UNLOCKED TOURS · Preview · no real bookings

Privacy

Your details are stored in this site’s database to handle your request. This form does not send an email or take a payment.

Contact, group, partner and guide form submissions, and customer details entered during checkout, are saved in the website’s persistent database to manage your request. Preview bookings do not take payments or send emails. Access to submitted details requires authenticated administration.

Essential storage supports security and your cookie preference. Optional analytics start only after consent. No analytics provider is loaded when no provider has been configured.

The data controller, contact details, retention periods and procedure for exercising privacy rights must be completed before the site processes real customer bookings.

When the referral programme is active, partner accounts store your name, email, salted password hash, sessions, agreed rates and referral records. If you submit bank-transfer details, the website stores the account holder, IBAN and optional bank name in its persistent database to administer partner payments. Account and payment administration support the partner relationship (GDPR Article 6(1)(b)); applicable accounting obligations use Article 6(1)(c). These records are stored even when tour payments are in preview mode.

Authenticated partner responses display only a masked IBAN ending in its last four characters. Authorised administrators can access the complete payment details to arrange partner payments. IBAN format and checksum checks do not establish that an account exists or belongs to you; entering bank details does not trigger an automatic transfer. Retention follows the active partner relationship, unresolved payments or claims and applicable accounting obligations.

Visits arriving with an active referral code are counted using a daily hash derived from the IP address, browser user-agent and referral code. Its salt changes each day in Europe/Madrid time. The referral visit table stores the hash, partner and day, not the original IP address or user-agent. This limited counter supports our legitimate interest in measuring partner recommendations and preventing duplicate counts (Article 6(1)(f)); you may object through our contact page. sessionStorage avoids repeated counts within a browser session. Booking attribution uses the code in the link or entered at checkout, without an attribution cookie. Optional Google or Meta analytics still require separate consent.