1. Who is the controller
- Owner: XR EXPERIENCES 2025, S.L.
- Trade names: XR Experiences and VR Guide Me Málaga
- NIF (Spanish tax ID): B75965087
- Registered office: Pl. de Uncibay, 3, Planta -1 (Galerías Goya), 29008 Málaga (Spain)
- Email: [email protected]
- Phone and WhatsApp: +34 670 11 73 17
- Registry details: Registered in the Commercial Registry of Málaga, sheet MA-188159, electronic folio, entry 1, dated 14/03/2025
- Management: Sole director
For any question about your data, write to us at [email protected]. We are not required to appoint a data protection officer and have not done so.
This policy applies to the data we process through the website xrexperiences.es, our contact channels (WhatsApp, email and phone) and our tour bookings. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
2. Where the data comes from
- From you: when you book, message us on WhatsApp or by email, call us, fill in the schools form or subscribe to the blog.
- From booking platforms: if you book on Civitatis, GuruWalk, FreeTour, GetYourGuide or another platform, it sends us the data needed to run the tour (name, contact, language, number of people, date). Each platform is responsible for the data it processes on its own account under its own privacy policy.
- From your browser: technical connection data (such as your IP address) that reaches our server and Cloudflare when you visit the website.
The website uses Google Analytics 4 to measure how it is used (pages viewed, where visits come from, which tours are looked at and which bookings are started), only if you accept analytics cookies in the notice shown when you arrive; if you reject them, nothing from Google is loaded and your visit is not measured. IP addresses are anonymised and data is kept for 14 months. We do not use social media pixels or advertising, and we do not build visitor profiles.
3. What we use your data for, legal basis and retention
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Managing your booking and running the tour: confirmation, reminders, changes, payments, refunds and coordination with the guide | Name, email, phone, language, tour, date, number of people and, where applicable, payment details (payment is processed by FareHarbor: we neither see nor store your full card number) | Performance of a contract (Art. 6(1)(b) GDPR) | While the booking is managed and, afterwards, 6 years for invoices and accounting records (Art. 30 Spanish Commercial Code). Messages and operational data, up to 5 years after the tour to handle possible claims (Art. 1964 Spanish Civil Code), restricted and only for that purpose. |
| Answering your enquiries by WhatsApp, email or phone | The data you give us: name, phone or email and the content of your message | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) or our legitimate interest in replying (Art. 6(1)(f) GDPR) | 1 year from the last communication, unless the enquiry becomes a booking (then as in the row above) |
| Answering requests from schools (form on the schools page) and preparing a proposal | Name, school, phone and, if you provide them, year group and number of pupils | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | 2 years from the last contact if no contract is signed; if it is, as in the first row |
| Sending you the blog’s stories by email (subscription) | Email, date and page you subscribed from, and a record of your consent | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time | Until you unsubscribe. After that we keep a restricted record of the subscription and unsubscription for 3 years, only to prove we acted correctly (Art. 32 Spanish Data Protection Act, LOPDGDD) |
| Protecting the website and preventing abuse (for example, limiting repeated form submissions) | IP address and technical connection data | Legitimate interest in website security (Art. 6(1)(f) GDPR) | Our server keeps the IP address in memory only, for at most 1 hour; it is not written to log files. Cloudflare processes technical data under its own policy |
| Complying with legal obligations (tax, accounting, consumer law) and defending ourselves against claims | Whatever is needed in each case | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) | The periods set by law (for example, 4 years for tax and 6 years for commercial matters) |
Fields marked as required in each form are needed to handle your request; if you do not fill them in, we will not be able to. We do not make automated decisions that produce legal effects on you or similarly significantly affect you.
We will only send you marketing by email or messaging if you have given your consent or, if you are already a customer, about services of ours similar to those you purchased (Art. 21 LSSI-CE); in both cases you can object at any time and every message will tell you how.
4. Data that passes through third parties when you use the website
- Booking calendar: free days and times are requested from FareHarbor by our server; your browser sends no personal data at that step. When you pick a time and click “Book”, the FareHarbor booking (fareharbor.com) opens in a window on our website; the data you enter there is received by FareHarbor, which processes booking data on our behalf and payment data with its own payment providers.
- Google reviews: the rating and number of reviews you see are fetched by our server; your browser does not connect to Google to display them.
- Typefaces: fonts are served from our own server; your browser does not connect to Google or any other third party to load them.
- WhatsApp, Google Maps, Instagram and Facebook: these are links, not embedded content. They only connect to those services if you click the link, and from then on their privacy policy applies.
5. Who receives your data
We do not sell your data or share it with third parties for their own purposes. The following may access it:
- The guides who run your tour (our own staff or contractors bound by a processing agreement and confidentiality), only with the data they need: booking name, number of people, language and, if necessary, a contact phone number.
- Our tax and accounting advisers, banks and payment institutions, and public authorities and courts where required by law.
- The platform you booked through, when a change, cancellation or incident has to be handled with it.
- Our providers (processors), who process data only on our instructions and under a contract that obliges them to protect it:
| Provider | What for | Where |
|---|---|---|
| FareHarbor (FareHarbor Holdings, Inc.) | Booking system, availability, payments and confirmation emails | USA |
| Cloudflare, Inc. | Website delivery (content delivery network, DNS, secure connection to our server and attack protection) | USA and global network |
| Google Ireland Ltd. (Google Analytics 4) | Website usage statistics, only if you accept analytics cookies | Ireland and USA |
| Brevo (Sendinblue SAS) | Sending the blog emails | European Union (France) |
| Bird (MessageBird B.V.) and WhatsApp (WhatsApp Ireland Ltd., Meta group) | WhatsApp messaging with customers | European Union; Meta may process data in the USA |
| Google (Google Ireland Ltd. / Google LLC) | Email and document storage | European Union and USA |
| Anthropic, PBC | Artificial intelligence tools that help us read, organise and draft replies to messages and bookings | USA |
| Email provider for the xrexperiences.es domain | [email protected] mailbox | — |
6. International transfers
Some of the providers above are located in the United States or may access data from there. These transfers are made with appropriate safeguards: the European Commission’s adequacy decision on the EU-US Data Privacy Framework (10 July 2023) for providers certified under it, and otherwise the standard contractual clauses approved by the European Commission (Art. 46 GDPR) included in their data processing agreements. You can ask us for more information about these safeguards at [email protected].
7. Your rights
You can exercise, at any time and free of charge, your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent (for example, unsubscribe from the blog) without affecting anything done before.
To exercise them, write to [email protected] or by post to XR EXPERIENCES 2025, S.L., Pl. de Uncibay, 3, Planta -1 (Galerías Goya), 29008 Málaga (Spain), stating which right you wish to exercise. We will only ask you to prove your identity if we have reasonable doubts about it. We will reply within one month, which may be extended by two further months for complex requests, in which case we will let you know.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es) or with the supervisory authority of your country of residence. We would appreciate it if you told us first so we can try to fix it.
8. Children
The website is not aimed at children under 14, who may not subscribe to the blog or send us their data on their own. Data about children taking part in a tour (for example, to count places) is provided by their parent or guardian or, on school trips, by their school.
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS) across the website, restricted password-protected access to our internal tools, encrypted backups and submission limits on forms. Should a security breach affecting your data ever occur, we will act in accordance with Articles 33 and 34 GDPR.
10. Changes to this policy
We will update this policy when what we do with data or the law changes. If the change is significant and we have your contact details, we will let you know. More about storage in your browser in our cookie policy.
This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.
Last updated: 2 November 2026