Privacy Policy Last Updated: October 2025 Who We Are Not Just a Tourist C/ Bartolomé de Medina 5, primero derecha 41004, Sevilla, Spain Contact: Email: info@notjustatourist.com Phone: +34 665 131 469 We provide authentic travel experiences in Seville, Granada, Andalusia, and Morocco. We respect your privacy and are committed to protecting your personal information. What Information We Collect When you book a tour or contact us, we collect: Booking Information: • Name and surname • Email address • Phone number • Home address • Date of birth • Nationality and passport/ID number (required by Spanish law) • Number of people in your group • For children: relationship to accompanying adult • Payment details (processed securely by our payment providers) Optional Information: • Dietary requirements or allergies • Special requests or accessibility needs • Travel preferences Website Information: • IP address • Browser type • Pages you visit • Cookies (see below) Why We Collect Your Information We use your information to: • Process and confirm your tour bookings • Communicate with you about your tour • Process payments securely • Comply with Spanish government requirements (tourist data reporting) • Share necessary details with our tour partners (hotels, restaurants, guides, transportation) • Occasionally send you tour recommendations (only if you agree) • Improve our services Legal Basis (GDPR): Contract: To fulfill your tour booking Legal Obligation: To comply with Spanish tourism law Legitimate Interest: To provide quality service and improve our business Your Consent: For marketing emails (you can unsubscribe anytime) Who We Share Your Information With We share your information only when necessary: Tour Partners: Hotels, restaurants, transportation providers, and local guides involved in your tour Payment Processors: Stripe and PayPal (they handle payments securely – we don’t store your card details) Spanish Government: As required by Spanish tourism law Third-Party Booking Platforms: If you book through platforms like TripAdvisor, Viator, or GetYourGuide We never sell your personal information to anyone. How Long We Keep Your Information Booking records: 3 years (Spanish legal requirement) Payment records: 6-10 years (tax purposes) Marketing emails: Until you unsubscribe Website data: 26 months Your Rights You have the right to: • Access your personal data • Correct inaccurate information • Delete your data (“right to be forgotten”) • Object to marketing emails • Withdraw consent at any time To exercise your rights: Email: info@notjustatourist.com Phone: +34 665 131 469 We will respond within 30 days. Cookies Our website uses cookies to: • Remember your preferences • Understand how visitors use our site (Google Analytics) • Ensure the website functions properly You can control cookies through your browser settings. When you first visit our site, we’ll ask for your consent to use non-essential cookies. Payment Security We use secure payment processors: • Stripe and PayPal for credit/debit card payments • Bank transfers for direct payments We do not store your credit card information on our servers. All payment data is encrypted and handled by our payment processors according to international security standards (PCI DSS). Customer Accounts If you create an account on our website: • Your information is stored securely • You can access and update your information anytime • You can request account deletion at any time If you book as a guest, we only keep the information necessary for your booking. Marketing Emails We occasionally send promotional emails about: • Special offers • New tours • Travel tips for Andalusia You can unsubscribe anytime by: • Clicking “unsubscribe” at the bottom of any email • Emailing us at info@notjustatourist.com • Calling +34 665 131 469 Data Security We protect your information with: • Secure website (SSL encryption) • Secure payment processing • Password-protected systems • Limited staff access to customer data However, no internet transmission is 100% secure. We do our best but cannot guarantee absolute security. Children’s Privacy We collect information about children only as part of family bookings. Parents or guardians must provide consent for minors’ information. International Data Transfers Some of our service providers (like payment processors) may be located outside the EU. When we transfer data internationally, we ensure it’s protected according to GDPR standards through: • EU-approved Standard Contractual Clauses • Adequate protection measures Changes to This Policy We may update this Privacy Policy occasionally. Any changes will be posted on this page with a new “Last Updated” date. Contact Us For any questions about this Privacy Policy or your personal data: Email: info@notjustatourist.com Phone: +34 665 131 469 Address: C/ Bartolomé de Medina 5, primero derecha, 41004, Sevilla, Spain Cookie Policy What are cookies? Cookies are small text files stored on your device when you visit our website. What cookies do we use? Essential Cookies: Required for the website to work (booking forms, security) We don’t need your consent for these Analytics Cookies: Google Analytics – helps us understand how visitors use our site We ask for your consent for these How to manage cookies: You can control or delete cookies through your browser settings: • Chrome: Settings > Privacy and Security > Cookies • Firefox: Settings > Privacy & Security > Cookies • Safari: Preferences > Privacy > Cookies This Privacy Policy complies with: • EU General Data Protection Regulation (GDPR) • Spanish LSSICE (Ley de Servicios de la Sociedad de Información) • Spanish LOPD (Ley Orgánica de Protección de Datos) • Spanish Royal Decree on Tourist Data Collection (December 2024) By using our website or booking our services, you acknowledge that you have read and understood this Privacy Policy.