Legal
Privacy Policy
How Varsity collects, uses and protects your personal data.
Last updated: November 2026
At a glance
Basic information on data protection
1. Who is responsible for your data
The controller of the personal data collected through varsityse.com is:
- Company: PLAY CAMINO S.L., trading as Varsity Sports & Educational Tours
- Tax ID: B24908980
- Address: Carrer Canigó 5, 08757 Corbera de Llobregat (Barcelona), Spain
- Email: [email protected]
- Phone: +34 646 848 860 (Europe) · +1 301 800 0929 (North America)
This policy explains how we process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD) and Law 34/2002 on Information Society Services (LSSI).
2. What data we collect
We only collect the data we need for each purpose:
- Contact form and emails: name, email, phone, school / club / organisation, type of trip, approximate group size, preferred dates and the content of your message.
- Tour organisation: data of group leaders and travellers needed to book and run the tour, such as full name, date of birth, nationality, passport or ID details, emergency contacts, room allocation, dietary requirements and, when strictly necessary, relevant health information (for example allergies or medical conditions).
- Billing: details of the organisation or person responsible for payment.
- Images: photos and videos taken during tours, as set out in section 6.
- Browsing data: technical data such as IP address, browser and pages visited, collected through cookies as described in our Cookies Policy.
Health information is a special category of data. We only process it when it is needed to protect travellers’ wellbeing during the tour, with the explicit consent of the traveller or, for minors, of their parent or legal guardian, and we share it only with those who need it to provide the service.
3. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries sent through the contact form, email or phone, and preparing quotes. | Your consent and pre-contractual steps taken at your request (art. 6.1.a and 6.1.b GDPR). |
| Organising and running the tour: bookings with suppliers, travel documents, rooming lists, assistance during the trip. | Performance of the contract with the group (art. 6.1.b GDPR). |
| Processing health data relevant to the trip. | Explicit consent (art. 9.2.a GDPR) and, in an emergency, the vital interests of the traveller (art. 9.2.c GDPR). |
| Invoicing, accounting and tax obligations. | Compliance with legal obligations (art. 6.1.c GDPR). |
| Sending information about future tours and events to schools, clubs and contacts we have worked with. | Legitimate interest or your consent (art. 6.1.f and 6.1.a GDPR, art. 21 LSSI). You can opt out at any time. |
| Publishing photos and videos of tours on our website and social media. | Consent of the traveller or, for minors, their parent or legal guardian (art. 6.1.a GDPR). |
| Website security and basic statistics. | Legitimate interest and, for non-essential cookies, your consent. |
Fields marked as required in our forms are necessary to answer you; if they are not provided we may not be able to deal with your request.
4. Minors
Many of our tours are for school and youth teams. Data about travellers under 18 is provided by their school, club or parents and is processed only to organise and run the tour. In Spain, minors under 14 cannot consent to the processing of their data themselves; in those cases, and whenever the law requires it, we rely on the consent of their parents or legal guardians, usually collected through the school or club. Our website is not directed at children, and we ask minors not to send us personal data through the contact form.
5. Who we share your data with
We do not sell or rent personal data. We only share it when necessary for the purposes above with:
- Travel service providers that deliver your tour: airlines, hotels, transport companies, sports venues, guides, restaurants and insurers.
- Technology providers acting on our behalf, such as website hosting, email and office software. They process data only on our instructions and under a data processing agreement.
- Public authorities, banks and advisors when required by law or to manage payments and our tax obligations.
6. Photos and videos
During tours we may take photos and videos of activities. We will only publish images in which travellers can be identified on our website, brochures or social media when we have the appropriate consent, collected through the school, club or traveller before the trip. You may withdraw this consent at any time by writing to [email protected], and we will remove the images within a reasonable time from the channels we control.
7. International transfers
Because we organise tours in Europe, the Americas and other destinations, and work with groups from outside the European Union, some data must be transferred outside the European Economic Area — for example to hotels and suppliers in the destination country or to our team in North America. These transfers are made when necessary to perform the contract you have requested (art. 49.1.b GDPR), to countries with an adequacy decision from the European Commission (such as Argentina, or certified companies in the United States under the EU-U.S. Data Privacy Framework) or with Standard Contractual Clauses approved by the European Commission.
8. How long we keep your data
- Enquiries that do not lead to a booking: up to 2 years, so we can follow up on future trips, unless you ask us to delete them earlier.
- Tour and contract data: for as long as the relationship lasts and afterwards for the periods required by law to address possible claims and tax obligations (generally up to 6 years for accounting records).
- Health data: only for the duration of the tour and deleted afterwards, unless it is needed to deal with an incident.
- Images: until you withdraw your consent.
9. Your rights
You can exercise the following rights at any time, free of charge:
- Access your personal data and receive a copy.
- Rectification of inaccurate or incomplete data.
- Erasure of your data when it is no longer needed.
- Objection to processing based on legitimate interest, including direct marketing.
- Restriction of processing in certain cases.
- Portability of the data you provided to us.
- Withdrawal of consent, without affecting processing carried out before.
To exercise them, write to [email protected] with the subject “Data protection” and include information that allows us to identify you. We will reply within one month. If you are not satisfied with our answer, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country.
10. Security
We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure, including encrypted connections (HTTPS) on our website, access only by authorised staff and confidentiality agreements with our providers.
11. Cookies
Our website uses cookies. You can find information about the cookies we use and how to manage them in our Cookies Policy.
12. Changes to this policy
We may update this policy to reflect legal or operational changes. The current version will always be available on this page with its date of last update.
Last updated: November 2026