PRIVACY POLICY

1. Data Controller

The controller of the personal data collected through this website is the owner of this website. You can contact us with any question at our contact email: info@ibizasinfiltro.com.

2. Data we process and purposes

• Contact form: name, email, message and any other data you choose to provide. Purpose: respond to your enquiry.
• Route bookings: first name, surname, email, phone, booking details and, where applicable, billing information. Purpose: process the contract and tax obligations.
• Browsing data (cookies): if you accept analytics or marketing cookies, we collect cookie IDs, truncated IP, pages visited, device and browsing behaviour through Google Analytics and/or Google Ads. Purpose: measure site usage and improve our services. More info in our Cookie Policy.

3. Legal basis

• Consent of the data subject (art. 6.1.a GDPR) for contact forms and non-technical cookies.
• Performance of a contract (art. 6.1.b GDPR) for bookings.
• Compliance with legal obligations (art. 6.1.c GDPR) in tax and accounting matters.
• Legitimate interest (art. 6.1.f GDPR) to ensure site security.

4. Retention period

• Contact enquiries: up to 1 year after the last communication.
• Booking data: during the service and afterwards up to 6 years for accounting and tax obligations (Spanish Commercial Code).
• Cookies: the period indicated for each cookie in the Cookie Policy.
• Cookie consent: 12 months from granting, after which it is requested again.

5. Recipients and processors

We don't sell your data. To provide our services we rely on the following providers acting as processors or third parties with their own policies:

• Vercel Inc. — hosting and delivery of the website.
• Google Ireland Ltd. — Google Analytics and Google Tag Manager (analytics), and Google Ads (marketing), if you accept the corresponding cookies.
• Email and customer support providers used to respond to enquiries or manage bookings.
• Public authorities when there is a legal obligation.

6. International transfers

Some providers (Google, Vercel) may process data in the USA. These transfers are covered by the EU-U.S. Data Privacy Framework and, alternatively, by Standard Contractual Clauses approved by the European Commission, in accordance with articles 45 and 46 GDPR.

7. Your rights

As the data subject you can exercise the following rights by sending an email to info@ibizasinfiltro.com, stating the right you exercise and attaching a copy of an ID document:

• Access, rectification and deletion.
• Objection and restriction of processing.
• Data portability.
• Not to be subject to automated decisions.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

If you believe your request has not been properly handled, you can file a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid.

8. Security measures

We apply appropriate technical and organisational measures to ensure an adequate level of security, in accordance with article 32 GDPR (encryption in transit, access control, backups, etc.).

9. Changes to this policy

This policy may be updated to reflect legal or operational changes. We will always publish the current version on this page with the date of the last update.