible with the purposes for which the data was collected.

6. PROCESSING PRINCIPLES

All processing carried out by the Company shall comply with the principles established by the General Data Protection Regulation and the applicable Andorran regulations.

In particular, the data shall be processed in accordance with the principles of:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimization;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability.

The Company shall adopt reasonable technical and organizational measures to ensure a level of security appropriate to the risk arising from the processing of personal data.

7. PURPOSES OF PROCESSING AND LEGAL BASIS

The Company shall process the user’s personal data only when there is a legal basis that legitimizes such processing and exclusively for the purposes indicated below.

Under no circumstances shall personal data be used for purposes incompatible with those for which it was collected.

8. COMMERCIAL COMMUNICATIONS

Whenever there is a legal basis that allows it, the Company may send the user commercial communications related to:

• sports activities;
• equipment rental;
• promotions;
• news and updates;
• events;
• marketed products;
• services related to the Company’s activity.

When the legal basis is consent, it may be withdrawn at any time without affecting the lawfulness of the processing carried out previously.

The user may unsubscribe from these communications by using the link provided in each electronic communication or by contacting the Data Protection Officer.

9. DATA RETENTION PERIOD

Personal data shall be retained only for the time necessary to fulfil the purpose for which it was collected and, subsequently, for the limitation periods established by civil, commercial, tax and other applicable regulations.

As a general rule:

• Data arising from contracting shall be retained while the contractual relationship remains in force and subsequently during the legal limitation periods.
• Data necessary for compliance with tax, accounting or administrative obligations shall be retained for the periods established by the corresponding legislation.
• Data processed on the basis of consent shall be retained until such consent is withdrawn.
• Data used for commercial communications shall no longer be processed when the data subject requests to unsubscribe.

Once the above periods have ended, the data may remain duly blocked for the time necessary to address possible legal liabilities and shall subsequently be securely deleted.

10. DATA RECIPIENTS

As a general rule, personal data shall not be disclosed to third parties except when necessary to comply with legal obligations or for the proper performance of the contracted services.

Depending on the requested service, the following may have access to personal data:

• Public Administrations and official bodies when there is a legal obligation.
• Judicial or administrative authorities.
• Financial institutions responsible for managing payments. Pic Negre uses Morabanc for Andorra and Banco Santander for Spain.
• Insurance companies when necessary for the provision of the service or the management of claims.
• Technology service providers, such as web hosting services, IT maintenance, development and technical support, when necessary for the provision of their services and always subject to the corresponding confidentiality obligations and through the signing of the data processor agreements required by data protection regulations.
• Booking or activity management platforms used by the Company. At Pic Negre, Wordpress and Drupal are used for website content management and bookings.
• Providers acting as data processors in accordance with Article 28 of Regulation (EU) 2016/679 or the equivalent Andorran regulations.

All these third parties shall access only the data strictly necessary for the performance of the contracted services and shall be subject to the corresponding confidentiality and data protection obligations.

11. INTERNATIONAL DATA TRANSFERS

As a general rule, the Company shall seek to ensure that personal data is processed within the European Economic Area or the Principality of Andorra.

However, certain technology providers used for the provision of services, such as hosting services, email, cloud storage or management tools, may involve international data transfers.

In such cases, the Company shall ensure that such transfers are carried out only when appropriate safeguards exist in accordance with the applicable regulations, including, where appropriate:

• adequacy decisions by the European Commission;
• standard contractual clauses;
• binding corporate rules;
• any other legally recognized mechanisms.

12. SECURITY MEASURES

The Company has implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk arising from the processing of personal data.

Among other measures, procedures are applied to:

• ensure the confidentiality of information;
• prevent unauthorized access;
• preserve data integrity;
• prevent the loss, destruction or accidental alteration of information;
• ensure the availability of systems when necessary.

However, the user must be aware that security measures on the Internet are not absolutely infallible and that, therefore, absolute security cannot be guaranteed against any external incident or unlawful action by third parties.

The Company periodically reviews the measures implemented in order to adapt them to technological developments and detected risks.

13. RIGHTS OF DATA SUBJECTS

Every person has the right to obtain information about the processing of their personal data and to exercise, at any time and free of charge, the rights recognized by the regulations in force on data protection.

In particular, the data subject may exercise the following rights:

• Right of access, to know what personal data is being processed and to obtain information about such processing.
• Right to rectification, to request the modification of data that is inaccurate or incomplete.
• Right to erasure, when the data is no longer necessary for the purposes for which it was collected or when any of the legally established circumstances apply.
• Right to object, to object to the processing of their data in the cases provided for by the regulations.
• Right to restriction of processing, when the circumstances established by the applicable legislation apply.
• Right to data portability, when the processing is based on consent or on a contract and is carried out by automated means.
• Right to withdraw consent at any time, when the processing is based on such legal basis, without affecting the lawfulness of the processing carried out previously.
• Right not to be subject to decisions based solely on automated processing, including profiling, except in the legally established cases.

14. EXERCISE OF RIGHTS

Rights may be exercised by means of a written request addressed to the corresponding data controller or to the Data Protection Officer.

Requests may be submitted by:

Email address

mailto:protecciodades@picnegre.com

Data Protection Officer email address:

Dirección postal

Delegado de Protección de Datos

PIC NEGRE, S.A.

Ctra. Vila – Obaga de Notari

AD200 Vila – Encamp

Principality of Andorra

The request must sufficiently identify the data subject and indicate the right they wish to exercise.

When there are reasonable doubts about the identity of the applicant, additional documentation may be requested solely for the purpose of verifying that identity.

The Company shall respond within the time limits established by the applicable regulations.

The exercise of rights shall be free of charge, unless the requests are manifestly unfounded or excessive under the terms provided by the regulations.

15. COMPLAINTS BEFORE THE SUPERVISORY AUTHORITY

If the data subject considers that the processing of their personal data does not comply with current regulations, they may file a complaint with the competent supervisory authority.

When the processing is carried out by PIC NEGRE, S.A., they may contact the Andorran Data Protection Agency (APDA), without prejudice to any other administrative or judicial remedy that may apply.

When the processing is carried out by SHUSSKI SPAIN, S.L.U., they may contact the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in accordance with the applicable regulations.

Filing a complaint with a supervisory authority does not limit the data subject’s right to bring any judicial actions that may apply.

16. MINORS

As a general rule, the services offered by the Company are not aimed at minors who do not have the authorization of their legal representatives when such authorization is required by the applicable regulations.

When the participation of minors in sports activities, courses, events or services organized by the Company is necessary, personal data shall be processed only to the extent necessary for the proper provision of the service and in accordance with the authorization granted by those exercising parental authority or legal representation.

The Company may request any supporting documentation necessary to verify such representation.

17. SOCIAL MEDIA

The Company maintains official profiles on various social media platforms for the purpose of providing information about its activities, services, promotions and events.

Users’ interaction with such profiles shall be governed, in addition to this Privacy Policy, by the terms of use and privacy policies of each platform.

The Company shall not be responsible for data processing carried out by the owners of such social media platforms outside the Company’s own scope of control.

The Company shall not extract personal data from social media unless there is a legal basis that legitimizes such processing.

18. LINKS TO THIRD-PARTY WEBSITES

The website may contain links to third-party websites or services.

This Privacy Policy does not apply to such websites, so the Company recommends that users consult the corresponding privacy policies before providing any personal data.

The Company assumes no responsibility for data processing carried out by third parties outside its organization.

19. UPDATING THE PRIVACY POLICY

The Company may modify this Privacy Policy when necessary to adapt it to regulatory changes, criteria issued by supervisory authorities, technical modifications or variations in the processing carried out.

The current version shall always be the one published on the website at the time of consultation.

When the modifications significantly affect the rights of data subjects or require obtaining new consent, the Company shall adopt the appropriate measures to inform users in accordance with the applicable regulations.

20. CONTACT

For any matter related to this Privacy Policy or to the processing of personal data, the user may contact:

PIC NEGRE, S.A.

Ctra. Vila – Obaga de Notari

AD200 Vila – Encamp

Principality of Andorra

Email address info@picnegre.com

Telephone +376 737 720

SHUSSKI SPAIN, S.L.U.

Travesía Juan Montes nº 2-4

27001 Lugo (Spain)

Email address info@picnegre.com

Telephone +34 982 729 946

Delegado de Protección de Datos

Email address

mailto:protecciodades@picnegre.com

Last updated: 23/07/2026 - v1.0

The intellectual and industrial property rights arising from all texts, images, graphics, as well as source codes, design, media and forms of presentation of its pages belong, in their own right or as assignees, to PIC NEGRE, S.A. Therefore, the user acknowledges that the reproduction, repetition, distribution, dissemination, commercialisation, transformation and, in general, any other form of exploitation, by any means, of all or part of the contents of this website constitutes an infringement of the intellectual and/or industrial property rights of the website owner or of the holder of these rights. In the event that PIC NEGRE, S.A. includes links to advertising or to third-party websites, PIC NEGRE, S.A. is not obliged to monitor, approve or endorse the services, content, data, articles, products or any type of material existing on third-party website pages, and therefore PIC NEGRE, S.A. shall not be liable, under any circumstances, for the legality of third-party content. The third party shall be solely responsible, including but not limited to, for ensuring that the content complies with the law, morality and public order, and that it does not infringe third-party rights. The existence of a link does not imply any relationship between PIC NEGRE, S.A. and the owner of the website on which it is established. In short, this privacy policy applies solely and exclusively to the website of PIC NEGRE, S.A. and not to other websites that may eventually be accessed through links, nor to links from other websites contained on PIC NEGRE, S.A.

PIC NEGRE, S.A. acts with the utmost possible diligence to ensure that the data and information provided on its website are updated at all times, although it does not guarantee or assume responsibility for the accuracy and updating of the website content, reserving the right to modify such content at any time.

PIC NEGRE, S.A. shall also not be responsible for any information that may be obtained through the links included on the website.

The duration of the provision of the website service and the services is indefinite.

Without prejudice to the foregoing, PIC NEGRE, S.A. reserves the right to interrupt, suspend or terminate the provision of the Website service or any of the services that comprise it.

PIC NEGRE, S.A. does not provide any guarantee and shall not be liable, under any circumstances, for damages of any kind that may arise from:

• The lack of availability, maintenance and effective functioning of the Website and/or its services or content.
• The lack of usefulness, suitability or validity of the Website and/or its services or content to meet specific needs, activities, results or expectations of users.
• The existence of viruses, malicious or harmful programs in the content.
• The receipt, obtaining, storage, dissemination or transmission of the content by users.
• The unlawful, negligent or fraudulent use of the website, its services or content by users, contrary to these General Terms and Conditions, good faith, generally accepted practices or public order.
• The lack of legality, quality, reliability, usefulness and availability of the services provided by third parties and made available to users on the website.
• The failure by third parties to comply with their obligations or commitments in relation to the services provided to users through the website.

Commercial relationships with customers shall be governed by the general terms and conditions that, where applicable, are established directly with PIC NEGRE, S.A. in a specific document for this purpose, or by the specific agreements that may be reached with customers.

We inform you that this Privacy Policy was updated in November 2025; however, it is subject to possible changes in accordance with the legislation in force at any given time, and periodic reviews will be carried out in order to keep it updated at all times.