Privacy Policy
Last updated: March 2026
At Xplore Canarias, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable Spanish data protection laws.
1. Data Controller
Xplore Canarias is the data controller responsible for your personal data. If you have questions about this policy, you can contact our Data Protection Officer at privacy@xplorecanarias.com.
2. Data We Collect
We collect data you provide directly (name, email, phone, payment details), data collected automatically (IP address, browser type, device information, pages visited, time spent), and data from third parties (social login providers, payment processors). We only collect data necessary to provide our services.
3. User Account Data
When you create an account, we store your name, email address, account preferences, and activity on the platform. This information is necessary to provide you with our booking services, manage your reservations, and communicate important updates about your bookings.
4. Booking Data
When you make a booking, we collect and store booking details (experience, date, number of participants), payment confirmation data, and communication with providers. This data is shared with the relevant service provider to fulfill your booking and retained for legal and accounting purposes for 5 years.
5. Payment Information
Payment processing is handled by Stripe, a certified PCI-DSS Level 1 payment processor. Xplore Canarias does not store your full card details. We retain only the last 4 digits of your card and the payment reference for record-keeping. Stripe's privacy policy applies to payment data.
6. Cookies and Analytics
We use essential cookies to operate the platform, analytics cookies (Google Analytics) to understand usage patterns, and optional marketing cookies to show relevant content. You can control cookie preferences via our Cookie Policy page. We anonymize analytics data where possible.
7. Third-Party Services
We share necessary data with: Stripe (payment processing), Google Analytics (platform analytics), email service providers (booking confirmations), and experience operators (to fulfill your booking). We do not sell your personal data to third parties.
8. GDPR Compliance and Your Rights
Under GDPR, you have the right to: access your personal data, correct inaccurate data, request deletion of your data ('right to be forgotten'), restrict or object to processing, data portability, and withdraw consent at any time. To exercise these rights, contact us at privacy@xplorecanarias.com.
9. Data Retention
We retain your account data for as long as your account is active or as needed to provide services. Booking data is retained for 5 years for legal and tax compliance. You may request deletion of your account and associated data at any time, subject to legal retention requirements.
10. Data Security
We implement technical and organizational measures to protect your data, including SSL encryption, secure servers, access controls, and regular security audits. In the event of a data breach that affects your rights, we will notify you and the relevant authority within 72 hours as required by GDPR.
11. International Transfers
Some third-party services (such as Stripe and Google) may process your data outside the EU. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
12. Contact
For any privacy-related inquiries, contact our Data Protection Officer at privacy@xplorecanarias.com or write to: Xplore Canarias, Canary Islands, Spain.