1. Introduction

This Privacy Policy explains how Gata Sports Tours S.L. (“Gata Sports Tours”, “we”, “us”) collects, uses and protects your personal data when you visit our website, book a sports travel package, or contact us.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (“LOPDGDD”). By using our website or services, you acknowledge that you have read this Policy.

2. Who Is Responsible for Your Data

The data controller is:

• Company: Gata Sports Tours S.L.

• Tax ID (NIF): [B-XXXXXXXX]

• Registered address: [Street, number, postcode] Barcelona, Spain

• Privacy contact: [hi@gatasportstours.com]

We have not appointed a Data Protection Officer, as it is not required for our activity. For any privacy question, write to the email above.

3. What Personal Data We Collect

We only collect the data we need to plan and deliver your trip:

• Identity and contact: name, email, phone number and country of residence, when you book a call, contact us or book a package.

• Booking and travel: travellers’ names, dates, room preferences, passport or ID details when required by hotels or ticket issuers, dietary needs, and jersey size and personalisation, when you confirm a booking.

• Payment: amount paid, payment date and billing details. Card details are handled by our payment provider; we do not store full card numbers.

• Communications: emails, messages and notes from calls with our team.

• Website usage: pages visited, device and browser type, approximate location and referring site, when you browse our website.

If you book for other people (for example, family or friends travelling with you), please make sure they know you are sharing their data with us and that this Policy applies to them.

We do not ask for special categories of data. If you tell us about a health condition or dietary need so we can accommodate you, we will use it only for that purpose and with your consent.

4. Why We Use Your Data and on What Legal Basis

• Answer your enquiries and schedule calls to plan your trip: steps taken at your request before a contract (Art. 6.1.b GDPR).

• Book and deliver your package (hotels, match tickets, transport, restaurants, guides and custom merchandise): performance of a contract (Art. 6.1.b GDPR).

• Take payments, issue invoices and keep accounting records: legal obligation (Art. 6.1.c GDPR).

• Handle cancellations, refunds and complaints: performance of a contract and legal obligation (Art. 6.1.b and 6.1.c GDPR).

• Measure and improve how our website works: legitimate interest (Art. 6.1.f GDPR), or your consent where cookies require it.

• Send you news about upcoming events and offers: your consent (Art. 6.1.a GDPR), which you can withdraw at any time, or our legitimate interest for similar services if you are already a customer.

We do not make decisions about you based solely on automated processing, and we do not sell your personal data.

5. Who We Share Your Data With

We share your data only when needed to run our business or deliver your trip:

• Travel and event partners: hotels, football clubs and ticketing platforms, transport companies, restaurants, local guides and merchandise suppliers. They receive only the details needed to provide their part of your trip.

• Service providers acting on our behalf: website hosting and analytics (Framer B.V.), call scheduling (Calendly LLC), email and office tools [e.g. Google Workspace], payment processing [payment provider] and our accountants. They process data under our instructions and a data processing agreement.

• Public authorities: when the law requires it, for example tax authorities or police and immigration rules on hotel guest registration.

5.1 International Transfers

Some providers, such as Calendly and [Google], are based in the United States. When data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of these safeguards.

6. How Long We Keep Your Data

• Enquiries that do not lead to a booking: 12 months from our last contact.

• Booking and customer records: for the duration of the contract, then up to 5 years to handle possible claims (Spanish Civil Code, Art. 1964).

• Invoices and accounting records: 6 years (Spanish Commercial Code, Art. 30).

• Marketing preferences: until you unsubscribe or withdraw consent.

• Website analytics: as set out in our Cookie Policy.

When these periods end, we delete or anonymise your data.

7. Cookies

Our website uses cookies and similar technologies. Some are strictly necessary for the site to work; others help us understand how visitors use it. Non-essential cookies are only set if you accept them in our cookie banner. You can change your choice at any time through “Cookie Settings” at the bottom of every page.

8. Your Rights

You can exercise the following rights at any time, free of charge:

• Access: know what data we hold about you and get a copy.

• Rectification: correct data that is wrong or incomplete.

• Erasure: ask us to delete your data when it is no longer needed.

• Restriction: ask us to limit how we use your data.

• Objection: object to processing based on our legitimate interest, including marketing.

• Portability: receive your data in a structured, machine-readable format.

• Withdraw consent: at any time, without affecting earlier processing.

To exercise them, email [hi@gatasportstours.com] with the subject “Data Protection” and tell us which right you want to use. We may ask you to confirm your identity. We will reply within one month.

If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority of your country of residence.

8.1 Visitors from the United States

Many of our customers live in the United States. We apply the rights above to all customers, wherever they live. We do not sell or share personal information for cross-context behavioural advertising.

9. Security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, and we only give access to people who need it to do their job. No transmission over the internet is completely secure, so please contact us if you think your data has been put at risk.

10. Children

Our services are aimed at adults. Bookings must be made by a person aged 18 or over. Data about minors travelling with their family is provided by their parent or guardian and used only to organise the trip.

11. Links to Other Websites

Our website links to third-party sites such as Calendly, Instagram and our partners’ websites. Their privacy practices are their own; please read their policies.

12. Changes to This Policy

We may update this Policy from time to time. The latest version will always be on this page, with the date of the last update at the top. If changes are significant, we will let our customers know by email.

13. Contact

For any question about this Policy or your data, write to [hi@gatasportstours.com].

Gata Sports Tours S.L.