This text is a legally informed basis, but it does not replace review by a lawyer. Complete the bracketed fields with the company's real details before publishing.
1. Data controller
Viviany Costa, registered as self-employed in Spain and trading as Upper Madrid, with a business address at Calle Príncipe de Vergara 132, 28002 Madrid, Spain, email info@uppermadrid.com, telephone +34 623 569 235. Tax identification details appear on the proposal and on the invoice issued to the client. She is the controller of the personal data collected through this website.
2. Data we collect
We collect only the data needed to respond to enquiries and to provide our services:
- Contact data: name, email, telephone or WhatsApp and country of residence.
- Trip data: dates, number and ages of travellers, interests, preferences, accommodation and whatever else you choose to share.
- Special category data, provided voluntarily: dietary requirements, health or mobility conditions you choose to tell us about so that the service can be adapted. We process this data only on the basis of your explicit consent and solely for the purpose stated.
- Browsing data: IP address, device type, pages visited and referral source, through analytics tools, according to your cookie choice.
3. Purposes and lawful bases
- Responding to enquiries and preparing proposals. Lawful basis: steps taken at the request of the data subject prior to entering into a contract.
- Providing the service engaged. Lawful basis: performance of a contract.
- Meeting tax and accounting obligations. Lawful basis: compliance with a legal obligation.
- Sending communications about our services. Lawful basis: consent, which may be withdrawn at any time.
- Analysing use of the website. Lawful basis: consent, given through the cookie banner.
4. Sharing of data
To deliver the service, we may share the strictly necessary data with suppliers such as restaurants, guides, transport companies, hotels and activity providers. We share only what each booking requires.
We also use technology providers for website hosting, email and analytics. These act as data processors on our behalf under a written processing agreement.
We do not sell, rent or otherwise transfer personal data to third parties for commercial purposes.
5. International transfers
Some technology providers may be located outside the European Economic Area. In those cases, we ensure the transfer takes place under an adequacy decision of the European Commission or under standard contractual clauses.
6. Retention periods
Enquiries that do not lead to a contract are kept for up to 24 months. Client data is kept for the duration of the contractual relationship and, after it ends, for the retention periods required by tax and civil law, generally five to six years.
7. Your rights
As a data subject you may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent, by writing to info@uppermadrid.com with proof of identity.
If you believe your rights have not been properly respected, you may lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es). Travellers resident elsewhere may also contact the supervisory authority of their country of residence.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including encrypted connections, restricted access and periodic review of our suppliers.
9. Children
This website is not intended for children under 14. Data about children who are travelling is provided by a parent or legal guardian as part of engaging the service.
10. Changes
This policy may be updated. The current version is always available on this page, with the date of the latest update.