Privacy Policy

1. Data Controller

Dornyx Travel (Barcelona, Spain) is the data controller for personal data collected through this website and our tour services. For any data-related enquiries, contact us at [email protected].

2. Data We Collect

We collect the following categories of data. Booking data: your full name, email address, and the tour or product you purchased. Payment data: transactions are handled by Revolut — Dornyx does not store card numbers or payment credentials. Technical data: IP address, browser type, device model, and pages visited, collected via server logs.

3. How We Use Your Data

We use your data to fulfil your booking and deliver your tour experience; to send booking confirmations, digital vouchers, and support emails; to improve our service through anonymised usage analysis; and to comply with our legal and tax obligations.

4. Legal Basis for Processing

Booking and delivery data is processed on the basis of contractual necessity. Technical and analytics data is processed on the basis of our legitimate interest in improving the service. If we send you marketing communications, we will only do so with your explicit consent, which you may withdraw at any time.

5. Data Sharing

We share your data only with trusted partners who help us deliver our service: Revolut (payment processing) and Google (Gmail API for transactional email, Google Maps for tour locations). We do not sell your personal data or share it for third-party advertising purposes.

6. Cookies

We use session cookies required for the booking and payment flow. We may also use analytics cookies to understand how visitors navigate our site. You can manage or disable cookies through your browser settings at any time, though this may affect the functionality of the booking flow.

7. Your Rights (GDPR)

If you are based in the EU or EEA, you have the right to access, correct, delete, or export your personal data; to restrict or object to certain types of processing; and to lodge a complaint with Spain's data protection authority (AEPD — www.aepd.es). To exercise any of these rights, email [email protected] and we will respond within 30 days.

8. Data Retention

Booking records are retained for 4 years to meet our tax and legal obligations under Spanish law. Marketing consent records are kept until you withdraw your consent. Server and technical logs are deleted after 90 days.

9. Changes to This Policy

We may update this policy periodically. The "last updated" date at the top of this page reflects the most recent revision. For significant changes we will notify users via email or a site notice.

10. Contact

Data protection or privacy queries: [email protected].

Questions? We're happy to help.