Privacy Policy

1. Controller

ARGY Tourism, S.L. (SENSA), NIF B75294511, Plaza de la Encarnación, 22, 41003 Sevilla, Spain. Contact for any data protection matter: info@sensatourism.com.

When you book through a hotel's page, SENSA is the controller of your booking data.

2. Data we process

• Booking holder: first name, last name, email and phone number.
• Booking details: experiences, dates and times, modality, language, number of participants, amounts, booking reference, meeting point, the channel through which you booked and the language of the website.
• Billing (only if you ask for a full invoice; it is mandatory if the booking exceeds €400): customer type (individual or company), name or company name, tax ID or passport number, address, postal code where applicable, city and country.
• Participants: where an experience requires nominative tickets, the full name and identity document or passport number of each participant.
• Payment: you pay by card on our payment provider's secure page (Redsys). Card details are entered there; SENSA does not receive or store them. We send Redsys only the amount, the currency, an order reference, the language and the return addresses, never your name or email. We keep the result of the payment, its reference and the response code.
• Cancellations and refunds: date, reason, amount, the result of each refund and the staff member who handles it.
• Contract records: the version of the Terms & Conditions and of this policy you accepted, when you accepted them and the cancellation condition applicable to each experience.
• Communications: the confirmation, voucher and refund emails we send you and their delivery status, and the content of messages you send us by email, phone or WhatsApp about your booking.
• Browsing analytics: none. SENSA does not analyse how you navigate.
• Technical data: your IP address is processed transiently to protect the booking service against abuse and appears in server logs for security reasons; it is not stored with your booking.

If you provide data about other participants, you must have informed them of this policy.

Participant names and document numbers are never stored in your browser or included in emails.

3. Purposes and legal bases

• Managing and delivering your booking, including payment, refunds, invoicing and service communications by email, phone or WhatsApp: performance of the contract (Article 6(1)(b) GDPR).
• Participants' identity document data: only to issue the nominative tickets or access that the venue requires, as part of performing the contract (Article 6(1)(b) GDPR) and in SENSA's legitimate interest in providing access to the participants included in the booking (Article 6(1)(f) GDPR).
• Issuing invoices, meeting accounting and tax obligations, and keeping booking and contract records: legal obligation (Article 6(1)(c) GDPR).
• Handling claims and defending against them: legitimate interest (Article 6(1)(f) GDPR).
• Protecting the service against abuse and fraud: legitimate interest in the security of the service (Article 6(1)(f) GDPR).
• Website navigation is not analysed. Sales, payment and refund figures come from booking records.

SENSA does not send commercial communications. We do not make automated decisions with legal effects on you.

4. Recipients

• Redsys (Redsys Servicios de Procesamiento) and SENSA's bank (CaixaBank, through its virtual POS): process card payments and refunds under their own terms and privacy policies.
• Where booking an experience requires nominative tickets or the identification of its participants, SENSA may use and communicate to the relevant organisers, monuments or entities only the personal data strictly necessary to manage those bookings and purchase the tickets.
• Guides and providers who deliver the experience, only with the information necessary to do so.
• Service providers that process data on SENSA's behalf, under a data processing agreement: IONOS SE (server hosting and encrypted backups, European Union), Holded Technologies S.L. (invoicing software in which the SENSA team issues invoices; it receives only the data needed to issue them) and Resend (delivery of booking emails; European Union region, Ireland; its data processing agreement is part of its terms of service, and any transfer outside the European Economic Area is made under standard contractual clauses).
• WhatsApp (WhatsApp Ireland Limited), if you contact us that way, under its own terms; this may involve transfers to Meta Platforms, Inc. in the United States with the safeguards Meta relies on. You can use email or phone instead.
• SENSA employees with an individual account in the Booking Backoffice, to manage bookings. Every access is logged; access to blocked data is exceptional and requires a reason.
• Public authorities, when legally required.

SENSA will not provide copies, photographs or reproductions of identity documents to third parties without the express authorisation of the data subject, unless an applicable legal obligation requires it.

If a service provider processes data outside the European Economic Area, this will only take place with appropriate safeguards, such as an adequacy decision or standard contractual clauses.

Links to Google Maps for meeting points are plain links: no Google resource is loaded until you click.

5. Retention

• Participants' identity document data: stored encrypted and automatically deleted from day 30 after the date of the booking's last experience (the latest one, if there are several). If an incident or claim is open, staff may keep it for as long as it lasts, with a recorded reason.
• Booking holder data (first name, last name, email, phone) and billing data: kept in ordinary use for six months from the latest of: the last experience, the cancellation or the last refund. After that the phone number is deleted and the rest is blocked: it is taken out of ordinary use and kept only at the disposal of judges, courts and authorities during the limitation periods for liability (six years for commercial and accounting obligations; four for tax; five for contractual claims). When that obligation ends (six full financial years after the close of the year of the last operation), it is anonymised: name, email, company name, tax ID, address and city.
• Bookings that were never paid (pending or failed): anonymised after six months.
• Kept without data that identifies you: booking reference, amounts, payments and their references, refunds, dates, statuses, invoice status and reference, and the version and date of acceptance of the Terms.
• Historical usage data (collected with consent before 22-10-2026): aggregated, deleted after 25 months.
• Backups: encrypted server backups rotate every 7 days, and an additional encrypted copy, kept off the server, rotates every 30 days (the 7 most recent are always kept). Deleted data therefore disappears from backups at most about 30 days later.
• Server logs: kept for 30 days and then deleted.

6. Your rights

You can request access, rectification, erasure, restriction, objection and portability by writing to info@sensatourism.com. Erasure of data we are obliged to keep will apply when the obligation ends, as set out in section 5.

If you consider that your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).