How we collect, use and protect your data
This Privacy Policy is developed in accordance with the General Data Protection Regulation (GDPR) of the European Union and the legislation of Spain. We respect your right to privacy and strive to protect your personal data. By using our website and services, you agree to the terms of this Policy.
When using our website and booking services, we may collect the following information:
Your personal data is used for the following purposes:
Your personal data is processed on the following legal bases:
Data processing for fulfilling the booking contract
Marketing communications, use of cookies
Service improvement, analytics, fraud prevention
Tax accounting, interaction with government agencies
We do not sell or transfer your personal data to third parties for commercial purposes. Your data may be shared only with: tour guides for tour organisation, transport companies, hotels and restaurants (as part of bookings), payment systems for payment processing, and government authorities where legally required. All third parties are bound by confidentiality obligations.
All tours are conducted within Spain (European Union). Your data is processed in accordance with GDPR requirements and is not transferred to countries outside the EU without appropriate safeguards.
Your personal data is retained for the duration of the booking contract and for 5 years thereafter in accordance with Spanish tax legislation. Technical data (IP addresses, logs) is retained for up to 12 months for security and statistical purposes. After these periods, data is destroyed or anonymised.
Under GDPR, you have the following rights: the right to access your data, the right to rectification, the right to erasure (right to be forgotten), the right to restrict processing, the right to data portability, the right to object to processing, and the right to withdraw consent at any time.
We take all necessary technical and organisational measures to protect your data: data encryption (SSL/TLS), access restriction, regular backups and security monitoring. All data is transmitted via secure channels.
For any questions regarding the processing of your personal data, you can contact us by email: privacy@traveltours.com or by phone: +34 911 234 567. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
We record how this website is used, so that we can see which tours attract interest and where visitors run into difficulty. This record covers every visitor, not only those who accept cookies, because it is limited to operating and improving our own website and is not used for advertising. We record:
We do not store your IP address. It is read once to determine your country and then discarded — it is never written to disk, never sent to anyone, and cannot be recovered from the information we do keep. You are recognised by the session identifier our website already sets to keep your booking form working; only a one-way hash of it is stored, so it cannot be traced back to you.
These notifications are delivered through Telegram (telegram.org), a messaging service operated outside the European Union, so that our staff receive them in real time. They are used solely to monitor and improve this website and to respond to enquiries. Visitor logs are deleted after 30 days; the live visitor view expires within 8 hours.
You may object to this processing at any time by contacting us using the details in section 10, and we will stop recording your visits. No advertising profile is built from this data, no automated decisions are made about you, and nothing is sold or shared for marketing.