Privacy Notice
Learn how we collect, use, and protect your personal information when you use our travel services.
Last updated: October 7, 20261. Data controller
The controller of your personal data is:
Albert Sabaté Martínez, trading as Viatsy ("Viatsy") NIF: 47986151D Carrer Gretel Ammann Martínez, 12, 6º 10ª 08020 Barcelona, Spain Email: hello@viatsy.com Phone: +34 930 474 418
This policy applies to the data we process through viatsy.com, our forms, the customer area and the channels through which you communicate with us (email, telephone and messaging apps).
2. What data we process
Depending on how you interact with us, we may process:
- Identification and contact data: first name and surname, email, telephone, postal address.
- Trip and traveller data: date of birth, nationality, passport or other travel document details, emergency contact, travel preferences and the information needed to book the services.
- Health data: allergies, intolerances, special diets, medical or mobility needs, only when you provide them to us (see section 4).
- Payment and billing data: your card details are processed directly by the payment institutions; we do not store your full card details.
- Communications: the content of the messages and conversations you have with us.
- Technical and browsing data: IP address, device, browser, pages visited, ad click identifiers and data obtained through cookies, depending on your settings (see our Cookie Policy).
The data is provided by you or by the person making the booking on your behalf. Fields marked as mandatory are necessary to handle your request or booking; if you do not provide them, we will not be able to provide the service.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Answering your enquiries and preparing quotes and trip proposals | Taking pre-contractual steps at your request (art. 6.1.b GDPR) | For as long as necessary to handle your request and, thereafter, for the applicable legal periods |
| Managing the booking and the travel contract: booking the services, payments, documentation, communications and assistance before and during the trip | Performance of the contract (art. 6.1.b GDPR) | For as long as the contractual relationship lasts and, thereafter, for the limitation periods for legal claims |
| Processing the health data you provide to meet your needs during the trip | Explicit consent (art. 9.2.a GDPR) | For as long as you keep the traveller profile or until you withdraw your consent |
| Managing your account in the customer area | Performance of the contract (art. 6.1.b GDPR) | For as long as you keep the account active |
| Complying with legal obligations: invoicing, accounting, tax obligations and requests from the authorities | Legal obligation (art. 6.1.c GDPR) | 6 years (art. 30 of the Spanish Commercial Code) and other applicable legal periods |
| Sending you commercial communications and the newsletter | Consent (art. 6.1.a GDPR) or, if you are a customer, legitimate interest for similar products or services (art. 21.2 LSSI-CE) | Until you unsubscribe or object |
| Measuring the effectiveness of our advertising and attributing requests and bookings to the originating campaign (section 7) | Acceptance given when submitting the request or booking and legitimate interest (art. 6.1.f GDPR); for contact details in browsing events, consent (art. 6.1.a GDPR) | The time needed for the measurement and, at most, that of the associated request or booking |
| Web analytics and personalised advertising through cookies (section 8) | Consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE) | As set out in the Cookie Policy |
| Recording, in anonymised form, a sample of visits to detect errors and improve the website (section 8) | Legitimate interest (art. 6.1.f GDPR) | Maximum 90 days |
| Ensuring the security of the website, preventing fraud and detecting technical errors | Legitimate interest (art. 6.1.f GDPR) | The time needed for that purpose |
| Bringing, exercising or defending claims | Legitimate interest (art. 6.1.f GDPR) | For the applicable limitation periods |
Once these periods have ended, the data is deleted or, where required by law, kept blocked and available to the competent authorities.
We do not take decisions based solely on automated processing that produce legal effects concerning you.
4. Health data
If you provide us with data about allergies, intolerances, diets, medical or mobility needs, we will process it with your explicit consent, solely to meet those needs during the trip, and we will share it with the tourism service providers that need to know it. Providing it is voluntary, but if you do not, we will not be able to take it into account. You may withdraw your consent at any time, without affecting the lawfulness of the prior processing.
5. Data of other travellers and of minors
If you provide data about other people (companions or travellers on your booking), you guarantee that you are authorised to do so, that you have informed them of the content of this policy and, where necessary, that you have their consent.
Minors under 14 may not provide their data to us themselves. Their data must be provided by their parents or legal guardians, who are responsible for doing so.
6. Commercial communications
We will only send you commercial communications if you have agreed to receive them or, if you are a customer, about products or services similar to those you have purchased. When you subscribe to the newsletter, we will send you an email to confirm the subscription. You can unsubscribe at any time using the link included in each communication or by writing to us at hello@viatsy.com.
7. Advertising measurement
When you submit an information or quote request, or make a booking or a purchase, and accept the conditions, we share with advertising and analytics platforms the information needed to measure the effectiveness of our advertising: contact data in pseudonymised form (hashed), ad click identifiers, technical data (such as the IP address or the browser) and the type and amount of the action. This measurement is independent of your cookie settings. You can object by writing to us at hello@viatsy.com.
To attribute requests and bookings to the originating campaign, we store in your browser the identifier of the ad through which you arrived, even if you reject cookies (see the Cookie Policy). In addition, from our servers we share browsing events with these platforms, such as trip views or searches: without contact details if you have not accepted cookies, and with pseudonymised contact details (hashed) only if you have accepted them.
8. Cookies, analytics and session recording
We use technical cookies, which are necessary for the website to work; cookies to measure requests and bookings (section 7), which are always active; and, only with your consent, analytics and advertising cookies. You can accept, reject or configure them at any time. More information in our Cookie Policy.
To detect errors and improve the website, we record, in anonymised form, a sample of visits (browsing, clicks and content shown on screen): personal information is always hidden and the recording is not linked to an identified person, even if you accept cookies. Sensitive data, such as passwords, health data, document numbers and payment card details, is never recorded.
9. Artificial intelligence tools
We may use artificial intelligence tools to help prepare replies, proposals and content, always within the purposes set out in this policy. The providers of these tools act as data processors and may not use your data for their own purposes. Decisions about your request or booking are always taken by our team.
10. Recipients
We only share your data when necessary for the purposes set out or when required by law. Recipients may include:
- Tourism service providers needed to organise and provide your trip (transport, accommodation, activities, services at the destination, organisers and insurers).
- Payment and banking institutions, to manage payments and refunds.
- Technology providers that provide us with web hosting, communications, management, electronic signature, artificial intelligence and similar services, as data processors.
- Advertising and analytics platforms, under the terms of sections 7 and 8.
- Public administrations, authorities and competent bodies (for example, border, consular or tax authorities, courts and tribunals), where required by law.
- Professional advisers (for example, accountants or legal advisers), subject to a duty of confidentiality.
On group trips we may create a messaging group with the participants to coordinate the trip; your telephone number will be visible to the other members of the group. If you do not want to be part of it, let us know.
We do not sell your personal data.
11. International transfers
To provide the trip you have booked, it is necessary to share your data with tourism service providers located in the destination country, which may not offer a level of protection equivalent to that of the European Union. These transfers are based on their being necessary for the performance of the contract (art. 49.1.b GDPR).
Some technology providers may process data outside the European Economic Area. In these cases, the transfer is covered by an adequacy decision of the European Commission or by other appropriate safeguards, such as standard contractual clauses (arts. 45 and 46 GDPR).
12. Security
We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse (art. 32 GDPR).
13. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, by writing to hello@viatsy.com or to our postal address, with the reference "Data protection". If necessary to verify your identity, we may ask you for additional information.
If you consider that we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
14. Accuracy of data
You are responsible for ensuring that the data you provide to us is accurate and up to date, especially travel document details. Let us know of any change.
15. Changes to this policy
We may update this policy to adapt it to regulatory changes or changes in our activity. We will publish the current version on this page and, if the changes are significant, we will let you know.