Privacy Policy

At Biosphere Responsible Tourism, S.L. ("BRT", "we" or "us") we treat the personal data provided to us with respect and integrity, and we are committed to protecting the privacy of the individuals whose data we receive through our websites www.biospheretourism.com and www.biospheresustainable.com.

This Privacy Policy explains what personal data we process, for what purposes and on what legal basis, for how long we retain it, to whom we disclose it and what rights you have. The processing of personal data is always carried out in accordance with:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, "GDPR");
  • Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD");
  • Law 34/2002, of 11 July, on information society services and electronic commerce ("LSSI"), and
  • any other applicable data protection regulations.

SECTION 1. Data Controller

The controller responsible for the processing of your personal data is:

Biosphere Responsible Tourism, S.L. (BRT)

CIF: B76584770

Registered office: C/ La Rosa, 1, 1st floor, 38002, Santa Cruz de Tenerife, Canary Islands, Spain

Email: info@biospheresustainable.com

Telephone: (+34) 922 24 29 04

SECTION 2. Definitions

To make this policy easier to understand, we explain below the main terms we use, in accordance with Article 4 of the GDPR:

  • Personal data: any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
  • Data subject: the natural person whose personal data is being processed.
  • Processing: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • Restriction of processing: the marking of stored personal data with the aim of limiting its processing in the future.
  • Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
  • Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
  • Recipient: a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
  • Third party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
  • Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

SECTION 3. Personal data we process

Depending on your relationship with us, we may process the following categories of personal data:

  • Registration and account data: first and last name, email address, access credentials and, where applicable, position and the entity you represent, provided when registering on our training or certification platforms.
  • Certification service data: the entity's contact persons' details and the information provided throughout the certification process (documentation and evidence submitted, communications with the audit team, audit reports, certification decisions and associated records).
  • Training service data: enrolment data, course progress, assessment results and any diplomas or certificates of completion issued.
  • Billing and transaction data: identification and tax details, billing address, details of the services purchased and amounts. Card or other payment method details are processed directly by the payment gateway provider; BRT does not have access to them.
  • Enquiry and correspondence data: the information you provide when contacting us by email, web forms, telephone or our platforms' messaging (ticketing) system, together with the metadata associated with those communications.
  • Complaint, claim and appeal data: the information you provide when submitting a complaint, claim or appeal relating to our services.
  • Browsing data: IP address, Internet service provider, browser type and version, operating system, referring website, pages visited, date and time of access and other similar technical data, which are recorded in the server's log files. If you accept this through the cookie settings panel, we also collect usage data for analytics purposes (see Section 8).

Where the data is not provided to us directly by you, its source will generally be the entity you represent (for example, where a company or a destination provides us with its contact person's details) or the entity that has purchased a service and assigned it to you by means of a code.

If you provide us with personal data relating to other individuals (for example, colleagues at your organisation), you must have previously informed them of the matters set out in this policy and, where applicable, have the necessary legal basis to do so.

We do not request special categories of data (such as health data, ethnic origin, political opinions or religious beliefs). Please do not include this type of information in the documentation you provide to us unless it is strictly necessary and you have informed us of this beforehand.

SECTION 4. Purposes and legal bases for processing

We process your personal data for the following purposes and on the following legal bases (Article 6.1 GDPR):

  • To manage your registration and user account on our platforms. Legal basis: performance of a contract or taking steps at your request prior to entering into a contract (Art. 6.1.b GDPR).
  • To provide the certification services, including reviewing the application, assessment and audit, the certification decision, issuing the certificate, monitoring and surveillance activities, and the communications inherent to the process (audit notices, instructions, deadlines and payments). Legal basis: performance of the certification contract (Art. 6.1.b GDPR).
  • To publish information on certified entities in our public online repository, on the terms set out in the contractual documentation of the certification service. Legal basis: performance of the certification contract (Art. 6.1.b GDPR).
  • To provide the training services and issue the corresponding diplomas or certificates. Legal basis: performance of a contract (Art. 6.1.b GDPR).
  • To issue invoices and comply with our accounting and tax obligations. Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR).
  • To handle your enquiries and requests for information. Legal basis: taking steps at your request prior to entering into a contract or, where applicable, our legitimate interest in responding to the communications we receive (Art. 6.1.b and 6.1.f GDPR).
  • To manage complaints, claims and appeals. Legal basis: performance of the contract and compliance with the obligations applicable to us as a certification body and in the field of consumer and user protection (Art. 6.1.b and 6.1.c GDPR).
  • To send our customers commercial communications about our own services similar to those contracted. Legal basis: legitimate interest (Art. 6.1.f GDPR), on the terms of Article 21.2 of the LSSI. You may object at any time, as explained in Section 9.
  • To send newsletters and commercial communications to individuals who are not customers. Legal basis: consent (Art. 6.1.a GDPR), which you may withdraw at any time.
  • To ensure the security of our websites and systems, prevent fraud and cyberattacks and, where applicable, provide the competent authorities with the necessary information in the event of a cyberattack. Legal basis: legitimate interest (Art. 6.1.f GDPR) and, where applicable, compliance with a legal obligation (Art. 6.1.c GDPR).
  • To analyse the use of our websites by means of non-technical cookies. Legal basis: consent (Art. 6.1.a GDPR and Art. 22.2 LSSI).
  • To bring, exercise or defend legal claims. Legal basis: legitimate interest (Art. 6.1.f GDPR).

Where the legal basis is legitimate interest, we have weighed that interest against your rights and freedoms. You may request further information on this balancing test through the contact details in Section 1.

We do not make decisions based solely on automated processing of your data, including profiling, which produce legal effects concerning you or similarly significantly affect you. Certification decisions are taken by persons designated by BRT on the basis of the results of the assessment process.

Providing the data requested as mandatory in our forms is necessary in order to provide you with the corresponding service. If you do not provide it, we will not be able to deal with your request or provide you with that service.

SECTION 5. Retention periods

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the legally required periods:

  • Registration and account data: for as long as you keep your user account active.
  • Certification service data and records: for the duration of the contractual relationship and, once it has ended, in accordance with the EEC-Biosphere Certification Regulation and BRT's records control procedure.
  • Training service data: for the duration of access to the course and, thereafter, for 3 years so as to be able to evidence the training undertaken.
  • Billing data: for a minimum of six (6) years, in accordance with Article 30 of the Commercial Code, and in any case for the periods required by tax legislation.
  • Enquiries and correspondence: for as long as necessary to deal with them and, where applicable, for the limitation periods of any potential liabilities.
  • Complaints, claims and appeals: while being processed and, thereafter, in accordance with BRT's complaints and appeals procedure.
  • Commercial communications: until you object to receiving them or withdraw your consent.
  • Server log files: for a maximum of [12 months], unless it is necessary to retain them for longer in order to investigate a security incident or for the formulation, exercise or defence of claims.
  • Cookies: for the periods indicated in our Cookie Policy.

Once these periods have elapsed, the data will be erased. Where legally required, the data will be kept blocked, in accordance with Article 32 of the LOPDGDD, available only to judges and courts, the Public Prosecutor's Office or the competent public authorities, for the purpose of addressing any liabilities arising from the processing, and only for the limitation period of such liabilities.

SECTION 6. Recipients of the data

We do not sell or rent your personal data. We will only disclose it in the following cases:

  • Data processors who provide us with services necessary for our activity, with whom we have signed the corresponding data processing agreement in accordance with Article 28 of the GDPR and who may only process the data following our instructions. These include:
    • Projectes a Internet Enginyeria de Software, S.L. (NIF B66797119, C/ Aragó 517, 6-1, 08013 Barcelona), developer and maintenance provider of our websites, platforms and email and communications server;
    • Google Ireland Limited, as provider of the Google Analytics web analytics service, only if you have accepted analytics cookies.
  • External auditors who take part in the certification processes on behalf of BRT, subject to written confidentiality undertakings.
  • The accreditation body, in exercising its functions of assessing BRT as a certification body, to the extent strictly necessary.
  • The training body, in the exercise of its training functions for the online courses available on the BRT campus, to the extent strictly necessary. In the case of ITR courses, ITR is the owner of these courses: it prepares the content, appoints the teaching team, manages enrolment, payment and invoicing, and issues and signs the diplomas.
  • The entity that has purchased a service and assigned it to you by means of a code, which will only receive the data indicated in Section 7 of our Terms and Conditions (services assigned and used, company name and contact email address).
  • The general public, with regard to the information on certified entities published in our public online repository, on the terms set out in the contractual documentation of the certification service.
  • Public authorities, judges and courts, the Ombudsman, data protection authorities and law enforcement bodies, where there is a legal obligation to provide them with the data or where necessary to bring, exercise or defend legal claims.

The processing of information obtained or generated in the certification processes is additionally subject to our Confidentiality Policy.

SECTION 7. International data transfers

As a general rule, we process your data within the European Economic Area (EEA). Some of our providers, such as Google, may process data outside the EEA, in particular in the United States. In such cases, transfers are carried out with the safeguards set out in Chapter V of the GDPR, such as an adequacy decision of the European Commission (for example, the EU-U.S. Data Privacy Framework, where the recipient adheres to it) or the standard contractual clauses approved by the European Commission. You may request further information on these safeguards through the contact details in Section 1.

SECTION 8. Cookies

Our websites use technical cookies, necessary for their operation, which are installed without the need for consent. All other cookies (personalisation, analytics and advertising cookies) are only installed if you accept them through the banner or the cookie settings panel, where you may also reject them or withdraw your consent at any time. If you disable certain cookies, some website features may not be available.

You can consult details of the cookies we use, their purpose and their duration in our Cookie Policy.

SECTION 9. Commercial communications and how to stop receiving them

You may stop receiving our commercial communications and newsletters at any time and free of charge, through any of the following means:

  • following the unsubscribe link included in each communication;
  • accessing your user profile and selecting the "Do not receive news" option, or
  • writing to us at info@biospheresustainable.com.

Please note that, if you are a customer, you will continue to receive the communications necessary for the provision of the contracted service (for example, registration confirmations, audit notices, instructions for completing the certification or training process, deadlines and payment reminders), as these form part of the performance of the contract.

SECTION 10. Minors

Our services are aimed at professionals and entities, and are not intended for minors. We do not knowingly collect personal data from children under fourteen (14) years of age, who, in accordance with Article 7 of the LOPDGDD, may not give their own consent.

If we discover that we have collected data from a child under fourteen without the consent of their parents or guardians, we will erase it as soon as possible. If you believe we hold data on a minor, you may notify us at info@biospheresustainable.com.

SECTION 11. Data security

We apply appropriate technical and organisational measures, in accordance with Article 32 of the GDPR, to ensure a level of security appropriate to the risk and to protect your personal data against unauthorised destruction, loss, alteration, disclosure or access. For example, access to our databases is restricted to authorised staff and segmented according to their functions, so that each person only accesses the information they need to perform their duties.

Payment information is always transmitted encrypted. However, no transmission over the Internet is completely secure, so we recommend that you safeguard your access credentials appropriately and do not share them with third parties.

SECTION 12. Your rights

In relation to your personal data, you may exercise the following rights:

  • Access: obtain confirmation as to whether we are processing your personal data and, if so, access it and information on the purposes of the processing, the categories of data, the recipients, the retention period and its origin. The first copy of your data will be free of charge; for additional copies we may charge a reasonable fee based on administrative costs.
  • Rectification: request the rectification of inaccurate data and the completion of incomplete data.
  • Erasure: request the erasure of your data where, among other reasons, it is no longer necessary for the purposes for which it was collected, you withdraw the consent on which the processing was based, you object to it, or the data has been unlawfully processed. This right does not apply where processing is necessary, among other cases, to comply with a legal obligation or to bring, exercise or defend legal claims.
  • Restriction of processing: request that we restrict the processing of your data where you contest its accuracy, while we verify it; where the processing is unlawful and you oppose its erasure; where we no longer need it, but you need it for the purpose of bringing, exercising or defending legal claims; or where you have objected to the processing, while we verify whether our legitimate grounds override yours.
  • Portability: where the processing is based on your consent or on the performance of a contract and is carried out by automated means, receive the data you have provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller, provided this does not adversely affect the rights and freedoms of others.
  • Objection: object, on grounds relating to your particular situation, to the processing of your data based on our legitimate interest. In such a case, we will stop processing it, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or that the processing is necessary to bring, exercise or defend legal claims. You may also object at any time to the processing of your data for direct marketing purposes; in that case, we will stop processing it for that purpose.
  • Not to be subject to automated individual decisions: not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.
  • Withdrawal of consent: where the processing is based on your consent, withdraw it at any time, without affecting the lawfulness of the processing carried out before its withdrawal.

How to exercise your rights. You may exercise these rights free of charge by writing to info@biospheresustainable.com or by post to the address indicated in Section 1, stating which right you wish to exercise. If we have reasonable doubts as to your identity, we may request the additional information necessary to confirm it. We will respond within one (1) month of receiving your request, which may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. In that case, we will inform you of the extension and its reasons within the first month.

Complaint to the supervisory authority. If you consider that the processing of your personal data does not comply with the applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid; [www.aepd.es](https://www.aepd.es)) or with the supervisory authority of the European Union Member State where you have your habitual residence, your place of work, or where the alleged infringement took place. Before doing so, you may contact us to try to resolve the matter.

SECTION 13. Accuracy of the data

We take reasonable steps to ensure that the personal data we process is accurate and up to date. To this end, we ask that you notify us of any change to your data, or update it directly in your user profile. You guarantee that the data you provide to us is true, accurate, complete and up to date, and you are liable for any damage that may arise from providing false or inaccurate data.

SECTION 14. Amendments to this policy

We may update this Privacy Policy, for example to adapt it to legal changes or new services. The current version will always be available on our websites, indicating the date of its last update. If the changes are material, we will notify you by email or through the messaging (ticketing) system of our platforms.

SECTION 15. How to contact us

For any question, suggestion or complaint regarding the processing of your personal data, you may contact us at:

Biosphere Responsible Tourism, S.L. (BRT)

CIF: B76584770

Registered office: C/ La Rosa, 1, 1st floor, 38002, Santa Cruz de Tenerife, Canary Islands, Spain

Email: info@biospheresustainable.com

Telephone: (+34) 922 24 29 04

Last updated: 28 September 2026