Privacy and Data Protection Policy
This policy details the exact use of personal data across all LEMS 360 interaction channels. We operate with transparency regarding our privacy practices to ensure understanding of the implications and control over the information provided.
1. Responsible for the processing
The legal entity that manages the LEMS 360 platform and is responsible for the processing of data is Toledo les 360 SL with NIF B27597228. Its registered office is at Carretera de Fuencarral N.º 44, building 5, loft 43, 28108, Alcobendas, Madrid. The face-to-face operation takes place at the premises at Calle Tornerías, 8, 45001, Toledo. The company assumes the full obligation to protect personal information. Contact regarding data protection is through email info@lems360.com.
2. Purpose and legitimacy
The processing of personal data is strictly in accordance with the purpose of the channel used. The applicable purposes and legal bases are as follows:.
A) Purchasing and services management
We process the name, surname, email address, phone number, postal code, country and transactional information (the result of the transaction, transaction identifier and, where applicable, last digits or token of the card provided by the payment gateway; LEMS 360 does not access or store the full details of the payment method, managed directly by the payment entity) to process the purchase and send the access confirmation to the routes. We request a declaration of age to verify that the user is over 8 years old (Article 7 LOPDGDD) and that the contracting party is of legal age, without requiring the full date of birth by default. We manage incidents, complaints or notify any changes that impact the route. Legitimation: Execution of the purchase contract. It is impossible to formalize access without providing these data.
B) Events and corporate reservations
We process identification and financial information to organize personalized events through our form. We require an age verification of over 8 years old. We respond to requests for changes or operational issues. The system does not store information about allergies in a personalized way. Legitimation: Execution of the reservation contract. When the reservation includes minors under 8 years of age, authorization from the holder of parental authority or guardianship will be required, obtained through a verifiable and provided procedure; the mere completion of the form does not in itself constitute legal representation.
C) Group visits
We process the data of the group manager and transaction details to process the joint reservation. We maintain mandatory age verification of over 8 years. Legitimation: Execution of the group visit contract.
D) User support and assistance
We use the information provided via forms or the phone to resolve technical issues with the immersive application, manage inquiries, and process complaints. We check the legal limit of 8 years during the support. Legitimation: application of pre-contractual measures or execution of the contract (Article 6.1.b GDPR) when the query concerns a reservation or service; in the remaining queries, legitimate interest in responding to user requests (Article 6.1.f GDPR).
E) Quality analysis and surveys
We send questionnaires to travelers after they complete their journey to measure the performance of the virtual environment and improve the service. We exclusively handle email or phone inquiries and the responses issued. Legitimation: Corporate legitimate interest in the technical optimization of the service, evaluated and documented internally. The interested party may object to this processing at any time (Article 21 GDPR) and any communication will include a simple and free means to stop receiving it.
F) Promotions and profiling
We analyze the history of purchased routes and socio-demographic criteria to suggest new experiences. We perform this profiling without generating legal effects on the person. Legitimation: (i) express consent (Article 6.1.a of the GDPR) for the sending of commercial communications and the profiling of those who are not customers; and (ii) legitimate interest (Article 6.1.f of the GDPR and Article 21.2 of the LSSI) only regarding customers and for communications about own services similar to those contracted. The profiling is based on the history of purchased routes and the declared socio-demographic data, and its sole consequence is the personalization of commercial suggestions. The interested party may object at any time, and each communication will include a simple and free deactivation mechanism.
G) Selection of personnel
We evaluate the skills and professional background of applicants to fill technical or narrative positions. Legitimation: application, at the request of the interested party, of pre-contractual measures (Article 6.1.b GDPR). Consent will be obtained solely for additional purposes, such as the preservation of the candidacy for future processes.
H) Management of lost objects in the physical establishment
We process only the data strictly necessary to manage the search and return of lost belongings within the premises located at Calle Tornerías, Toledo. Legitimation: Corporate legitimate interest to assist the owner in recovering their property.
I) Management of lost personnel
Protocol annulled. LEMS 360 operates autonomously on public roads and lacks its own closed premises where it would apply a system of searching and locating users in accordance with regulations.
J) Cookies
We implement tracking technologies to ensure the security of the session, compile statistical metrics, and customize web browsing, in accordance with the Cookie Policy and the consent managed in the configuration banner.
K) Legal obligations
We process transactional and identification records to comply with fiscal regulations, e-commerce regulations, and consumer protection regulations. Legitimation: the unavoidable compliance with the national and European legal framework applicable to the company.
L) Geolocalization and usage data of the web application
The route guidance requires accessing the device location through the browser, with the user’s permission, revocable at any time from the browser or device settings. The calculation of real-time position and proximity to the points of the route is performed entirely in the user’s browser; GPS coordinates are not transmitted or stored on LEMS 360 servers. The server receives and stores exclusively a progress log composed of: the log identifier, the identifier of the acquired route, the number of the reached stop, the status of the route (ongoing or completed) and a user identifier — randomly generated in the browser for unregistered users, or the account identifier when the user logs in with their account or PIN. This progress log is kept for the duration of the contractual relationship linked to the route, in accordance with the deadlines indicated in section 3. The providers involved in the mapping and geolocation guidance are Google Maps, and in terms of usage analytics, Google Analytics, both with Google Ireland Limited as the contractual entity, as detailed in section 4. The denial or revocation of the location permission will prevent geolocated guidance, without affecting the rest of the functions. Legitimation: execution of the contract (Article 6.1.b GDPR) for route guidance and the persistence of progress; consent (Article 6.1.a GDPR) for any additional uses.
3. Conservation criteria
The information life cycle is governed by precise regulatory deadlines.
- Acquisitions and events: We retain the information for the duration of the contractual relationship related to the route.
- Technical support: We keep the record for the time necessary to close the claim.
- Polls: We delete the responses after a maximum period of 12 months.
- Commercial communications: We process the data until the formal execution of the right of revocation or cancellation.
- Job applications: We destroy the files 12 months after receiving them, unless the candidate consents to a longer period.
- Lost items: We delete the data 3 months after the loss is recorded.
When the operational deadlines have expired, we technically block the information, reserving it exclusively for the Control Authority, Judges or Courts during the periods of limitation of legal actions. Once the limitation period has expired, we proceed to the definitive deletion of the information, including its progressive removal from the backup copies according to their technical rotation cycles.
4. Recipients
We communicate the information to the competent authorities exclusively upon firm legal requirements. Security technology providers, cloud hosting and payment gateways access the data while acting as data controllers under strict corporate guidelines, lacking the legal capacity to use them for their own purposes. The main services used are: web hosting lems360.com, booking platform bokun.io, payment gateway stripe.com, Email, support and phone support info@lems360.com, Analytics and advertising (Google Analytics, contractual entity: Google Ireland Limited) and map and geolocation providers (Google Maps, contractual entity: Google Ireland Limited). When any of these services involves international data transfers, these are covered by adequacy decisions or other safeguards under Chapter V of the GDPR, as detailed in the Cookie Policy and in the specific information for each service.
5. User rights
The legal framework guarantees control over personal data. All interested parties have the right to exercise access, rectification, opposition, deletion, limitation, portability and not to be subject to automated individual decisions. To exercise these rights, a request can be sent to the privacy contact via email. info@lems360.com; Only proof of identity will be requested when there are reasonable doubts about it (Article 12.6 GDPR) or by postal mail to Carretera de Fuencarral N.º 44, building 5, loft 43, 28108, Alcobendas, Madrid.
6. Origin
We obtain the data directly through web interaction and platform registration. The introduction of third-party data requires the user to ensure that they are authorized to provide it and to inform the data owners in advance; this does not exempt Toledo les 360 SL from fulfilling its own obligations as the controller, including the obligation to inform such data owners when required (Article 14 GDPR).
7. Minimum legal age
The contracting of routes requires 8 completed years for the purposes of consent regarding data protection (Article 7 of the LOPDGDD); the conclusion of the contract and payment shall in any case be made by an adult person. The participation of minors under 8 years of age shall require the authorization of the holder of parental authority or guardianship, obtained through a verifiable and appropriate procedure.
8. Authority for claims
We invite the interested party to contact our privacy contact in advance. info@lems360.com To resolve any issue; although this in no case constitutes a prerequisite. It maintains the power to file formal complaints with the Spanish Data Protection Agency (AEPD).www.aepd.es) to safeguard their rights.
Date of entry into force: 01/10/2026.