Privacy Policy

This policy explains how we process personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Who is responsible for your data

Data controller	[Owner’s full legal name or company name]
NIF / CIF	[NIF / CIF]
Address	[Registered postal address, Spain]
Contact for privacy matters	[Contact email address]

2. The short version

• You can use AndaluciaTours without an account and without giving us your name or email.
• If you write to us, we use your details only to reply.
• We use Google Analytics to understand, in aggregate, how the website is used.
• We do not sell your personal data. We do not pass it to tour operators.
• When you follow a link to a tour operator, its own privacy policy applies from that point.

3. What we collect, why, and on what legal basis

Purpose	Data	Legal basis	How long we keep it
Replying to your messages and requests	Name, email address, the content of your message	Our legitimate interest in answering you, or steps you ask us to take before a contract (Art. 6(1)(f) and 6(1)(b) GDPR)	While we deal with your request, then up to 12 months, unless we need to keep it longer to handle a legal claim
Measuring how the website is used (Google Analytics)	Online identifiers stored in cookies, pages visited, referring site, device and browser type, approximate location (country or city)	Your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE)	Analytics cookies up to 2 years; event-level analytics data no longer than 14 months
Keeping the website secure and working	IP address, date and time, pages requested, browser information (server logs)	Our legitimate interest in running a secure website (Art. 6(1)(f) GDPR)	Short periods set by our hosting provider, normally a few weeks

We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Links to tour operators

When you click through to a tour operator’s website, we do not send it your name, email or any other personal data. Like any website you visit, the operator receives standard technical information from your browser. If the link is a partner link, it may contain a code identifying AndaluciaTours as the source of the visit. From that point, the operator’s (and, where relevant, the affiliate network’s) privacy and cookie policies apply.

5. Who we share data with

We only share personal data with service providers who process it on our behalf, under contracts that require them to protect it:

• our website hosting provider (DreamHost), which stores the website and its server logs;
• Google Ireland Limited, which provides Google Analytics;
• our email provider, which stores messages you send us.

We may also disclose data where the law requires it, for example to a court or public authority.

6. International transfers

Some of these providers, or their group companies, are based in the United States. Where data is transferred outside the European Economic Area, it is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or by the European Commission’s Standard Contractual Clauses.

7. Your rights

You can ask to access your personal data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect processing carried out before you withdraw it. To exercise your rights, write to [Contact email address]. We may ask you to confirm your identity. We will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority of the EU country where you live.

8. Children

AndaluciaTours is not aimed at children. We do not knowingly collect personal data from anyone under 14, the age of digital consent in Spain.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and keeping our software up to date.

10. Cookies

Details of the cookies we use and how to control them are in our Cookie Policy.

11. Changes to this policy

We will update this policy if the way we process personal data changes, for example when we launch new services. The date at the top of the page shows the latest version.