Privacy Policy

Last updated: 18 April 2026

Girona Bike Tours ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, share, and protect information about you when you visit our website or purchase our services.

This policy complies with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Spanish Data Protection Act (LOPDGDD), and the UK GDPR where applicable.

1. Data Controller

Girona Bike Tours S.L.
Carrer de la Força 12, 17004 Girona, Catalonia, Spain
Email: privacy@gironabiketours.com
Phone: +34 972 000 000

2. Personal Data We Collect

2.1 Information You Provide Directly

Contact details: name, email address, phone number, country of residence
Booking information: selected tour, preferred dates, group size, fitness level
Communication records: messages sent via the contact form or email
Payment data: processed securely by our payment provider — card numbers are never stored on our servers

2.2 Information Collected Automatically

IP address and approximate geographic location
Browser type and version, operating system
Pages visited, time on page, referring URL
Device type and screen resolution
Cookie and session data (see Section 5)

3. Legal Basis for Processing

Purpose	Legal Basis
Responding to enquiries and booking tours	Contractual necessity (Art. 6(1)(b))
Processing payments	Contractual necessity (Art. 6(1)(b))
Sending booking confirmations and service communications	Contractual necessity (Art. 6(1)(b))
Marketing emails and newsletters (opt-in)	Consent (Art. 6(1)(a))
Analytics cookies (Google Analytics 4)	Consent (Art. 6(1)(a))
Advertising cookies (Google Ads)	Consent (Art. 6(1)(a))
Record-keeping and legal compliance	Legal obligation (Art. 6(1)(c))
Fraud prevention and website security	Legitimate interests (Art. 6(1)(f))

4. How We Use Your Personal Data

Respond to enquiries and process tour bookings
Provide contracted services (guided tours, bike hire, accommodation)
Send booking confirmations, itineraries, and pre-departure information
Process and verify payments
Send marketing communications if you have opted in
Improve our website using aggregated, anonymised analytics data
Comply with our legal obligations under Spanish and EU law
Investigate and prevent fraud or security incidents

5. Cookies & Tracking Technologies

Our website uses cookies. We implement Google Analytics Consent Mode v2, which means analytics and advertising cookies are only activated after you give explicit consent via our cookie banner.

Cookie Type	Purpose	Provider	Consent Required
Necessary	Cookie consent preferences, session management	Girona Bike Tours	No — essential
Analytics	Website usage statistics (pages, sessions, referrals)	Google Analytics 4	Yes — opt-in
Marketing	Ad personalisation, conversion tracking, remarketing	Google Ads	Yes — opt-in

You can manage your preferences at any time by clicking Cookie Settings. You can also opt out of GA tracking globally via the Google Analytics Opt-out Add-on.

6. Sharing Your Personal Data

We do not sell, rent, or trade your personal data. We may share it with:

Service providers: payment processors, accommodation partners, email delivery services — only as necessary
Google LLC: analytics and advertising services, subject to your consent
Legal authorities: where required by law or court order

7. Data Retention

Booking records and invoices: 7 years (Spanish tax law)
Contact enquiries (no booking): 2 years from last contact
Marketing consent records: until withdrawal + 1 year
Cookie consent records: 13 months from date of consent
Website analytics data: 14 months (GA4 default)

8. Your Rights Under GDPR

Right of access (Art. 15): Request a copy of the data we hold about you
Right to rectification (Art. 16): Request correction of inaccurate data
Right to erasure (Art. 17): Request deletion of your data
Right to restriction (Art. 18): Request limits on how we process your data
Right to data portability (Art. 20): Receive your data in machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interests
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time

To exercise any right, contact: privacy@gironabiketours.com
We respond within 30 days. You may also complain to the Spanish DPA: www.aepd.es

9. International Data Transfers

Some providers (including Google) process data outside the EEA. We ensure appropriate safeguards (EU Standard Contractual Clauses or EU-US Data Privacy Framework certification).

10. Data Security

HTTPS encryption for all data in transit
Access controls on a need-to-know basis
Regular security updates and vulnerability assessments
Secure payment processing via PCI-DSS compliant providers

11. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has submitted data to us, contact us immediately.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be highlighted on our website. Continued use after changes constitutes acceptance of the updated policy.

13. Contact Us

Privacy / DPO Contact
Girona Bike Tours S.L., Carrer de la Força 12, 17004 Girona, Spain
Email: privacy@gironabiketours.com
We aim to respond within 5 working days.

← Back to Home | Manage Cookie Preferences