Information security and privacy policy

Royal Decree 311/2022, of January 8, which regulates the National Security Scheme (ENS), requires us to protect the services we provide to our interested parties. With the implementation of an ISMS under the UNE ISO/IEC 27001 Standard integrated with the MEDIUM category ENS in accordance with the criteria established in Annex I of RD 311/2022, and the application of the requirements described in the CCN Guides and Technical Instructions, the security of our services is strengthened, as well as the information and data they include and that are necessary for their correct and adequate provision.

IAG7 Viajes processes certain personal data that must be registered and kept updated through the document “Registration of Processing Activities” in order to facilitate the control, management and protection of rights by applying specific security measures to comply with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016, relating to the protection of natural persons with regard to the processing of personal data and the free circulation of these data and which repeals Directive 95/46/EC (General Data Protection Regulation), equivalent to Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, which was created to facilitate application and compliance in Spain.

The regulations applicable to the organization are the following:

Following these principles, the organization undertakes to comply with them as follows:

a) Security as an integral process

At IAG7 Viajes, security is an inherent aspect of all our operations. We have integrated security into every phase of our processes, from the implementation of new systems to the daily management of information. Through ongoing training and promoting a culture of security, we are ensuring that all of our employees understand their role in protecting our information assets.

b) Risk-based security management

We are currently conducting a comprehensive risk analysis to identify the most likely threats and their potential impacts. We have cataloged our information assets and evaluated their value to the organization. With this information, we design specific security controls to mitigate each risk, prioritizing those that represent the greatest threat to our business continuity.

c) Prevention, detection, response and conservation

To prevent security incidents, we have implemented multiple security measures, such as firewalls, intrusion detection systems, and secure access policies. Additionally, we have a detailed incident response plan that allows us to quickly detect and respond to any threats. In the event of an incident, we retain all the evidence necessary to conduct a thorough investigation and learn from the experience.

d) Existence of lines of defense

We have established defense in depth, implementing multiple layers of security to protect our systems and data. These layers include physical, logical, and administrative controls. For example, we control physical access to our facilities, protect our systems with antivirus and firewalls, and have implemented robust password policies.

e) Continuous surveillance

Our systems are constantly monitored for any suspicious activity. We use log analysis tools to identify unusual patterns and possible threats. Additionally, we conduct regular security audits to evaluate the effectiveness of our controls.

f) Periodic reevaluation

We recognize that the threat landscape is constantly evolving. Therefore, we conduct regular risk assessments to identify new threats and adjust our security controls accordingly. We also review our security policies and procedures to ensure they remain relevant and effective.

g) Differentiation of responsibilities

We have clearly assigned security responsibilities to different areas of the company. Each department has specific roles and responsibilities in protecting information. For example, the IT department is responsible for the security of computer systems, while the human resources department is responsible for access management.

By implementing these ENS principles, IAG7 Viajes is significantly strengthening its security posture and proactively protecting its information assets.

Furthermore, at IAG7 Viajes the Intellectual Property Law is complied with and respected regarding the use of the software, as well as the rest of the applicable regulations included in the “Regulatory Framework” document.

The Management of IAG7 Viajes is committed to facilitating and providing the necessary resources for the establishment, implementation, maintenance and improvement of the entity's ISMS/ENS, as well as to demonstrate its leadership and commitment through the establishment of the Security Committee.

This policy is understood, implemented and kept up to date at all levels of the company and has the full commitment and support of the IAG7 Viajes Management, who establishes, develops and applies it through the Information Security Management System implemented, according to the international standard UNE-ISO IEC27001 and the R.D. 311/2022 of the National Security Scheme.

They will be established in the relevant functions and levels, focused on improvement and using as a reference framework:

The deployment of the IAG7 Viajes ISMS/ENS is carried out based on the “Security Risk Map”, which allows determining the level of security required by the organization and identifying the controls necessary to treat the risk and bring it to an acceptable level, in accordance with Annex I of RD 311/2022 and Annex A of the ISO 27001 standard. The security controls must be implemented, maintained and continually improved and be available as documented information that must be reviewed. and approved by the Information Security Committee on behalf of the General Directorate.

The documented information will be classified as: Public, Internal and Confidential, giving appropriate use in accordance with said classification and according to the criteria established in the Information Classification and Labeling Procedure. The documented information on security controls must be communicated to the personnel working in the entity (internal and external personnel) who will have the obligation to apply it in the performance of their work activities.

In compliance with article 12 of the Royal Decree of the ENS, this Security Policy will be developed applying the following minimum requirements and will be included in the system documentation:

Audits will be carried out to review and verify compliance of the ISMS/ENS of IAG7 Viajes with the requirements of the ISO/IEC 27001 Standard for the ISMS and with Royal Decree 311/2022, of January 8, which regulates the National Security Scheme, so the personnel affected by the scope of said audits must be collaborative for their effectiveness, as well as in the application of corrective actions. that are derived for continuous improvement.

Our management system has the following structure: Security Policy, regulations and internal procedures and records.

The management of our system is entrusted to the person responsible for the information.

The Information Security Committee will proceed to review and propose the approval of this Information Security Policy to the General Directorate, which is Responsible for Information.

In addition, the Security Committee will centralize the coordination and conflict resolution mechanisms between the responsible parties indicated below, which will be discussed through debate during the meetings of the members of said Committee and which will be moderated by the General Directorate:

The Security Committee, representing the General Management, will be the body in charge of approving the Policy and will be responsible for authorizing its modifications, as well as all the documented information from the entity's ISMS/ENS.

The Information Security Manager will be in charge of notifying this Policy to the entity's staff and of the changes that may occur therein, as well as coordinating the implementation, maintenance and improvement actions of the entity's ISMS/ENS (including the signing of the Declaration of Applicability that formalizes the list of applicable security measures derived from the Risk Analysis), and its audits, with the Systems Manager who will be in charge of managing the technical security requirements of the systems. of information, and with the Responsible for the Service, whose figure falls on the directors of the areas of the entity, who will be in charge of managing the security requirements of the activities of their area for the provision of services.

The person responsible for each information and/or service affected by the risk analysis and management will be indicated in the ISMS/ENS Risk Map, which will include the criteria that will determine the level of security required, within the framework established in article 40 and the general criteria prescribed in Annex I of the Royal Decree of the ENS.

The Data Protection Manager, in collaboration with the Security Committee, undertakes to deal with the risks arising from the processing of personal data and will therefore be responsible for ensuring that personal data is processed and protected in accordance with the General Data Protection Regulation (GDPR EU 2016/679), and will therefore work in coordination with the Information Security Manager and the Systems Manager.

All personnel of the organization, both internal and external, will be responsible for complying with this Information Security Policy within their work area, as well as for applying all the documented information of the controls and security measures of the ISMS/ENS of IAG7 Viajes in their work activities that affects their performance in information security.

This Information Security Policy will be examined in system reviews by Management through the Information Security Committee whenever significant changes occur and at least once a year.

This Information Security Policy will be approved by the General Directorate of IAG7 Viajes by signature and disseminated to the interested parties.

Likewise, the General Directorate will provide the necessary resources for the effective application of this policy, and for its proper development, both in implementation activities.

IAG7 Viajes has the duty to structure our management system in a way that is easy to understand. Our management system has the following structure: POLICIES, PROCEDURES AND RECORDS.

The management of our system is entrusted to the person responsible for the information and the system will be available in our information system in a repository, which can be accessed according to the access profiles granted according to our current access management procedure.

Differences in criteria that could lead to a conflict will be dealt with within the Security Committee and the criteria of the General Management will prevail in all cases.

The main data protection risks for IAG7 Viajes are:

To mitigate these risks, IAG7 Viajes has implemented the following measures:

Following the principles of legality, loyalty and transparency, the relevant information regarding personal data collected from employees and clients is detailed below:

At IAG7 Viajes, depending on the category of interested party in question, we process the information you provide us with the following purposes:

The legal basis for the processing of your personal data, depending on the category of interested party in question, may be:

The data we request from you is adequate, relevant and strictly necessary and in no case are you obliged to provide it to us, but failure to provide it may affect the purpose of the service or the impossibility of providing it.

Your data will be kept for the minimum time necessary for the correct provision of the service offered, as well as to meet the responsibilities that may arise from it and any other legal requirement.

Additionally, we inform you that certain data, by virtue of current regulations or the contractual relationship you maintain with IAG7 Viajes, may be communicated to:

As we have indicated previously, for the management of the purposes inherent to the development and fulfillment of the contracted service, it may be necessary and mandatory to communicate your data to certain suppliers such as airlines, shipping companies, hotels and other service providers. These providers, depending on the country of destination of your trip, may be located in third countries for which it is necessary to carry out an international data transfer and/or they may be located in countries that do not have adequate guarantees. In any case, we will ensure that any international transfer complies with the necessary guarantees, in order to guarantee the confidentiality of your information.

INTEGRATION AGENCIA DE VIAJES could carry out international transfers of data derived from the acceptance of cookies from this website:

Google Llc and Google Ireland Limited transfer data to the United States based on the user's consent by accepting cookies.

By accepting cookies from these entities, the user consents that their personal data that may be collected through the loading and reading of cookies be transferred to the United States, a country in which a level of protection comparable to the European one is offered, only in those American companies included in the EU-US data privacy list, in what is known as the “Data Privacy Framework” (hereinafter, “DPF”). If American companies are not members of the DPF, it will be understood that they do not guarantee a level of protection comparable to the European one.

If the user does not consent to this international transfer of data to the United States, they must reject these cookies, not providing or obtaining the functionalities or services offered with these cookies.

You can find out about transfers to third countries that, where applicable, are carried out by the third parties identified in thecookie policyin their corresponding policies.

The data protection rights that interested parties may exercise, when applicable, are:

You can use the following models to carry out your rights exercises:

The owners of the personal data obtained may exercise their personal data protection rights by sending a written communication to the registered office of Integración Agencias de Viajes S.A. or to the email enabled for this purpose,dpo@iag7viajes.com.

You have models, forms and more information available about your rights on the website of the national control authority, Spanish Data Protection Agency, hereinafter, AEPD, inwww.aepd.es

You have the possibility and the right to withdraw consent for any specific purpose granted at the time, without affecting the legality of the treatment based on consent prior to its withdrawal.

If any interested party considers that their data is not processed correctly by IAG7 Viajes or that the requests to exercise rights have not been satisfactorily attended to, they may file a claim with the corresponding data protection authority, the AEPD being the one indicated in the national territory,www.aepd.es.

In order to safeguard the security of your personal data, we inform you that IAG7 Viajes has adopted all the necessary technical and organizational measures to prevent its alteration, loss, and/or unauthorized processing or access, as required by regulations, although absolute security does not exist.

It is important that, so that we can keep your personal data updated, you always inform us when there is a change to it.

IAG7 Viajes informs you that your data will be treated with the utmost care and confidentiality by all personnel involved in any of the processing phases. We will not transfer or communicate your data to any third party, except in the cases legally provided for, or unless the interested party has expressly authorized us.