Privacy Policy

Data controller

The controller of personal data is FH GLOBAL, S.L., trading under the name VIAJES FH. Company NIF: B72398340; registered address: Paseo Quince de Mayo, 3, Bajo 1, 28019 Madrid, España.

If you have questions about the processing of personal data or this Policy, you can email [email protected], or call +34 919 471 812.

Scope of this Policy

This Policy applies to the processing of personal data when you visit www.fhglobal.es, submit a travel enquiry or quote request, create a booking request, manage cruises and other travel services, or contact us through the website. Processing related to employees, suppliers or other independent business relationships may be governed by separate, specific notices.

Data we process

Depending on the features you use, we may process contact names, telephone numbers, email addresses, correspondence and travel requirements; passenger names, dates of birth, nationalities, passport or identity document details; itinerary, cabin, special assistance requirements, order numbers, payment status and details needed for invoicing.

Our website infrastructure may also generate IP addresses, browser and device types, access times, request paths, security events and error logs. We only process the data needed to provide the relevant service, protect security or meet legal obligations.

Purposes and legal bases for processing

We process data to respond to enquiries, prepare quotes and take pre-booking steps at your request; establish, manage and perform travel service contracts; contact travellers and provide customer support; and handle changes, cancellations, refunds, complaints and rights requests. The relevant legal basis is primarily taking pre-contractual steps at your request and performing a contract that has already been concluded.

To comply with requirements relating to travel agencies, consumer protection, accounting, taxation, fraud prevention and competent authorities, we may process necessary data on the basis of applicable legal obligations. To protect the security of the website and services, prevent misuse and maintain business records, we may process necessary data on the basis of legitimate interests, provided this does not override the data subject’s fundamental rights.

We will request separate, clear and withdrawable consent only when processing requires consent. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Other travellers and special data

If you provide data on behalf of other travellers, you must ensure that you are authorised to provide the relevant data and inform them about this policy. We will request passport, health, mobility assistance, dietary or other more sensitive data only when it is genuinely necessary to confirm the itinerary, supplier or traveller’s individual circumstances.

When processing special categories of data, such as health data, we will restrict access and, where required by applicable law, obtain explicit consent or rely on another lawful basis for processing.

Recipients of data

To provide the requested travel services, necessary data may be shared with cruise lines, airlines, hotels, local operators, insurers, transfer or activity providers, payment service providers and competent authorities legally entitled to receive the data. Suppliers will receive only the data needed to provide the relevant service.

Authorised staff and service providers supplying cloud infrastructure, website hosting, communications, security, technical support and business software may also process necessary data, subject to contractual and confidentiality obligations. We do not sell travellers’ personal data.

International data transfers

Travel services may involve destinations and suppliers outside the European Economic Area. When data must be transferred to suppliers abroad, we will limit the scope of the transfer according to the itinerary and contractual requirements and, where applicable, rely on European Commission adequacy decisions, standard contractual clauses, statutory derogations for transfers necessary to perform a contract requested by the traveller, or other valid safeguards.

Booking data required for MSC-related services may be shared with MSC Cruises S.A., located in Switzerland. Switzerland is currently recognised by the European Commission as providing an adequate level of protection. You can contact us using the contact email address to learn about the safeguards applicable to a specific transfer.

Technical storage and operation logs

As of the date this policy was updated, the public website does not use advertising, cross-site tracking, or user behavior analytics cookies. The cruise order linking feature temporarily stores the order number in the current browser tab’s sessionStorage for up to approximately two minutes, then deletes it after it is read; this storage is used only to complete the order linking you requested.

Hosting, security, and content delivery infrastructure may generate necessary access and security logs to provide the website, prevent attacks, and troubleshoot issues. These technical records are not used to create advertising profiles unrelated to this service. If the website enables non-essential tracking technologies in the future, we will update this notice before enabling them and provide choices as required by law.

Retention period

Inquiry data is retained for the time needed to provide a response and reasonable follow-up; booking, contract, invoice, payment and complaint data is retained for as long as necessary to provide the service, handle claims and comply with accounting, tax, travel agency and consumer protection obligations. Once the applicable retention period expires, the data will be deleted, anonymized or restricted from processing for the duration of any statutory liability period.

If the booking request is not confirmed, we will not retain your data indefinitely for the duration applicable to a confirmed order; the specific retention period may also be adjusted to account for unresolved complaints, judicial requests, or legally mandated retention obligations.

Your data protection rights

You may exercise your rights of access, rectification, erasure, restriction of processing, objection to processing, and data portability, and withdraw your consent where processing is based on consent. Please contact [email protected] Submit a request; to prevent information from being disclosed improperly, we may require identity verification proportionate to the risk.

If you believe that the processing of your personal data does not comply with applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency. Spanish Data Protection Agency (AEPD) Submit a complaint.

Data Security and Automated Decisions

We use access controls, permission restrictions, transmission safeguards, logging, and other appropriate technical and organizational measures based on the nature of the information and the risks involved. Internet transmissions cannot be guaranteed to be completely risk-free. If a personal data security incident occurs that we are legally required to report, we will take appropriate action and fulfill our notification obligations in accordance with applicable rules.

The public website does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for travelers. Prices, availability, and order status are rechecked against authoritative information from the supplier and service provider before the service is confirmed.

Policy Updates and Related Terms

We may update this policy in response to changes in the law, our services, or technology, and will indicate the date at the top of the page. We will notify you of significant changes in an appropriate manner to the extent required by applicable law.

For information about website use, bookings, changes, refunds, and liability, please see Terms of Service.