Privacy policy

Last updated: 9 October 2026

This policy is based on the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).

Who is responsible for your data?

TRIPTO X VENTURES, S.L. (trading as Avesta Travel Agency), NIF B93935120, Calle Juan Antonio de Torquemada 2 (A), Escalera 7, Planta 00, Puerta B82, Residencial Acqua Fase IV, 29670 Marbella (Málaga), Spain. Email: avestatravelagency@gmail.com.

What data we collect

  • Contact and booking requests: name, email, phone number, country, number of travellers, each child’s age in years on departure (no birth dates), travel dates and any message you send us.
  • Booked trips: the details we need to arrange your trip, such as passport details for some services, dietary needs or accessibility needs (only if you give them to us).
  • Newsletter sign-up is unavailable. Submitted addresses are not stored, sent or logged by the newsletter action.
  • Technical data: basic data needed to run the website safely, such as your IP address in server logs.

Why we use it, and our legal basis

  • Answering your questions and booking requests: steps before a contract, at your request.
  • Organising and managing your trip: performance of the contract.
  • Newsletter marketing is currently disabled.
  • Accounting, tax and legal duties: legal obligation.
  • Keeping the website secure: legitimate interest.

Who we share it with

Only with the suppliers needed for your trip (hotels, transport companies, guides, insurers), our IT and email providers, and public authorities when the law requires it. Some providers may be outside the European Economic Area. If so, we use legal safeguards such as the EU Standard Contractual Clauses.

How long we keep it

  • Booking requests that don't become a trip: up to 12 months.
  • Booking and invoice data: as long as tax and consumer law requires (usually up to 6 years).
  • No newsletter subscription records are currently created.

Google Maps is optional and loads only when you select “Load Google Maps”. Google then receives your IP address and browser information and may use cookies or process data outside the EEA under its own privacy policy (https://policies.google.com/privacy). You can remove the embedded map; removal stops the embed but does not undo data already sent or remove Google cookies. Your loading choice is held only in component memory. External Google Maps links also contact Google when opened.

Your rights

You can ask to access, correct or delete your data, limit or object to how we use it, or receive a copy (portability). To do this, write to avestatravelagency@gmail.com. If you are not happy with our answer, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).