Privacy policy

Through the website tripstop.eu, Sherpas Time Consulting S.L provides you with this privacy policy in order to inform you in detail about how we process your personal data and protect your privacy and the information you provide to us. Should we make any changes to it in the future, we will notify you through the website or by other means so that you can learn about the new privacy terms introduced.

In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation, and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights, we inform you of the following:

Data controller

For what purposes do we process your personal data?

At Sherpas Time Consulting S.L we collect and process your personal information, as a general rule, to manage our relationship with you. The main purposes we have identified are the following:

How do we collect your information?

We collect your personal information through different means, but you will always be informed at the time of collection, through information clauses, about the data controller, the purpose and legal basis of the processing, the recipients of the data and the retention period of your information, as well as how you can exercise your data protection rights.

In general, the personal information we process is limited to identification data (first name and surname, date of birth, address, national ID number, phone number and email address), contracted services, and payment and billing data.

For staff management and recruitment, we collect academic and professional data in order to meet the obligations arising from the employment relationship or, where applicable, for you to join our team.

Sherpas Time Consulting S.L uses social networks, and this is another way of reaching you. The information collected through the messages and communications you publish may contain personal information that is available online and accessible to the public. These social networks have their own privacy policies explaining how they use and share your information, so Sherpas Time Consulting S.L recommends that you consult them before using these networks to confirm that you agree with the way your information is collected, processed and shared.

Through our website we collect information about your browsing by means of our own and third-party cookies (for example, Google) for technical, analytical, personalisation and advertising purposes. Strictly necessary cookies are installed without the need for consent; all others are only activated if you accept them. You can view the full list of cookies and accept them, reject them or change your choice at any time via the “Cookie settings” link in the website footer.

When you use our mobile app, and in order to provide you with the services it offers, we use the geolocation data of your mobile device if you have this feature enabled. If geolocation is not enabled, we will inform you and ask for your permission beforehand by means of a notification. Most mobile devices allow users to disable these services at will, usually through the device’s settings menu. If you have any questions about how to enable/disable this feature, please consult your device manufacturer’s website or contact your mobile operator.

User responsibility

By providing us with your data through electronic channels, the user guarantees that they are over 14 years of age and that the data provided to Sherpas Time Consulting S.L is true, accurate, complete and up to date. To this end, the user confirms that they are responsible for the accuracy of the data provided and that they will keep this information duly updated so that it reflects their actual situation, being liable for any false or inaccurate data they may provide, as well as for any direct or indirect damage or loss that may result from it.

How long do we keep your information?

At Sherpas Time Consulting S.L we only keep your information for as long as necessary to fulfil the purpose for which it was collected, to comply with the legal obligations imposed on us and to address any liabilities that may arise from fulfilling the purpose for which the data was collected.

If you wish to join our team and apply for one of our positions, the data you provide will become part of our job pool and will be kept for the duration of the selection process and for a maximum of 2 years, or until you exercise your right to erasure.

If at any time we have collected your data in order to contact you as a potential user of our services or to respond to a request for information you have made, such data may be kept for a maximum of 3 years from its collection, and will be deleted after that period if no contractual relationship has been formalised, or as soon as you ask us to do so.

In any case, and as a general rule, we will keep your personal information for as long as a contractual relationship between us exists or until you exercise your right to erasure and/or restriction of processing. In that case, the information will be blocked and not used beyond its storage, for as long as it may be necessary for the exercise or defence of claims or as long as any liability that must be addressed may arise.

Who do we share your data with?

In general, Sherpas Time Consulting S.L does not share your personal information, except for those disclosures we are required to make under legal obligations.

However, in order to develop and provide the requested service, we disclose your data to other partner companies and/or startups. You can inform us that you object to the disclosure of your data, although in that case it would not be possible to provide the requested service. Although this does not constitute a disclosure of data, in order to provide the requested service, third-party companies acting as our suppliers may access your information to carry out the service we have contracted from them. These processors access your data following our instructions, may not use it for any other purpose and maintain the strictest confidentiality. Should it be necessary as a result of an incident recorded by our security cameras, your images could be disclosed to the State Security Forces and Corps, in accordance with the law.

Likewise, your personal information will be available to Public Administrations, Judges and Courts for the purpose of addressing any liabilities arising from the processing.

Communications between users

To enable interaction between users within any of our tools, personal information may be shared. For example:

International data transfers

Some of the providers we use to deliver our services process personal data outside the European Economic Area (EEA), specifically in the United States. In all cases, we have the appropriate safeguards required by the GDPR.

You can consult each provider’s privacy policy via the links in the “Data processors – Virtual assistant” section of this policy.

Virtual assistant

TripStop offers an artificial intelligence virtual assistant, available on this website, in the app, via Facebook and Instagram messaging or via WhatsApp, which allows travellers to get real-time support at the camper spots managed through TripStop.

Purpose of processing: Incident management and real-time operational support for travellers during their stay at a TripStop camper spot.

Data processed:

Legal basis: Performance of the service contract (Art. 6.1.b GDPR) and TripStop’s legitimate interest in providing the service (Art. 6.1.f GDPR).

Retention period: 15 days in the systems of the data processors, after which the data is deleted.

Handover to a human: Once the assistant has gathered the information needed to resolve the incident, the conversation is transferred to TripStop’s internal staff for final handling.

Identification as AI: In compliance with Art. 50 of Regulation (EU) 2024/1689 (AI Act), the assistant explicitly identifies itself as an artificial intelligence virtual assistant in its welcome message.

Data processors – Virtual assistant

To provide the virtual assistant service, TripStop uses the following data processors:

What are your rights regarding the processing of your data and how can you exercise them?

Data protection legislation allows you to exercise your rights of access, rectification, erasure and data portability, and to object to and restrict processing, as well as the right not to be subject to decisions based solely on the automated processing of your data, where applicable.

These rights have the following characteristics:

To make it easier for you to exercise them, here are the links to the request form for each right (forms in Spanish):

To exercise your rights, Sherpas Time Consulting S.L makes the following means available to you:

In both cases, you must prove your identity by enclosing a photocopy or scanned copy of your national ID card or equivalent document, so that we can verify that we only respond to the data subject or their legal representative, in which case a document proving such representation must be provided.

Likewise, and especially if you consider that you have not obtained full satisfaction in the exercise of your rights, you may lodge a complaint with the national supervisory authority by contacting the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan, 6 – 28001 Madrid (Spain).

How do we protect your information?

At Sherpas Time Consulting S.L we are committed to protecting your personal information.

We use reasonably reliable and effective physical, organisational and technological measures, controls and procedures aimed at preserving the integrity and security of your data and guaranteeing your privacy.

In addition, all staff with access to personal data have been trained and are aware of their obligations in relation to the processing of your personal data.

The contracts we sign with our suppliers include clauses requiring them to maintain the duty of confidentiality regarding the personal data they have accessed by virtue of the assignment, as well as to implement the technical and organisational security measures necessary to guarantee the ongoing confidentiality, integrity, availability and resilience of the personal data processing systems and services.

All these security measures are reviewed periodically to ensure their adequacy and effectiveness.

However, absolute security cannot be guaranteed and no security system is impenetrable. Therefore, should any information processed and under our control be compromised as a result of a security breach, we will take the appropriate measures to investigate the incident and notify the Supervisory Authority and, where applicable, any users who may have been affected so that they can take the appropriate measures.

Translation notice: this document is a translation of the original Spanish version, provided solely to make it easier to understand. In the event of any discrepancy, contradiction or doubt of interpretation between the two versions, the Spanish version shall prevail in all circumstances.