Legal
Privacy Policy
This policy explains how [COMPANY NAME] (“we”, “us”), with registered office at [REGISTERED ADDRESS] and tax ID [NIF/CIF], processes personal data when you use auraretreats.travel or contact us.
1. Controller
Data controller: [COMPANY NAME], [REGISTERED ADDRESS], [NIF/CIF]. Contact: reservations@auraretreats.travel (confirm recipient).
2. Data we collect
- Enquiry form: name, email, preferred destination/dates, message.
- Itinerary designer (browser localStorage): selections you make locally on your device.
- Technical: IP address, user agent, and basic analytics events if Vercel Web Analytics is enabled.
- Payments (when Stripe is configured): handled by Stripe as an independent controller/processor; we receive confirmation of payment status, not full card numbers.
3. Purposes & legal bases (GDPR)
- Responding to enquiries and managing bookings — Art. 6(1)(b) contract / pre-contract steps, or Art. 6(1)(f) legitimate interests.
- Legal and tax compliance — Art. 6(1)(c).
- Site security and aggregated analytics — Art. 6(1)(f).
- Marketing emails only with consent — Art. 6(1)(a), where applicable.
4. Retention
Enquiry correspondence is kept as long as needed to respond and for up to [RETENTION PERIOD — e.g. 24 months] afterwards, unless a longer period is required for a booking or legal obligation.
5. Recipients
We may share data with hosting (Vercel), email delivery (Resend, when configured), payment (Stripe, when configured), and partner sanctuaries only as needed to fulfil a booking. Transfers outside the EEA use appropriate safeguards (e.g. SCCs).
6. Your rights
You may request access, rectification, erasure, restriction, portability, and objection, and withdraw consent where processing is consent-based. You may lodge a complaint with your supervisory authority (in Spain: AEPD). Contact us at the email above to exercise rights.
7. Cookies & analytics
Essential cookies may be used for site operation. Vercel Web Analytics, if enabled, collects privacy-friendly page-view metrics without advertising cookies. No third-party ad trackers are installed in this draft.
8. Changes
We will update this page when the draft is finalised with confirmed company details.