Privacy and Personal Data Protection Policy
1. Data Controller
LUX TOUR SERVICES SLU
Tax ID: B55127971
Address: C/ Garrigues, núm. 3, Bústia 116 – Hostalets (L), 17310 Lloret de Mar, Girona, Spain
Email: info@luxtour.es
Telephone / WhatsApp: +34 696 767 975
LUX TOUR SERVICES SLU is the controller of the personal data provided by users through Luxtour.es, booking forms, email, WhatsApp, or other communication channels.
2. What Data We May Process
Depending on the services used, we may process:
— full name;
— telephone number and email address;
— information required to arrange and manage a booking;
— details of the selected excursion, date, number of participants, and special requests;
— invoicing information and data required to meet tax obligations;
— messages sent through website forms, email, or WhatsApp;
— technical data collected while using the website, including cookie-related data in accordance with our Cookie Policy.
We do not store bank card details. Payments are processed through secure banking and payment services.
3. Purposes of Processing
Your data may be used to:
— arrange, confirm, and manage bookings for excursions and travel services;
— contact you regarding bookings, changes, cancellations, or the provision of services;
— issue invoices, process payments, and meet administrative and tax obligations;
— handle enquiries, complaints, requests, and messages;
— send informational or marketing communications where the user has given explicit consent;
— maintain website security, prevent fraud, and improve service quality;
— comply with applicable legal obligations.
4. Legal Basis for Processing
We process personal data on the following legal grounds:
— performance of a contract or taking steps before entering into a contract, for example when making a booking;
— compliance with legal obligations, including tax, accounting, and administrative obligations;
— the company’s legitimate interest, for example to protect the website, prevent fraud, and defend the company’s rights;
— the user’s consent, particularly for marketing communications and analytics or advertising cookies.
The user may withdraw consent for marketing communications or non-essential cookies at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
5. Data Recipients
Data may be shared, only where necessary for providing the services, with the following categories of recipients:
— banks and payment platforms for payment processing;
— technical service providers, including hosting, website security, email, and booking management tools;
— accounting, tax, or legal advisers where necessary;
— public authorities, courts, or other competent bodies where legally required;
— partners or suppliers involved in a specific excursion where necessary to fulfil the booking.
We do not sell users’ personal data to third parties.
6. International Data Transfers
Some technical providers, such as analytics, advertising, mapping, or email services, may process data outside the European Economic Area.
In such cases, transfers will only take place where legally required safeguards are in place, such as an adequacy decision by the European Commission, standard contractual clauses, or other mechanisms provided for under the GDPR.
7. Data Retention Period
Data will only be retained for as long as necessary for the purposes for which it was collected.
Booking and payment-related data may be retained for the period required to fulfil contractual, accounting, tax, and legal obligations. Once those periods expire, the data will be deleted or anonymised unless further retention is required by law.
Contact data used for marketing communications will be retained until the user withdraws consent or objects to receiving such communications.
8. User Rights
Users have the right to:
— access their personal data;
— request correction of inaccurate or incomplete data;
— request deletion of data where permitted by law;
— request restriction of processing;
— receive their data in a portable format where applicable;
— object to processing based on legitimate interest;
— withdraw previously given consent;
— not be subject to decisions based solely on automated processing where such decisions produce legal or similarly significant effects.
To exercise these rights, please send a request to info@luxtour.es. To verify identity, we may request only the information or documentation reasonably necessary in each case.
Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Marketing Communications
We only send marketing and informational communications where we have the user’s consent or where otherwise permitted by applicable law.
Users may opt out at any time by using the unsubscribe link in an email or by writing to info@luxtour.es.
10. Children’s Data
The website’s services are intended for persons over 18 years of age who make bookings independently.
When an excursion is booked for minors, the child’s data may only be provided by a parent, legal guardian, or authorised adult making the booking. Minors’ data will only be processed to the extent necessary to provide the service.
11. Social Media and Third-Party Services
The website may contain links to social networks, maps, video services, and other third-party websites. When accessing such services, data processing is governed by their own privacy policies.
LUX TOUR SERVICES SLU is not responsible for how personal data is processed on external websites or platforms outside its control.
12. Data Security
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or unlawful processing.
However, transmitting information over the internet always involves certain risks. Users should also take appropriate measures to protect their devices, passwords, and account credentials.
13. Changes to This Policy
We may update this Privacy Policy when legislation, services used, or data-processing practices change. The current version will always be available on Luxtour.es.
Last updated:
