Privacy policy
The texts that govern the website and the bookings.
Data controller
The website does not use any analytics, advertising or tracking tools.
What data is processed and why
- Booking request. Name, email, phone, number of people at each rate, language, the payment method you choose and any notes you write, plus the moment you accepted the terms. They are used only to manage your seat, confirm the tour and reach you on the day.
- Invoicing. Only if you ask for an invoice: the tax details you send us by email (name or company name, tax ID and address), to issue it.
- Contact form. Name, email and your message. They are not stored on the website: they go to the Cartagena Escape inbox so we can reply.
- Server technical log. When you send a form or something goes wrong, the server records the IP address, the page and the time. It is used to keep the website secure (stopping abuse and mass submissions) and to fix errors; never to follow your browsing.
- Google reviews. The home page shows reviews their authors have published on Google, with their public name, profile photo and text. The photo is stored on this server so your browser does not need to connect to Google to show the home page. If the author deletes or changes their review on Google, it disappears or is updated here at the next sync (every few hours).
Legal basis
Bookings are processed because this is necessary to provide the service you ask for (art. 6.1.b GDPR), and invoicing details because the law requires it (art. 6.1.c). Contact messages, with your consent (art. 6.1.a), which you can withdraw at any time. The technical log and the Google reviews, on the basis of legitimate interest (art. 6.1.f): keeping the website secure and showing opinions their authors have made public. You can object to either by writing to hola@cartagenaescape.es.
How long it is kept
- Confirmed bookings (including those later cancelled or where you do not show up): five years from the tour date, because of tax obligations (four years plus the current tax year) and possible claims.
- Requests that were never confirmed (expired, or cancelled before confirmation): until the tour date.
- Once that period ends, the website automatically deletes the name, email, phone and notes; only the figures remain (tour, date, seats and amount), with nothing that identifies you.
- Contact messages: until your question has been answered; if it leads to a confirmed booking, the five years of the booking.
- Technical log: 20 days; then it is deleted automatically.
Who receives it
It is never sold. It is processed on behalf of Cartagena Escape by the web hosting and email provider (SERED, with its servers in Spain), acting as data processor. No international data transfers take place.
If you pay by Bizum, PayPal or Revolut, that company processes the payment data as an independent controller, under its own privacy policy; Cartagena Escape only receives confirmation of the payment.
Your rights
You can request access, rectification, erasure, objection, restriction and portability by writing to hola@cartagenaescape.es. You will get a reply within one month at the latest. If you believe your request has not been dealt with, you can complain to the Spanish Data Protection Agency (aepd.es).
What we do not do
There are no automated decisions or profiling, we do not ask for more data than necessary and checkboxes are never pre-ticked.