At Vive La Palma we handle your data with the same care we take when leading you out to sea. This policy explains what information we collect when you book, what we use it for and how you can make decisions about it at any time.
1. Data controller
The personal data you provide is processed under the responsibility of:
- Legal name: GIANLUCA LEON CARLUCCI (individual / self-employed)
- Tax ID: 21130399T
- Registered address: Camino Los Tijaraferos, 2, 38760 Los Llanos de Aridane, Santa Cruz de Tenerife (Spain)
- GDPR contact: info@vivelapalmatourexperience.com
2. Data we collect
When you book or contact us we may collect the following categories of data:
- Identification data: first and last name.
- Contact data: email and phone number.
- Booking data: chosen activity, date, number of participants, price and, where applicable, status as a Canary Islands resident.
- Marketing consent: only if you tick the corresponding checkbox in the booking form.
We do not collect sensitive data (special categories under Article 9 of the GDPR).
3. Purpose of processing
- Manage your booking: confirmation, pre-trip information, contact in case of weather changes and after-sale support.
- Tax and accounting compliance: issuing invoices and meeting tax obligations.
- Commercial communications: only if you ticked the opt-in, to send you information about upcoming activities and recommendations to enjoy La Palma.
4. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR): necessary to manage your booking and deliver the service.
- Legal obligation (Art. 6(1)(c) GDPR): tax and accounting obligations.
- Explicit consent (Art. 6(1)(a) GDPR): for sending commercial communications.
5. Recipients of your data
Your data is shared only with the data processors needed to deliver the service:
- Turitop SLU, a Spanish company in charge of the technical management of the booking form and associated notifications.
- Invoicing and hosting providers based in the European Economic Area (EEA).
We do not sell or share your data with third parties for commercial purposes.
6. International transfers
We do not transfer data outside the European Economic Area (EEA). All the data processors we work with operate from within the EEA.
7. Retention periods
- Contractual and invoicing data: between 4 and 6 years from the last commercial interaction, in accordance with applicable tax obligations.
- Marketing consent: until you withdraw your consent or unsubscribe from our communications.
8. Your rights
You can exercise the following rights over your personal data at any time:
- Access: see what data of yours we hold.
- Rectification: correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): have us delete your data when it is no longer needed.
- Objection: object to a specific type of processing.
- Restriction of processing: temporarily limit the use of your data.
- Portability: receive your data in a structured format so you can transfer it to another provider.
To exercise any of these rights, send us an email to info@vivelapalmatourexperience.com with the subject "GDPR - [right to exercise]".
To verify your identity, we may ask for a copy of your DNI/NIE (Spanish ID/residence card) or passport when you exercise any of these rights.
9. Complaint to the AEPD
If you believe we haven't properly addressed your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD) via their website: https://www.aepd.es.
10. Security measures
We apply reasonable technical and organisational measures to protect your data: encrypted HTTPS connections across the whole website, hosting on Spanish servers (Hostinger) with their own security measures, and restricted access to staff who need to process the information.
11. Minors
We do not collect or process data of minors under 14 years of age (under Spanish law — LOPDGDD, as the company is based in Spain) without the express consent of a parent or legal guardian. If we detect that we have received data from a minor without that consent, we will delete it immediately.
12. Changes to this policy
We reserve the right to update this policy to reflect legal or service changes. Any changes will be published at this same URL and will be effective from the time of publication.
13. Last updated
April 19, 2026