Privacy policy
Last updated: 29 October 2026
Here we explain, in plain words, what personal data we process, why we do so and what rights you have, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (Spanish Data Protection and Digital Rights Act, LOPDGDD).
01Who is the controller of your data
- Owner
- Marta Estany Sanchez
- Trading name
- Esenzia Travels
- Tax ID (NIF)
- 39396292Y
- Registered address
- C/ Faig, 14, 08272 Sant Fruitós de Bages (Barcelona)
- Phone
- +34 695 343 267
- Activity
- Design and organisation of private, tailor-made experiences and trips in Barcelona, Catalonia and the Balearic Islands
We have not appointed a data protection officer because the law does not require us to. For any question about your data, write to us at info@esenziatravels.com.
02What data we process
- When you ask us for a proposal using the form: the occasion, the approximate dates, the number of nights, the number of travellers, your interests, the budget range, your full name, email, phone or WhatsApp, country, any comments you add, the experience you were looking at and the page from which you reached the form.
- When you ask for the Little Black Book: your email address and the language of the website, to send you the guide and Marta’s monthly letter.
- When you write to us or call us by email, phone or WhatsApp: the data you send us.
- If you book a trip: each traveller's data needed for the bookings (name, date of birth, nationality, identity document or passport, emergency contact), billing data and payment data. We do not store full bank card numbers.
- Special requirements: allergies, diets, reduced mobility or other health needs. We only process them if you give them to us with your explicit consent, and only to adapt the trip.
- Minors: the data of travelling minors, which must be provided by their parents or guardians.
- Partners and suppliers: the professional contact details of the people we work with.
- Technical data: for security reasons, the server logs the IP address, the date and time, the page viewed and the browser. We do not use analytics or advertising tools.
03Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your request and preparing a proposal for you | Your consent and the pre-contractual steps you ask us to take (Art. 6(1)(a) and 6(1)(b) GDPR) |
| Organising the trip, making bookings with suppliers and looking after you during the trip | Performance of the contract (Art. 6(1)(b) GDPR) |
| Taking dietary, mobility or health needs into account | Your explicit consent (Art. 9(2)(a) GDPR) and, in an emergency, the protection of vital interests (Art. 9(2)(c) GDPR) |
| Invoicing, keeping accounts and reporting traveller data to accommodation providers and the authorities as required by law (Real Decreto 933/2021) | Legal obligations (Art. 6(1)(c) GDPR) |
| Sending you news and proposals | Your consent or, if you are already a client, our legitimate interest in offering you similar services (Art. 21.2 LSSI-CE). You can unsubscribe from any message. |
| Managing the relationship with partners and suppliers | Legitimate interest (Art. 6(1)(f) GDPR) |
| Keeping the website secure and preventing abuse | Legitimate interest (Art. 6(1)(f) GDPR) |
| Handling complaints and requests to exercise rights, and defending ourselves if necessary | Legal obligations and legitimate interest (Art. 6(1)(c) and 6(1)(f) GDPR) |
We do not make automated decisions or create profiles.
04How long we keep it
- Requests that do not lead to a booking: twelve months from the last contact.
- Clients: for as long as the relationship lasts and, afterwards, blocked for the periods set by law. These are six years for accounting records (Art. 30 of the Código de Comercio, the Spanish Commercial Code), four years for tax obligations and, in addition, the limitation period for any claims that may arise from the contract.
- Health data and special requirements: we delete them when the trip ends, unless they are needed to handle a complaint.
- Identity documents: for as long as needed for the bookings and as set by the applicable rules. For the traveller register, this is three years.
- Marketing communications: until you unsubscribe.
- Server technical logs: a short period, of twelve months at most.
05Who we share it with
- The suppliers of your trip, such as accommodation, restaurants, guides, transport companies and chauffeurs, boat skippers, wineries or event organisers. We only pass on the data they need to provide the service, and each of them is responsible for it under its own policy.
- Suppliers that work for us, such as web hosting, email, management tools and our accounting and tax advisers. We have contracts that require them to protect the data and to use it only for us (Art. 28 GDPR).
- Banks and payment institutions, to process payments.
- Insurers, if you take out travel insurance.
- Public authorities, courts and law enforcement agencies, when required by law.
We do not sell your data or pass it on to anyone so that they can advertise to you.
06Transfers outside the European Economic Area
We normally process data within the European Economic Area. It may leave it in these cases:
- when the trip includes services outside the European Economic Area or you live outside it, and the transfer is necessary to perform the contract (Art. 49(1)(b) GDPR);
- when a technology provider, for example for email or messaging such as WhatsApp, processes data outside the European Economic Area. In that case, it does so under an adequacy decision, such as the EU-US Data Privacy Framework, or with the European Commission's standard contractual clauses. If you ask us, we will give you a copy.
07Your rights
At any time, you can ask us for access to your data, its rectification, its erasure, restriction of processing or portability, or object to our processing it. You can also withdraw any consent you have given us. Withdrawing it does not affect the lawfulness of the processing we have carried out up to that point.
Write to us at info@esenziatravels.com with the subject “Data protection” and tell us which right you wish to exercise. If we have doubts about your identity, we may ask you to prove it. We will reply within one month.
If you believe we have not handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency) (www.aepd.es).
08Data of other people and of minors
If you give us data about other travellers, you must have informed them of this policy and have their permission. The website is not aimed at children under fourteen, who cannot give consent on their own (Art. 7 LOPDGDD). The data of travelling minors must be provided to us by their parents or guardians.
09Security
We apply technical and organisational measures appropriate to the risk. The website uses an encrypted connection (HTTPS), access to data is limited to the people who need it, and we only work with providers that offer sufficient guarantees.
11Social media
We have profiles on Instagram and LinkedIn. If you interact with them, we process the data you make public only to reply to you, and those platforms process it under their own policies. For profile statistics, we are joint controllers with each platform.
12Changes to this policy
If we change the way we process data, we will update this page and change the date. If the change is significant and we have your email address, we will also let you know.