Privacy Policy
Last updated: 21 September 2026
This policy explains what personal data Walkie Talkie Tours collects, why, on what legal basis, who receives it, how long we keep it, and what rights you have. It is issued in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services (LSSI-CE).
1. Who is responsible for your data
- Controller: Carlos Iglesias Hernández (trading name: Walkie Talkie Tours)
- NIF: 54477272R
- Address: Av. de la Constitución 6, oficina 57, 29631 Arroyo de la Miel, Benalmádena, Málaga, Spain
- Email: info@walkietalkietours.com
2. What data we collect and where it comes from
When you contact us by our contact form, email or WhatsApp: your name, email address, telephone number and whatever you tell us in your message.
When you book on our website: your name, email address, telephone number, number of participants, time zone and any answers you give in the booking form. Bookings on our website are handled through Calendly.
When you book a private or group tour: the above, plus company and invoicing details where relevant.
When you pay a deposit or balance: payments are made through SumUp or by bank transfer. We receive confirmation of the payment, the payer’s name and the amount. We do not see or store your full card details.
When you book through a platform such as GuruWalk, FreeTour, GetYourGuide, Civitatis, Headout, TripAdvisor or Google: the platform passes us the details we need to run your tour, usually your name, contact details and number of participants.
During a tour: photographs or video in which you may appear, only where you have agreed (see Section 3).
When you visit our website: your IP address is processed by our hosting provider and by our floating contact button provider. If you accept the relevant cookies, it is also processed by Calendly and Google Maps. Cookies are explained in our Cookie Policy.
Apart from the click statistics recorded by our contact button provider (see Section 5.1), which do not identify you, we do not use analytics or advertising tools and we do not track your browsing.
Providing the data needed for a booking is necessary to make and manage that booking. If you do not provide it, we cannot confirm your place.
3. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiries and preparing quotations | Steps taken at your request before entering into a contract (Art. 6.1.b GDPR) |
| Managing your booking and sending confirmations and practical information | Performance of a contract (Art. 6.1.b GDPR) |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6.1.c GDPR) |
| Sending you, after your tour, an email with recommendations, a link to leave a review and information about our other tours | Our legitimate interest (Art. 6.1.f GDPR) and Article 21.2 LSSI-CE, which allows us to send customers information about similar services of our own. You can object at any time (see Section 7). |
| Taking and publishing photographs or video on our website and social media | Your consent (Art. 6.1.a GDPR), which you can withdraw at any time |
| Keeping our website secure and preventing abuse | Our legitimate interest (Art. 6.1.f GDPR) |
| Cookies that are not strictly necessary | Your consent, as explained in our Cookie Policy |
We do not use your data for automated decision-making or profiling.
4. How long we keep your data
- Enquiries and bookings: up to three years from our last contact with you, unless a longer period is required by law or needed to deal with a claim.
- Invoicing and accounting records: for the periods required by Spanish tax and commercial law, currently up to six years.
- Post-tour emails: until you object.
- Photographs and video: until you withdraw your consent, or until we stop using the image.
- Technical data such as IP addresses: for the limited period set by our hosting provider for security logs.
- Cookies: as set out in our Cookie Policy.
When the period ends, the data is deleted or anonymised.
5. Who receives your data
We do not sell or rent your personal data.
5.1 Service providers acting on our behalf
These providers process data only on our instructions and for the purposes above.
| Provider | What they do |
|---|---|
| Hostinger | Hosts our website |
| Calendly LLC (United States) | Operates our booking calendar and sends booking confirmations and post-tour emails |
| Google (Google Ireland Limited / Google LLC) | Provides our email service |
| Buttonizer (part of Formilla, LLC) | Provides the floating contact button on our website. When you click it, it records the time, the page, how long you had been on it, your country and your type of device, without identifying you |
| Our accounting and tax adviser | Bookkeeping and tax filings |
5.2 Organisations acting under their own responsibility
These organisations receive data in connection with your booking but decide for themselves how to process it, under their own privacy policies.
- Booking platforms (GuruWalk, FreeTour, GetYourGuide, Civitatis, Headout, TripAdvisor, Google): if you book through one of them, it collects your data under its own privacy policy and passes us what we need to run your tour.
- Payment providers (SumUp, and the banks involved in a transfer): to process your payment and meet their own legal obligations.
- Google Maps: if you accept third-party cookies, the map on our website is loaded from Google, which processes your IP address under its own privacy policy.
- WhatsApp (WhatsApp Ireland Limited): if you contact us by WhatsApp.
- Public authorities, courts and the tax authorities: where the law requires us to disclose data.
6. International transfers
Some of our providers are based in, or process data in, the United States:
- Calendly LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection.
- Google relies on its certification under the EU–U.S. Data Privacy Framework and, as a supplementary safeguard, on Standard Contractual Clauses approved by the European Commission.
- Buttonizer stores its data on servers in the Netherlands. Your IP address passes through its content delivery network, Cloudflare, Inc., which is certified under the EU–U.S. Data Privacy Framework; Buttonizer states that it does not collect or use it.
7. Your rights
You have the right to:
- access the personal data we hold about you
- rectify data that is inaccurate or incomplete
- erase your data where it is no longer needed or you withdraw consent
- restrict how we process your data in certain circumstances
- receive your data in a portable format
- object to processing based on our legitimate interest, including our post-tour emails, at any time
- withdraw your consent at any time, for photographs or cookies, without affecting processing carried out before you withdrew it
To exercise any of these rights, write to info@walkietalkietours.com. To stop receiving post-tour emails, you can also use the unsubscribe link at the bottom of any of them, or simply reply and tell us. We will respond within one month. In complex cases this can be extended by up to two further months, and we will tell you if that happens. Where we cannot verify who you are, we may ask for proof of identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es, at any time — in particular if you are not satisfied with how we have responded to a request.
8. Minors
Bookings are made by adults. Where children join a tour, their data is provided by the accompanying adult, who remains responsible for it. We do not knowingly collect data directly from anyone under 14.
9. Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. No transmission over the internet is completely secure, but we work only with providers that apply suitable security measures.
10. Links to other websites
Our website links to other websites, including booking platforms, WhatsApp, Instagram and Facebook. We are not responsible for how those sites handle personal data, and we encourage you to read their privacy policies.
11. Changes to this policy
We may update this policy when our services, our providers or the law change. The date at the top shows when it was last revised.
12. Contact
Questions about this policy or about your data: info@walkietalkietours.com