Privacy Policy

We process personal data in line with the GDPR (EU) 2016/679 and the Spanish data protection act LOPDGDD (Ley Orgánica 3/2018). For each processing activity below you can see why we use data, on what legal basis, who receives it and how long we keep it.

Last updated: 9 August 2026

Controller

Controller: Eugenio Garcia (sole trader / autónomo)
Trade name: Explore Cádiz
Address: Calle Hércules 11, 11003 Cádiz, Spain
NIF/NIE: Z3152593B
Email: hola@explorecadiz.es
Phone: +34 620 037 918

No data protection officer has been appointed. This is not required under Art. 37 GDPR for a business of this size and type. For privacy questions, write to hola@explorecadiz.es.

1. Contact by email and WhatsApp

Purpose: Answering your enquiry about tours, dates and availability, and preparing a possible booking.
Legal basis: Art. 6(1)(b) GDPR for pre-contractual enquiries, otherwise Art. 6(1)(f) GDPR (legitimate interest in communicating with interested visitors).
Data categories: Name, email address, phone or WhatsApp number, content of your message, time of the message.
Recipients: Our email provider. For WhatsApp: WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd.
Retention: Until your enquiry is resolved, then usually up to 24 months for follow-up questions. Tax and commercial retention periods remain unaffected.
Third-country transfer: With WhatsApp, data may be transferred to Meta Platforms, Inc. in the USA on the basis of standard contractual clauses and the EU-US Data Privacy Framework.

If you write to us on WhatsApp, Meta Platforms Ireland Ltd. processes metadata about your use, such as your phone number, device and connection data and the times of your messages. We have no influence over that processing.

If you prefer to avoid it, you can reach us just as well by email at hola@explorecadiz.es or by phone on +34 620 037 918.

3. Bookings via GetYourGuide

Purpose: Running the tour you booked.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract for the tour).
Data categories: Name of the person booking, number of participants, date and time, chosen language, and where provided a phone number and booking notes.
Recipients: We receive this data from GetYourGuide GmbH. We do not pass it on.
Retention: Up to 12 months after the tour for follow-up questions and complaints. Invoice-relevant records are kept for up to 6 years under Spanish tax law.
Third-country transfer: None on our side.

Booking and payment run through the GetYourGuide platform. For that part of the processing GetYourGuide GmbH is an independent controller and its own privacy policy applies: https://www.getyourguide.com/legal/privacy-policy/

We only receive the data we need to run the tour. We do not receive payment data.

4. Hosting and delivery via Cloudflare

Purpose: Providing, delivering and securing the website, including CDN acceleration and protection against attacks and bots.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and fast operation).
Data categories: Server log files with IP address, date and time, requested URL, volume of data transferred, referrer, browser and operating system details.
Recipients: Cloudflare, Inc. (USA) and Cloudflare Germany GmbH as processors under Art. 28 GDPR.
Retention: Log data is usually deleted within a few days, at the latest after 30 days, unless a security incident requires longer retention.
Third-country transfer: USA, based on the EU-US Data Privacy Framework and additionally on standard contractual clauses.

5. Google Analytics 4

Purpose: Audience measurement: understanding which pages are used so we can improve content and offering.
Legal basis: Exclusively Art. 6(1)(a) GDPR (consent given through the cookie banner).
Data categories: Truncated IP address, pseudonymous user and session identifiers, pages viewed, time on page, referrer, approximate location at country or city level, device and browser details.
Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor.
Retention: Event data retention is limited to 14 months. Cookies expire after 24 months at the latest and can be deleted in your browser at any time.
Third-country transfer: USA to Google LLC, based on the EU-US Data Privacy Framework and additionally on standard contractual clauses.

Google Analytics 4 is only loaded after you consent in the cookie banner. Without consent, no measurement takes place.

A data processing agreement is in place with Google. IP truncation is active, Google Signals is switched off, data retention is limited to 14 months and we use Consent Mode v2.

You can withdraw your consent at any time with effect for the future by changing your choice in the cookie banner.

Google's privacy policy: https://policies.google.com/privacy — browser add-on to opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout

6. Embedded OpenStreetMap map

Purpose: Showing a map with our meeting point in Cádiz.
Legal basis: Art. 6(1)(a) GDPR (consent).
Data categories: IP address, date and time of the request, browser and device details.
Recipients: OpenStreetMap Foundation, United Kingdom.
Retention: Determined by the OpenStreetMap Foundation; we store no map data ourselves.
Third-country transfer: United Kingdom, covered by an EU adequacy decision.

The map is only loaded after you give consent. Before that, no connection to OpenStreetMap servers is made.

7. GetYourGuide badge and widget

Purpose: Showing the booking badge and linking to our listings on GetYourGuide.
Legal basis: Art. 6(1)(a) GDPR (consent).
Data categories: IP address, date and time of the request, browser and device details; possibly tracking by the provider.
Recipients: GetYourGuide GmbH, Berlin (delivered via gyg.me).
Retention: Determined by GetYourGuide GmbH; see their privacy policy.
Third-country transfer: May occur according to GetYourGuide's own information, based on standard contractual clauses.

Badge and widget are only loaded after you give consent.

8. External image source Unsplash

Purpose: Displaying individual photos loaded from external servers.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast image delivery).
Data categories: IP address, date and time of the request, browser and device details.
Recipients: Unsplash Inc., Canada and USA.
Retention: Determined by the provider; we store no data for this.
Third-country transfer: Canada, covered by an adequacy decision; where applicable USA on the basis of standard contractual clauses.

This section applies only while individual images are embedded from an external source. Once all images are hosted locally, this processing no longer takes place.

9. Instagram

We only link to our Instagram profile. No Instagram content is embedded, no Meta scripts are loaded, and no data is sent to Instagram when you visit our website.

Only when you click the link do you leave our website. From then on the privacy policy of Meta Platforms Ireland Ltd. applies.

10. Your rights

You have the following rights regarding your data at any time:

Access to the data we hold about you (Art. 15 GDPR).
Rectification of inaccurate data (Art. 16 GDPR).
Erasure (Art. 17 GDPR).
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR).
Objection to processing based on legitimate interests (Art. 21 GDPR).
Withdrawal of consent with effect for the future (Art. 7(3) GDPR).

11. Right to lodge a complaint

To exercise your rights, a message to hola@explorecadiz.es or a letter to Calle Hércules 11, 11003 Cádiz, Spain is enough. We reply within one month.

You may also complain to a supervisory authority. The competent authority is the Spanish data protection agency AEPD (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can also contact the supervisory authority where you habitually reside.

12. Changes to this policy

We update this privacy policy when our website or the legal situation changes. The version published here, with the date shown above, applies.