PRIVACY POLICY
The purpose of this Policy is to inform data subjects about the different processing activities carried out by the organizations responsible through the website that affect their personal data, all in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.
Company name: Vueling Airlines, S.A.
NIF/VAT: A-63422141
Registered address: Viladecans Business Park, Edif. Brasil, Carrer de Catalunya, 83, 08840, Viladecans (Barcelona)
Contact details of Vueling's Data Protection Officer: data.protection@vueling.com
Vueling privacy policy: https://www.vueling.com/es/atencion-al-cliente/politica-deprivacidad https://www.vueling.com/es/atencion-al-cliente/politica-deprivacidad
Company name: Foundspot, S.L.
NIF/VAT: B87946877
Registered address: C/ Alameda No. 22 (28014) Madrid,
Contact details of Foundspot's Data Protection Officer: infodpo@forlopd.es
Foundspot privacy policy: https://www.foundspot.com/es/politica-privacidad/ https://www.foundspot.com/es/politica-privacidad/
Your personal data will be processed by VUELING AIRLINES, S.A. as Data Controller until the item is found and you are informed that it has been recovered.
Once your item has been located, FOUNDSPOT will process your data as Data Controller for the purpose of delivering it to you, except where the recovered item is handed directly to the passenger and no postal shipment is made.
We will process the personal data provided for the following purposes:
● To handle requests, complaints and incidents submitted through the contact channels available on our website in relation to compliance with legal obligations.
● To comply with the legal obligations directly applicable to us.
● To protect and exercise our rights or respond to claims of any kind on the basis of our legitimate interest in protecting our image, business and track record.
● To manage requests to locate lost items at our facilities and cross-check them against the existing inventory on the basis of compliance with legal obligations.
● To receive, store and manage the operational processing of location requests on the basis of compliance with legal obligations.
• To manage the scheduling of the return of the identified item on the basis of the performance of the contract entered into.
• To carry out procedures related to the shipment of the identified item and the associated administrative, accounting and tax procedures, all on the basis of the performance of the contract entered into and compliance with the legal obligations associated with that contractual relationship.
a. a. managing communication with the data subject regarding all matters relating to the postal shipment of the located item;
b. b. arranging the postal shipment of the recovered item (shipping details)
c. c. managing payments, incidents, returns or claims relating to the postal shipment of the item.
• We will process the personal data provided to understand the visitor's behavior on the website in order to identify and prevent possible cyberattacks against the website, on the basis of our legitimate interest in ensuring the security of the platform, protecting users' data and preserving the integrity of our systems.
• To manage your registration on the entity's web platform and create a username and password on the basis of your consent. Refusal to provide such authorization will make it impossible to register on the platform.
The personal data provided will be retained for as long as necessary to fulfil the purposes for which it was initially collected.
Once the data are no longer necessary for the relevant processing activity, they will be duly blocked and, where applicable, made available to the competent public authorities and bodies, Judges and Courts or the Public Prosecutor's Office, for the limitation period applicable to any actions that may arise from the relationship maintained with the customer and/or for the legally established retention periods.
Data blocking period:
• CIVIL CODE. Between 1 and 5 years, depending on the case, in accordance with Articles 1964.2 and 1968.2 of the aforementioned legislation.
• COMMERCIAL CODE. For 6 years, in accordance with Article 30 of the aforementioned legislation. This applies to commercial information relating to (issued and received invoices, receipts, corrective invoices, bank documents, etc.).
• GENERAL TAX LAW. For 4 years, in accordance with Articles 66 to 70 of the aforementioned legislation. This applies to information relating to tax obligations.
The website does not make automated decisions or create profiles.
As part of our services, we use the Redsys payment gateway to process financial transactions and ensure that your payments are made securely and efficiently. We recommend that you review the Redsys privacy policy in advance to
understand how they handle your personal information by clicking here.
During the period for which your personal data are processed, the organization may disclose your data to the following recipients:
• Judges and Courts.
• State law enforcement and security forces.
• Other competent public authorities or bodies, where the controller is legally required to provide the personal data.
• Banks and financial institutions.
• Courier and delivery companies for the shipment of the identified item.
The organization does not carry out any International Data Transfers. If it subsequently becomes necessary to carry out international data transfers, the level of protection in the destination country will be assessed and the safeguards required by applicable regulations will be adopted.
Data subjects may request further information about the processing of their personal data and may exercise, at any time and free of charge, their rights of access, rectification and erasure, as well as request restriction of the processing of their personal data, object to such processing, request data portability (where technically possible), withdraw the consent provided and, where applicable, not be subject to a decision based solely on automated processing, including profiling.
To do so, you may send a written request to the postal or email address indicated in the controller's header to whom you wish to address your request to exercise your rights. For these purposes, please note that you may be asked to provide your DNI or another equivalent document in order to verify your identity, provided that this cannot be done by less intrusive means.
If you believe that your rights regarding data protection have been infringed, particularly where you have not obtained satisfaction when exercising your rights, you may lodge a complaint with the competent Data Protection Supervisory Authority (Spanish Data Protection Agency) through its website www.aepd.es
The user guarantees that the data provided are true, accurate, complete and up to date, and undertakes to inform us of any changes to the data provided through the channels made available for this purpose and indicated in section one of this Policy. The user shall be responsible for any damage or loss, whether direct or indirect, that may arise as a result of failure to comply with this obligation.
If the user provides third-party data, they declare that they have obtained the consent of the data subjects and undertake to provide them with the information contained in this clause, releasing the organization from any liability arising from failure to comply with this obligation.
This Privacy Policy may be amended/updated in accordance with applicable legal requirements or in order to adapt it to instructions issued by the Spanish Data Protection Agency, or as a result of changes to the website. For this reason, we recommend that users visit our Privacy Policy periodically.
If you have any questions about this Policy, you may contact the controllers by sending a written request to the postal address or email address referred to in the heading.
Last reviewed: 09 September 2026.