Privacy and Cookies Policy
1. Data controller
The controller responsible for processing personal data is [full name of the website owner], owner of the website mabeltoursevilla.com, operating under the name Mabel Tour Sevilla.
- Contact address: [contact address of the data controller].
- Email: [confirm reservas@mabeltoursevilla.com as the privacy contact email address].
2. What data we process
When you make a booking, we collect your full name, email address, number of participants and details of the selected visit, such as the tour, date and time. We also generate a booking reference and retain the information needed to manage the booking status and related communications.
If you email us, we process your email address and the information you include in your message to respond to your request. Please avoid sending us sensitive data or information about other people that is not necessary to handle your enquiry or booking.
The servers hosting the website may record technical information, such as your IP address, the date and time of access and the requests made, to maintain the operation and security of the service.
3. How we use your data and the legal basis
| Purpose | Legal basis |
|---|---|
| Managing your booking request, organising the visit and handling changes or cancellations. | Taking steps at your request before entering into a contract and performing the contractual relationship, as applicable. |
| Sending you confirmations and information necessary for your booking. | The same legal basis that allows us to manage the booking and provide the service. |
| Responding to enquiries about visits or a possible booking. | Taking steps at your request before entering into a contract. |
| Maintaining website security and preventing misuse. | Legitimate interest in protecting the service and the data it contains, while respecting users’ rights. |
| Meeting applicable legal obligations. | Compliance with legal obligations. |
The mandatory fields in the form are necessary to manage your booking. If you do not provide this information, we cannot process your booking through this channel.
We do not use booking data to send advertising or newsletters. We do not carry out advertising profiling or make automated decisions that produce legal effects concerning you or similarly significantly affect you.
4. How long we retain your data
We retain booking data for as long as necessary to organise and carry out the visit and handle any related changes, cancellations or issues.
Email enquiries are retained for as long as necessary to respond to them and follow them up.
Once these purposes have been fulfilled, we delete the data or, where appropriate, retain it in a blocked state for the periods required by applicable law or necessary to address potential liabilities. This also applies to copies of messages received in the mailboxes used to manage the service.
5. Service providers and access to data
The website and domain email use services provided by Hostalia. Messages received at reservas@mabeltoursevilla.com are forwarded to a Google Gmail mailbox used by the data controller to manage communications. Therefore, the content of these messages and the data they contain are also processed through Google’s services.
We do not sell your data or disclose it to third parties for their own advertising campaigns. Hosting and communications providers may process the data necessary to deliver their services. Data may also be disclosed where there is a legal obligation to do so.
[Complete before publication: identify the contracted service provider entities and describe any international data transfers that may take place, the legal mechanisms supporting them and how to consult their safeguards. Check the specific terms applicable to the Gmail mailbox used; do not assume that a free account has the same terms as Google Workspace.]
6. Your rights
You may request access to your data, its rectification or erasure and, where applicable, restriction of processing, object to processing and request data portability.
To exercise these rights, write to [confirmed privacy contact email address], specifying your request. If there are reasonable doubts about your identity, we may ask for the additional information necessary to verify it.
If you believe that the processing of your data breaches the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
7. Cookies
Cookies are small files that your browser stores on your device. This website uses technical cookies and language preference cookies solely to remember the choice you make.
We do not use advertising or analytics tracking cookies.
The following first-party cookies are created when you select a language:
| Cookie | Purpose | Duration |
|---|---|---|
| mabel_tour_lang | Remember the language selected for the tour interface. | 30 days from selection. |
| pll_language | Store the same language choice as a website compatibility mechanism. | 30 days from selection. |
These cookies are used solely for the preference you request and do not require consent. For this reason, the website does not display a cookie consent banner.
You can delete or block cookies through your browser settings. If you block them, the website may not remember your language between visits.
8. Links to other websites
This policy will be updated when the processing of data or the services used by the website change. The date of the latest update will be shown on this page.
Last updated: [publication date of the final version].
Internal notes: do not copy to the public page
- The data controller may be an individual. The absence of a company or registration as self-employed does not replace the obligation to identify the data controller. Do not publish the draft identifying the controller only by the brand name.
- Confirm the contact address and that the privacy email address is actually monitored. The private Gmail address does not need to be publicly displayed to explain the forwarding arrangement.
- Review the terms of Hostalia and the specific Google account, including access to data, retention and international transfers. A generic statement of GDPR compliance does not replace this check.
- The proposed retention criteria require an actual review and deletion process covering the database, Hostalia, Gmail and backups. The reviewed plugin does not demonstrate an automatic age-based data deletion system.
- Check cookies, local storage and external requests in the browser and on the production website. The inventory above includes the two language cookies observed locally; also check hosting cookies and cookies used to access the administration area if that area is included in the scope of the page.
- Check whether the duplicate cookie
pll_languageis removed and update the table if the implementation changes. - The statements about the absence of advertising, analytics and profiling describe the intended configuration. Confirm them before publication.
- Add links from the footer and the form. Select this page in WordPress privacy settings once it has been created.
- Separate privacy information from booking terms. Suggested privacy wording: “I have read the Privacy Policy”, with a working link. The terms should have their own wording and link.
- The reviewed form uses
novalidate; its JavaScript and API do not check the current checkbox. If it remains a submission requirement, implement the corresponding check. Do not treat that checkbox as the legal basis for providing the service. - Add visible basic information to the form about the data controller, purpose, legal basis, providers, rights and a link to the policy. A checkbox alone is not sufficient.