ESEN
NETSANET

Privacy Policy

1. Data controller

The controller responsible for personal data collected through this website is:

  • Name: Patricia Ihenacho Otero.
  • Trading name: NETSANET Private Expeditions.
  • Spanish tax identification number (NIF): 78945120-N.
  • Address: C/ General Concha 2, 5.º derecha, 48008 Bilbao, Bizkaia, Spain.
  • Email for enquiries and data protection rights: [CONTACT EMAIL].
  • Website: https://netsanetprivateexpeditions.com/.

This policy explains how we process personal data provided when browsing the website, using its forms or contacting us for information about expeditions.

2. Personal data we process

Depending on how you contact us, we may process:

  • Identification and contact details: name, email address and telephone number.
  • Travel preferences: your destination of interest and other information necessary to prepare the proposal you request.
  • The content of your communications with us.
  • Technical browsing data and server logs, such as IP address, access date and requests made, where recorded by the systems used to provide and protect the service.
  • Data associated with cookies or similar technologies, according to their configuration and as explained in the Cookie Policy.

Please provide only the information necessary to deal with your request. Do not send passport copies, medical information or other particularly sensitive data through the contact form.

If additional information is needed to arrange a trip, we will explain how it will be processed before requesting it.

3. Purposes and legal bases

General enquiries

We use your information to respond to your enquiries.

Where an enquiry does not concern a potential booking or contract, the legal basis is our legitimate interest in handling incoming communications and maintaining contact with those who approach us. Processing will be limited to what is necessary to handle the enquiry, and you may object where applicable.

Requests for travel proposals

We use your information to understand your preferences, prepare tailored proposals and communicate with you about your requested trip.

The legal basis is taking steps at your request before entering into a contract, under Article 6(1)(b) of the General Data Protection Regulation.

Legal obligations and claims

We may process information necessary to comply with applicable legal obligations and respond to requests to exercise data protection rights.

Where information must be retained or used to establish, exercise or defend legal claims, processing will be based on our legitimate interest in protecting our rights, while respecting the rights of those concerned.

Website security

Necessary technical data may be used to detect errors, prevent unauthorised access and maintain website security.

The legal basis is our legitimate interest in protecting the website, its systems and incoming communications.

Cookies and similar technologies

Cookies requiring consent will be used on the basis of the permission you provide through the settings panel. Further information is available in the Cookie Policy.

Requesting travel information does not authorise newsletters or advertising unrelated to your enquiry. If these communications are introduced, specific information will be provided and consent obtained where required.

4. Whether you must provide your data

Fields marked as mandatory are necessary to process your request. If you do not provide this information, we may be unable to deal with it.

Optional fields may be left blank without preventing you from submitting an enquiry.

5. How long we retain your data

Enquiry data will be retained for as long as necessary to respond and carry out related follow-up.

Information used to prepare proposals will be retained while the request is being handled and negotiations remain active. If a contract is concluded, the necessary data will be processed to manage that contractual relationship, with any additional privacy information required.

Once these purposes have ended, data will be deleted or, where required, retained with processing restricted under the applicable Spanish data-blocking rules for the statutory limitation periods. Blocked data will not be used for marketing.

Technical logs will be retained for the period necessary for security and diagnostic purposes. Cookie lifetimes will be detailed in the Cookie Policy.

6. Who may access your data

Service providers necessary for the operation of the business, such as website hosting, email, technical maintenance and communications management providers, may access data within the scope of their functions and subject to the required contractual safeguards.

Data may also be disclosed to public bodies, courts and other authorities where legally required.

[COMPLETE BEFORE PUBLICATION: confirm the categories of providers actually used and whether the form transmits data to external platforms.]

If preparing or booking a trip requires disclosure to local operators, accommodation providers, carriers or other tourism suppliers, the relevant information about recipients, purposes and legal bases will be provided beforehand.

7. International transfers

[COMPLETE BEFORE PUBLICATION: check the locations and access arrangements of hosting, email, form and other service providers. State whether transfers outside the European Economic Area occur and, where applicable, identify the countries or recipients, the relevant legal mechanism and how information about safeguards can be obtained.]

The destinations advertised on the website are outside the European Economic Area. This does not mean that enquiry data is automatically transferred to those countries.

If preparing or performing a trip requires disclosure to suppliers in those destinations, information about recipients, countries and the applicable safeguards or legal derogations will be provided before the transfer.

8. Your rights

Where applicable and subject to statutory limitations, you may:

  • Access your personal data.
  • Request correction of inaccurate data.
  • Request erasure.
  • Request restriction of processing.
  • Object to processing based on legitimate interests on grounds relating to your particular situation.
  • Request data portability where processing is based on consent or a contract and carried out by automated means.
  • Withdraw consent at any time, without affecting the lawfulness of earlier processing.

You can exercise your rights by writing to [CONTACT EMAIL] or the postal address stated in this policy. Please identify the right you wish to exercise. If there are reasonable doubts about your identity, we may request proportionate additional information to verify it.

You may also lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es/, or with the competent supervisory authority.

9. Automated decision-making

[CONFIRM BEFORE PUBLICATION: we do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.]

10. Data security

Technical and organisational measures appropriate to the risk will be applied to protect personal data against unauthorised access, loss, alteration or improper disclosure.

11. Changes to this policy

This policy may be updated to reflect changes in processing activities or legislation. Where a change requires additional information or fresh consent, this will be provided or obtained before the relevant processing takes place.

Last updated: 28 October 2026.