Privacy policy

This policy explains how we process the personal data you provide through this website, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD).

1. Data controller

  • Controller: Viajes St Sanxenxo, S.L.
  • Tax number (NIF): B36394948
  • Address: Calle Carballeira, 15, 36630 Cambados, Pontevedra, España
  • Telephone: +34 986 52 45 20
  • Email: info@stsanxenxo.com

2. What data we process and where it comes from

We process only the data you give us voluntarily:

  • Contact form: full name, email address, telephone (optional), subject and the content of your message.
  • Technical request data: IP address, date and time of submission and browser identifier. These are stored alongside the message as a security measure and to prevent abuse of the form.
  • Email or telephone: whatever you tell us if you contact us by those means.

We do not collect special categories of data through this site. Where a trip requires information about allergies, diet or mobility needs, it is requested separately during the booking process on the appropriate legal basis.

3. Why we use your data and on what legal basis

  • To answer your enquiry and prepare a travel proposal. Legal basis: your consent (art. 6.1.a GDPR), given by ticking the box on the form, and pre-contractual steps taken at your request (art. 6.1.b GDPR).
  • To manage the contract if you go on to book a trip. Legal basis: performance of a contract (art. 6.1.b GDPR).
  • To meet legal obligations in tax, accounting and tourism regulation. Legal basis: legal obligation (art. 6.1.c GDPR).
  • Website security and prevention of automated submissions. Legal basis: our legitimate interest in protecting our systems (art. 6.1.f GDPR).
  • Visit counting. We count page views and daily visits on our own server, without cookies and without any third party service. We do not store your IP address: it is combined with the date and a secret value to produce a code that changes every day and that cannot identify you or follow you from one day to the next. Only aggregate figures per page and language are kept. Legal basis: our legitimate interest in understanding how the site is used (art. 6.1.f GDPR). Because nothing is stored on your device, this measurement needs no prior consent.
  • Audience measurement with Google Analytics, only if you accept measurement cookies. It is separate from the counting above and is currently switched off unless the cookie policy says otherwise. Legal basis: your consent (art. 6.1.a GDPR), which you may withdraw at any time.

We do not carry out automated decision making or profiling. We do not use your data to send you marketing unless you specifically ask us to.

4. How long we keep data

  • Enquiries that do not lead to a booking: up to 12 months from the last contact, then deleted.
  • Clients: for the duration of the contract and afterwards for the applicable limitation periods. Records with tax and accounting effect are kept for 6 years under the Spanish Commercial Code and 4 years for tax purposes.
  • Technical security logs: 12 months.
  • Visit counts: the aggregate figures are kept indefinitely, as they contain no personal data. The daily visitor codes are deleted after 3 days.

5. Who we share data with

We do not sell or share your data with third parties for commercial purposes. Access is limited to the suppliers needed to deliver the service, acting as processors under a contract compliant with article 28 GDPR:

  • Arsys Internet, S.L.U. (Spain), web hosting and email provider.
  • Tax and accounting advisers and, where relevant, financial institutions, as part of administrative management.
  • Travel suppliers (hotels, carriers, insurers, event organisers), limited to the data strictly needed to deliver the service you booked, and only where a booking exists.

Where a trip takes place outside the European Economic Area, passing your data to the supplier at destination is necessary to perform the contract under article 49.1.b GDPR. Outside that case we make no international data transfers.

6. Your rights

You may exercise the following rights at any time:

  • Access: find out what data of yours we hold.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: ask us to delete data that is no longer needed.
  • Restriction: ask us to pause processing while a complaint is checked.
  • Objection: object to processing based on legitimate interest.
  • Portability: receive your data in a structured, commonly used format.
  • Withdraw consent at any time, without affecting the lawfulness of earlier processing.

To exercise them, write to info@stsanxenxo.com or to the postal address above, identifying yourself and stating which right you wish to exercise. We reply within one month.

If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

7. Data security

We apply technical and organisational measures appropriate to the risk: administration panel access restricted to individual credentials with hashed passwords, login attempt limiting, a log of content changes, backups, and TLS encryption for outgoing mail.

8. Children

This site is not aimed at children under 14 and we do not request their data through the form. Where a trip involves minors, their data is supplied by the responsible adult as part of the booking.

9. Changes to this policy

We may update this policy if our services or the applicable rules change. The version in force is always the one published on this page.

Updated on 6 August 2026