Legal Terms of the “Black Friday 2025 with Civitatis” Campaign

FIRST – Organizing Company, Purpose, Duration and Scope

The promotional contest and raffle are organized by Civitatis Tours S.L. (hereinafter, “CIVITATIS”), with registered office at Calle Coloreros 2, 28013 Madrid.

CIVITATIS is launching, for promotional purposes, the “Black Friday 2025 with Civitatis” campaign (hereinafter, the “Campaign”) at an international level. It will be carried out online and is open to participants of legal age.

The Campaign will begin on November 28, 2025, and will end on December 5, 2025. Notwithstanding the above, CIVITATIS reserves the right to modify the Campaign dates at its discretion.

SECOND – Participation Requirements

All people(hereinafter, the “Participants”) who accept these Legal Terms and meet the following participation rules may take part in the Campaign:

• Register, or already be registered, on the Civitatis website (www.civitatis.com).
  
• Once logged in, they must purchase at least two (2) products or activities in a single transaction during the Campaign period using the direct link from the promotional newsletter identifiable with ID 510. This grants the buyer one (1) entry into the Campaign.

THIRD – Prizes, Draw Conditions and Awarding

The prize for this Campaign consists of reimbursing each winner for the amount of their winning purchase in the form of Civitatis Balance through the CIVITATIS Wallet, up to a maximum of ONE THOUSAND EUROS (€1,000). If the winning purchase exceeds €1,000, the maximum refundable amount will still be €1,000.

There will be up to three (3) winners, each different, selected at the sole discretion of CIVITATIS through a draw carried out via the CoolTabs application among users who meet the participation requirements. Participants who have not strictly followed all steps will be automatically removed. Any profile detected as false or fraudulent will also be removed.

Canceled purchases will be automatically excluded. If a cancellation is detected after the prize is awarded, CIVITATIS may void the winner’s prize.

Only purchases that include at least two (2) products or activities will qualify. Each qualifying purchase grants one (1) entry, with no participation limit.

Once CIVITATIS identifies the winners, they will be notified from December 31, 2025, onwards, by phone or email using the contact details provided at registration. CIVITATIS may also publish the winners’ names and surnames on the Civitatis Magazine blog (www.civitatis.com/blog/).

The refunded amount, issued as Civitatis Balance via the CIVITATIS Wallet, will be valid until December 31, 2026. After this date, the balance will expire. The balance must be redeemed before its expiration date.
If a winner cannot be reached within seven (7) calendar days of notification, the prize will be awarded to the next eligible participant. The initial winner will be deemed to have irrevocably waived the prize. If the substitute cannot be reached within seven (7) calendar days, the prize will be declared void.

The prize is non-transferable and cannot be exchanged for cash or other products. Any taxes or expenses resulting from accepting the prize will be borne by the winner unless expressly assumed by CIVITATIS.

FOURTH – Taxation of the Prize

All applicable tax provisions under current Spanish law apply to this prize. The winner must comply with the tax obligations associated with the awarded prize. If the winner is a Spanish tax resident, the prize may be subject to withholding (for cash prizes) or income on account (for in-kind prizes), in accordance with applicable tax regulations.

If the winner is not a Spanish tax resident, the prize may be subject to NRIT (Non-Resident Income Tax) withholding if applicable. CIVITATIS will handle any required withholding or income on account and pay it to the Spanish Tax Agency on behalf of the winner.

All other tax obligations are the sole responsibility of the winner. CIVITATIS will issue a certificate with the relevant information if required.

FIFTH – Limitations

The following persons may not participate or receive the prize, even as companions:
(i) CIVITATIS employees and their relatives;
(ii) Individuals who directly or indirectly hold shares in CIVITATIS;
(iii) Any Notary designated by CIVITATIS to notarize these terms, as well as their employees;
(iv) Any individual who participated directly or indirectly in preparing or executing the Campaign (agencies, suppliers, etc.).

By accepting these Legal Terms, Participants consent to CIVITATIS excluding or disqualifying entries that violate these Legal Terms. Entries submitted after the Campaign end date or that fail to meet requirements will be void. CIVITATIS may exclude Participants suspected of fraud.

If winners or substitutes fail to meet requirements or fail to provide requested documentation, they will be disqualified.

The prize cannot be modified, exchanged, or compensated. CIVITATIS reserves the right to modify, suspend, or extend the Campaign for justified reasons. Claims may be submitted within fifteen (15) calendar days after the prize is awarded. Participants will not be charged any additional amount to take part in the raffle.

CIVITATIS may replace prizes with others of similar characteristics if necessary.

SIXTH – Disclaimer of Liability

 CIVITATIS is not responsible for, including but not limited to:

• The winner’s use of the prize.
• Damages arising from temporary unavailability of telecommunication services.
• Services provided by third-party collaborators.
• Force majeure or unforeseen events preventing the Campaign or prize enjoyment.

CIVITATIS may cancel or modify the Campaign in case of fraud, technical errors, or other causes beyond its control.

SEVENTH – Limitation on Photo Content and Comments

Prohibited content includes:

• Discriminatory content violating rights to honor, privacy, image, or dignity, based on race, sex, religion, opinion, nationality, disability, etc.
• Illegal activities, obscene or defamatory content.
• Self-harm-related content or content promoting drug use or eating disorders.
• Violence, including sexual violence or violence against animals or people.
• Degrading, intimidating or threatening content.
• Sexual content of any kind.
• False content, including fake “likes” or social media indicators.
• Promotional content of personal products.
• Manipulated or extrapolatable content.

Violation of these rules may result in exclusion.
CIVITATIS is not liable for damages caused by participant-submitted photographs.

EIGHTH – Personal data Protection

Data Controller: The personal data provided as a result of your participation in this giveaway will be processed by CIVITATIS TOURS S.L. (CIVITATIS), with registered address at C/ Coloreros 2, 28013, Madrid, and contact email comunicacion@civitatis.com.

Data Protection Officer (DPO): The DPO is a legally established role whose main functions are to inform and advise our organization on the obligations concerning the protection of personal data and to supervise compliance with them.

Additionally, the DPO acts as a point of contact for any issues related to the processing of personal data. Therefore, if you have any questions, concerns, or suggestions regarding how we use your personal data, you can contact us at: dpo@civitatis.com

Purpose of Data Processing: We process the personal data you provide for the following purposes:

• To manage your participation in this giveaway, as well as the delivery of prizes.
• To announce the winners of the giveaway through the channels described in these terms and conditions, specifically by publishing their identifying information.
• To send commercial communications about the products and services of the entities organizing the giveaway.

Providing your data for the purposes indicated is mandatory; otherwise, you will not be able to participate in this giveaway.

Data Retention: As a general rule, personal data will be retained for the duration of the giveaway and, afterwards, for as long as any legal liability related to it may arise. The winners’ data will remain published indefinitely.

Data processed for the purpose of sending commercial communications (identifying and contact information) will be retained indefinitely, until the user withdraws their consent or objects to such data processing.

Legal Basis: The legal basis for processing your data is the execution of the contractual relationship arising from your acceptance of the terms and conditions governing participation in the giveaway.

The legal basis for sending commercial communications is the consent given by the participants, which may be communicated through any of the contact addresses provided or by any other means offered by the organizing entities. Consent can be withdrawn at any time; however, this will not affect the lawfulness of data processed prior to withdrawal.

Recipients of the Data: Data will be processed confidentially; however, due to the operational nature of the giveaway, participants’ data may be shared with the following third parties:

• The competent Public Administrations, in cases provided for by law and for the purposes defined therein.
• The winners’ data will be published on the CIVITATIS Magazine blog (www.civitatis.com/blog/).

Exercise of GDPR Rights: Any individual has the right to obtain confirmation as to whether we are processing personal data concerning them. Interested parties have the right to access their personal data, as well as to request the correction of inaccurate data or, where applicable, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Under the conditions set out in the General Data Protection Regulation, data subjects may request the restriction of the processing of their data or its portability, in which case we will only retain it for the exercise or defense of claims.

In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. If you have given consent for a specific purpose, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. In such cases, we will stop processing the data or, where applicable, stop processing it for that specific purpose, unless there are compelling legitimate reasons, or for the exercise or defense of possible claims.

Furthermore, data protection regulations allow you to object to being subject to decisions based solely on automated processing of your data, where applicable.

The aforementioned rights are characterized as follows:

• Exercising them is free of charge, except in the case of manifestly unfounded or excessive requests (e.g., repetitive requests), in which case a proportional fee may be charged to cover administrative costs, or the request may be refused.
• You can exercise your rights directly or through your legal or voluntary representative.
• We must respond to your request within one month, although, taking into account the complexity and number of requests, the period may be extended by up to two additional months.
• We are obliged to inform you of the means to exercise these rights, which must be accessible, and you cannot be denied the exercise of a right simply for choosing a different means. If the request is submitted electronically, the information will be provided through the same means whenever possible, unless you request otherwise.
• If, for any reason, the request is not processed, we will inform you, no later than one month, of the reasons and of the possibility to file a complaint with a Supervisory Authority.
  

To facilitate the exercise of these rights, we provide the following links to the request forms for each right:

• Right of Access Request Form
• Right to Rectification Request Form
• Right to Object Request Form
• Right to Erasure Request Form (right “to be forgotten”)
• Right to Restrict Processing Request Form
• Right to Data Portability Request Form
• Right Not to Be Subject to Automated Individual Decision-Making Request Form

To exercise any of these rights, send a message to dpo@civitatis.com.

In case of any violation of your rights, especially if you do not obtain satisfaction in their exercise, you may file a complaint with the Spanish Data Protection Agency (contact details available at www.aepd.es) or another competent supervisory authority. You may also obtain more information about your rights by contacting these organizations.

Source of the Data: Personal data is provided by participants in the giveaway.

If third-party data is provided, the provider assumes responsibility for informing them in advance of everything provided in Article 14 of the General Data Protection Regulation under the conditions established in that provision.

Measures to Protect Personal Data: We are firmly committed to protecting the personal data we process. We use physical, organizational, and technological measures, controls, and procedures that are reasonably reliable and effective, aimed at preserving the integrity and security of your data and ensuring your privacy.

In addition, all personnel with access to personal data have been trained and are aware of their obligations regarding the processing of personal data.

For contracts we enter into with our providers, we include clauses requiring them to maintain confidentiality regarding personal data accessed under the assignment and to implement the necessary technical and organizational security measures to ensure the permanent confidentiality, integrity, availability, and resilience of personal data processing systems and services.

All these security measures are periodically reviewed to ensure their adequacy and effectiveness.

However, absolute security cannot be guaranteed, and no security system is impenetrable. Therefore, if any information under our control is compromised due to a security breach, we will take appropriate measures to investigate the incident, notify the Supervisory Authority if applicable, and, if necessary, inform affected users so they can take appropriate action. Responsibility of Participants: Participants are responsible for the truthfulness of the data they provide and are liable for any false or inaccurate data they submit, as well as for any direct or indirect damages that may result.

NINTH – Changes and Acceptance

CIVITATIS may modify or extend these terms, provided it does not harm Participants’ rights.

Participation in the Campaign implies full acceptance of these Legal Terms by the Participants who register in the Campaign. These Terms may, at CIVITATIS’s discretion, be formalized in a Notarial Deed; however, they will always be available to anyone who wishes to consult them.

TENTH – Applicable Law and Jurisdiction

These Legal Terms will be interpreted and governed in accordance with Spanish law. Any claims or disputes regarding the validity, interpretation, or enforcement of these terms shall be subject, with express waiver of any other jurisdiction, to the courts and tribunals of the city of Madrid (Spain). Nevertheless, every effort will be made to resolve any disputes arising from this Contest amicably before resorting to legal action.