1. Who is responsible for your data
The data controller is Briskio Curious Valt S.L. ("we", "us"), company number B-88472051, registered at Carrer de la Marina 212, 3º 2ª, 08013 Barcelona, Spain. For any privacy matter, including requests to exercise your rights, contact our data protection contact at [email protected]. General enquiries go to [email protected].
2. What we collect
We keep collection deliberately narrow. In practice there are three categories:
- Information you send us. If you use the enquiry form or email us, we receive your name, email address, the region you selected, the number of nights you entered and the text of your message.
- Technical information. Our hosting infrastructure records server log data such as IP address, user agent, requested URL, referrer and timestamp. These logs exist for security, abuse prevention and fault diagnosis.
- Consent and preference data. Your cookie choice is stored in your browser's local storage so the banner does not reappear on every page. This is stored on your device, not on our servers.
We do not ask for payment details, passport data, health data or any other special category data. Please do not send such information to us.
3. Why we process it, and on what legal basis
Under the EU General Data Protection Regulation we rely on the following bases. Consent (Art. 6(1)(a)) for optional analytics and functional cookies, and for replying to you by email where you tick the consent box. Legitimate interests (Art. 6(1)(f)) for keeping the site secure, preventing abuse of the contact form and understanding aggregate site performance where that does not require consent. Legal obligation (Art. 6(1)(c)) where we must retain records to comply with Spanish accounting, tax or regulatory requirements.
4. Cookies and similar technologies
We use a small set of cookies and local storage entries. Essential items keep the site functional and remember your consent decision. Optional analytics items help us see which route guides are read and where visitors leave. Optional functional items remember interface preferences. Nothing optional is set before you choose, and you can change your decision at any time. Full details, including the cookie table and browser opt-out instructions, are in our Cookie Policy.
5. Third-party processors
We use a limited number of service providers, engaged under written data processing agreements and instructed to process data only on our behalf. They fall into these categories: a web hosting and content delivery provider that serves the site and holds server logs; an email service provider that delivers and stores correspondence sent to our addresses; and a privacy-oriented analytics provider that reports aggregate traffic patterns, active only if you consent to analytics cookies. Where a processor handles data outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an equivalent recognised transfer mechanism. We do not sell personal data, and we do not share it with advertising networks or data brokers.
6. How long we keep it
- Enquiry correspondence: up to 24 months after the last message, so we can follow up on a continuing conversation, then deleted.
- Server logs: typically 30 days, unless retained longer for the investigation of a specific security incident.
- Analytics data: retained in aggregated form only; individual-level records are not built.
- Consent records: stored on your device until you clear your browser storage or change your choice.
- Accounting records: retained for the period required by applicable Spanish law.
7. Your rights
If you are in the EEA or the UK, you have the right to access your personal data, to rectify inaccurate data, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing. To exercise any right, email [email protected]. We respond within one month and may ask a question to confirm your identity before acting. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos, or with your local data protection authority.
If you are a California resident, you may request disclosure of the categories and specific pieces of personal information we hold, request deletion, and opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights. Requests can be submitted to the same address.
8. Security and children
The site is served over HTTPS, administrative access is limited to named individuals, and we minimise what we store in the first place as our principal safeguard. No system is perfectly secure, and we cannot guarantee the security of information you send us by email. The site is intended for adults planning travel; we do not knowingly collect data from children under 16. If you believe a child has sent us personal data, contact us and we will delete it.
9. Changes to this policy
We may update this policy to reflect changes in our processing, our processors or applicable law. The revision date at the top of the page always shows the current version. Material changes affecting how we use data you have already given us will be highlighted on this page before they take effect.