Privacy policy

At Vive La Palma we handle your data with the same care we take when leading you out to sea. This policy explains what information we collect when you book, what we use it for and how you can make decisions about it at any time.

1. Data controller

The personal data you provide is processed under the responsibility of:

  • Legal name: GIANLUCA LEON CARLUCCI (individual / self-employed)
  • Tax ID: 21130399T
  • Registered address: Camino Los Tijaraferos, 2, 38760 Los Llanos de Aridane, Santa Cruz de Tenerife (Spain)
  • GDPR contact: infovivelapalmatours@gmail.com

2. Data we collect

When you browse, book or contact us we may collect the following categories of data:

  • Identification data: first and last name.
  • Contact data: email and phone number.
  • Booking data: chosen activity, date, number of participants, price and, where applicable, status as a Canary Islands resident.
  • Marketing consent: only if you tick the corresponding checkbox in the booking form.
  • Optional measurement data: pages visited, source, campaign, language, device or browser type, and aggregate events such as clicks or booking completion. We do not send your name, email, phone number or booking identifier to Umami. After you consent, Google Ads may receive the booking identifier as the transaction_id used to deduplicate the conversion, together with the amount and currency. The advertising-personalization signal remains denied.

We do not collect sensitive data (special categories under Article 9 of the GDPR).

3. Purpose of processing

  • Manage your booking: confirmation, pre-trip information, contact in case of weather changes and after-sale support.
  • Tax and accounting compliance: issuing invoices and meeting tax obligations.
  • Commercial communications: only if you ticked the opt-in, to send you information about upcoming activities and recommendations to enjoy La Palma.
  • Measurement and attribution: only if you accept optional measurement, to understand website performance and attribute bookings to campaigns in aggregate.

4. Legal basis

  • Performance of a contract (Art. 6(1)(b) GDPR): necessary to manage your booking and deliver the service.
  • Legal obligation (Art. 6(1)(c) GDPR): tax and accounting obligations.
  • Explicit consent (Art. 6(1)(a) GDPR): for commercial communications and, separately, for optional measurement and Google Ads. You may reject it and continue browsing or booking.

5. Recipients of your data

The following providers and recipients may process the data needed to deliver the service or perform the measurement you accepted:

  • TuriTop S.L., which provides the technical booking form and associated notifications. Its widget loads only when you choose to open booking. Only if you accept measurement may campaign parameters be made temporarily available to the widget to attribute the booking; if you do not accept, they are hidden while it loads.
  • YouTube (privacy-enhanced mode) and Google My Maps, external content your browser requests only when you press the button to load that video or map. This direct request may disclose technical data such as your IP address, browser and referring page to the provider, independently of your measurement choice.
  • Umami Cloud, cookieless analytics that we load only after your consent, with URL search parameters excluded.
  • Google Ads, campaign and conversion measurement that we load only after your consent.
  • Invoicing and hosting providers required to deliver the service.

We do not sell or share your data with third parties for commercial purposes.

6. International transfers

Some technology providers may process data outside the European Economic Area. Where applicable, processing is subject to the safeguards and transfer mechanisms declared by each provider. See the privacy policies of Umami and Google. Before you accept measurement, your browser does not request their analytics or advertising scripts.

7. Retention periods

  • Contractual and invoicing data: between 4 and 6 years from the last commercial interaction, in accordance with applicable tax obligations.
  • Marketing consent: until you withdraw your consent or unsubscribe from our communications.
  • Measurement preference: stored in your browser for up to 180 days; you can change it using the “Privacy” button in the footer.
  • Campaign attribution: UTM parameters are stored only for the browser session after acceptance; the local conversion-deduplication key uses a hash and is functionally limited to 90 days.

8. Your rights

You can exercise the following rights over your personal data at any time:

  • Access: see what data of yours we hold.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): have us delete your data when it is no longer needed.
  • Objection: object to a specific type of processing.
  • Restriction of processing: temporarily limit the use of your data.
  • Portability: receive your data in a structured format so you can transfer it to another provider.

To exercise any of these rights, send us an email to infovivelapalmatours@gmail.com with the subject "GDPR - [right to exercise]".

To verify your identity, we may ask for a copy of your DNI/NIE (Spanish ID/residence card) or passport when you exercise any of these rights.

9. Complaint to the AEPD

If you believe we haven't properly addressed your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD) via their website: https://www.aepd.es.

10. Security measures

We apply reasonable technical and organisational measures to protect your data: encrypted HTTPS connections across the whole website, hosting on Spanish servers (Hostinger) with their own security measures, and restricted access to staff who need to process the information.

11. Minors

We do not collect or process data of minors under 14 years of age (under Spanish law, LOPDGDD, as the company is based in Spain) without the express consent of a parent or legal guardian. If we detect that we have received data from a minor without that consent, we will delete it immediately.

12. Changes to this policy

We reserve the right to update this policy to reflect legal or service changes. Any changes will be published at this same URL and will be effective from the time of publication.

13. Last updated

August 24, 2026