Data controller
- Name: Maria Mercedes Izquierdo Aviño
- NIF: 25156934V
- Address: Avinguda dels Banys 28, 08860 Castelldefels (Barcelona), Spain
- Email: [email protected]
- Website: https://www.castelldefelstapastour.com
Data we collect
Depending on how you interact with us, we may collect the following personal data:
- First and last name
- Email address
- Phone number (if provided)
- Dietary restrictions or food allergies — only if voluntarily provided in the booking form
- Payment data processed by our payment gateway (we do not store card details)
- Browsing data collected via cookies, subject to your prior consent
Purposes and legal basis
We process your data for the following purposes:
- Booking management and service delivery — legal basis: performance of a contract (Art. 6.1.b GDPR).
- Managing dietary restrictions or allergies — legal basis: explicit consent (Art. 9.2.a GDPR), as this constitutes special category data.
- Booking confirmation and reminders — legal basis: performance of a contract and legitimate interest (Art. 6.1.b / 6.1.f GDPR).
- Compliance with legal accounting and tax obligations — legal basis: legal obligation (Art. 6.1.c GDPR).
- Web analytics via cookies — legal basis: consent (Art. 6.1.a GDPR).
Data retention
- Booking and billing data: minimum 5 years, to comply with legal accounting obligations.
- Allergy data: deleted once the service has been completed.
- Web analytics data: as per the retention periods set out in our Cookie Policy.
Recipients and international transfers
Your data may be shared only with:
- Stripe, Inc.: solely to process the payment transaction. See stripe.com/en/privacy.
- Google LLC (Google Analytics): for web analytics, subject to your prior consent. Transfer to the US is covered by Standard Contractual Clauses.
- Meta Platforms Ireland Ltd. (Meta Pixel): for analytics and advertising, subject to your prior consent.
No other international data transfers take place.
Your rights
Under the GDPR, you have the right to access, rectify, erase, port, restrict or object to the processing of your personal data, and to withdraw your consent at any time.
To exercise any of these rights, email us at [email protected] stating which right you wish to exercise and attaching a copy of your ID.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Security
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure, in accordance with the GDPR.
Cookies
This website uses first-party and third-party cookies. For full details on which cookies we use, their purpose and how to manage them, please read our Cookie Policy.
Changes to this policy
We may update this Privacy Policy to reflect changes in legislation or our services. We will notify you of any significant changes by publishing the new version on this page with the updated date.