Privacy Policy

1. Who we are

Get Lanzarote sells activities and days out in Lanzarote, Canary Islands, Spain, run by local operators. We are responsible for the personal data described here.

For anything about your data, write to hello@getlanzarote.com.

2. What we collect

• When you book: name, email, phone, how many adults and children, where you are staying if the activity picks you up, and anything you add in the notes.
• When you pay: the card payment is processed by our payment provider. We receive whether it was authorised and a reference, not your full card number.
• When you use the chat: what you write. Please do not type card details or anything sensitive.
• When you write to us: your name, email and message.
• If you arrive from a code in a villa: which villa code you scanned, so the booking is attributed to it.
• If you sign up as an operator: company, contact person, phone, email, activity and website, and, when you accept the collaboration agreement, the date, time, IP address and version accepted.
• Technical data: to stop abuse we limit how often a form can be sent; for that we keep a one-way hash of your IP address, not the address itself.

3. What we use it for, and on what basis

• Your booking (contract): to confirm it, pass it to the operator, send you the details, handle changes, cancellations and refunds.
• Answering you (your request): the chat and the contact form.
• Ideas and offers by email (consent): only if you tick the box when booking or turn it on in your account. It is off unless you turn it on, and you can turn it off at any time from My bookings or by replying to any email.
• Security (legitimate interest): limiting abuse of the forms and the chat.
• Accounting and tax (legal obligation): keeping booking and payment records.

We do not sell your data.

4. Who receives it

• The operator who runs your activity: your name, group size, phone and pick-up point, only to run it. Our agreement forbids them from using it for their own marketing.
• Companies that work for us, only for the service they provide: Supabase (database), Vercel (hosting of the website), Resend (sending our emails), OpenAI (writes the chat replies from what you type; under its API terms it does not use that to train its models) and our card payment provider.

Some of them are based outside the European Economic Area. Those transfers are covered by the safeguards the GDPR requires, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

5. How long we keep it

• Bookings and payments: as long as Spanish tax and accounting law requires.
• The chat: we do not store your conversation. OpenAI may keep it for up to 30 days to detect abuse, and then deletes it.
• Permission to email you: until you withdraw it. We keep the date you gave it and withdrew it.
• Operators: while we work together, and afterwards as long as the law requires.

6. Your rights

You can ask to access, correct or delete your data, to restrict or object to how we use it, to take a copy with you, and to withdraw any consent you gave. Write to hello@getlanzarote.com. If you think we have not handled it properly, you can complain to the Spanish Data Protection Agency (aepd.es).

7. Cookies

We only use the cookies the site needs to work. Details in the cookie policy.

8. Contact

hello@getlanzarote.com