Privacy policy

Data controller: Ecotour Experiences. Contact: info@ecotourexperiences.com. Full identification of the owner (name, NIF, address) is in the legal notice.

This policy complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD). Appointing a data protection officer is not mandatory: given the volume and type of processing, the privacy contact functions are carried out directly by the controller at the contact address given above.

What data we process and why

• Enquiries and bookings: identity, contact details and travel preferences (destination, dates, number of people, level), to reply to you and organise the activity or trip.
• Health or physical condition data: only if you choose to share it with us and it is relevant to your safety during the activity (injuries, conditions, allergies, medication, limitations). We do not ask for it in the enquiry form or in the chat: when it is needed, it is collected in a specific questionnaire before the departure, with its own consent box. It is handled with particular care: access is restricted to the staff who organise and guide that departure (including the guide or the local operator at the destination, and only with what is essential for your safety), it is not used for any other purpose, and it is deleted when the activity ends, unless there is a legal obligation to keep it. See the legal basis below.
• Booking: billing and payment data needed to formalise the booking and meet tax and accounting obligations.
• Marketing communications: name and email when you voluntarily subscribe to the newsletter.
• The website's virtual assistant: the text you type in the chat, to give you guidance on the catalogue (see the "Virtual assistant" section).
• Security and operation: minimal technical browsing information and your cookie consent preference.

Legal basis

• Enquiries and bookings: pre-contractual measures at your request and, once you have booked, performance of the contract (art. 6.1.b GDPR).
• Health data (special category, art. 9 GDPR): your explicit consent (art. 9.2.a), collected with its own box in the health questionnaire before the departure, not in the website's enquiry form, and which you can withdraw at any time. That same consent covers passing on what is essential to the guide or the local operator at the destination when it is necessary for your safety. If you do not provide the health data needed to assess your safety, we may not be able to confirm your participation in certain activities.
• Billing and accounting: compliance with legal obligations (art. 6.1.c).
• Marketing communications, advertising and loading of external content: your consent (art. 6.1.a), which can be withdrawn. This includes the Meta pixel used to measure and target our Facebook and Instagram campaigns, which is only activated if you accept the "Advertising" category in the cookie banner.
• Basic website security: legitimate interest (art. 6.1.f).

Recipients and providers

We pass on the essential data to the guides, accommodation providers, carriers and local collaborators needed to deliver the service you book. We also work with the following processors and technology providers:

• Cloudflare: hosting, security and delivery of the website, and the infrastructure behind the virtual assistant.
• HubSpot: contact management and sales follow-up system for enquiries, including tracking of your visit to the website if you accept the "CRM" cookie category (see the cookie policy).
• MailerLite: sending the newsletter to those who subscribe.
• Stripe: processing card payments (deposits and booking payments). Card details are collected directly by Stripe; Ecotour never sees or stores them.
• Resend: sending the emails that manage your booking (confirmations, payment links, notices).
• Cloudflare Turnstile: anti-bot check on booking forms, with no advertising tracking.
• Google (calendar and work email): internal organisation of departures and communication with people who book.
• Google (Analytics / Tag Manager and YouTube): aggregate traffic measurement and playback of embedded videos. Only after your consent.
• WhatsApp (Meta): if you write to us on WhatsApp, the conversation is processed on Meta's platform under its terms. It is an optional channel: you can also use email or the phone.
• Meta (Facebook/Instagram pixel): measuring our advertising campaigns and building remarketing audiences. Only after your consent to the "Advertising" category.

Several of these providers (Cloudflare, HubSpot, MailerLite, Stripe, Resend, Google, Meta) may process data outside the European Economic Area. When they do, it is under the EU-U.S. Data Privacy Framework or other safeguards accepted by the GDPR, such as the European Commission's standard contractual clauses.

Virtual assistant

The website includes a chat assistant that answers using the real catalogue of trips and activities. The text you type is processed by a language model hosted on Cloudflare's infrastructure (Workers AI) for the sole purpose of generating the answer you see on screen. It is not used to train models, it is not cross-referenced with your commercial profile, and the conversation only persists in your browser during the session. Do not enter in the chat any data you do not want to share; for matters involving personal or health data, use email or the phone.

Retention

Enquiries are kept for as long as needed to reply and, as a general rule, for up to 12 months from the last contact. Booking data is kept for the legal periods of liability, accounting and taxation. The subscription lasts until you withdraw it. Your cookie preference is reviewed at most every 24 months.

Your rights

You can request access, rectification, erasure, objection, restriction or portability, or withdraw a consent, by writing to the email address given and proving your identity where necessary. We will reply within a maximum of one month, extendable by a further two months for particularly complex requests (we would notify you within the first month). Withdrawing consent does not affect processing carried out before.

If you consider that your rights have not been dealt with, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

Automated decisions and minors

We do not make automated decisions with legal or similarly significant effects. The website's virtual assistant and recommender only offer guidance: any booking is always confirmed with a member of the team. Minors must provide data through their legal representatives where applicable.