Home/Privacy Policy

Privacy Policy

How we handle your personal data.

Last updated: March 2026

1. Who We Are

Hit Madrid Tours is an independent experience brand based in Madrid, Spain. We are the data controller for personal data collected through our website and booking process. Contact: [email protected]

2. Data We Collect

When you use our website or book an experience, we may collect the following personal data:

  • Name, email address, and phone number
  • Group size and occasion details
  • Preferred language and special requests
  • Payment information (handled securely via third-party processors)
  • Photographs or videos taken during experiences (with your consent)
  • Website usage data (via cookies — see Section 7)

3. How We Use Your Data

We use your personal data for the following purposes:

  • To process and confirm your booking
  • To design and deliver your personalized experience
  • To communicate with you before, during, and after your experience
  • To send post-event feedback surveys
  • To comply with legal obligations
  • With your explicit consent: to use photos/videos in our marketing

We do not sell your personal data to third parties.

4. Legal Basis for Processing

We process your data on the following legal bases:

  • Contract performance: to fulfil your booking
  • Legitimate interests: to improve our services and communicate effectively
  • Consent: for marketing communications and photo/video use
  • Legal obligation: where required by law

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, and in accordance with Spanish and EU law. Booking records are typically retained for 5 years for legal and accounting purposes. You may request deletion of your data at any time (see Section 6).

6. Your Rights

Under the GDPR and Spanish data protection law, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data ("right to be forgotten")
  • Object to or restrict processing
  • Request data portability
  • Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies

Our website uses essential cookies to function correctly (e.g. language preference). We do not use tracking or advertising cookies. If this changes, we will update this policy and request your consent as required.

8. Third Parties

We may share data with trusted third-party service providers (e.g. email platforms, booking tools, payment processors) only as necessary to deliver our services. These providers are contractually bound to process data only on our behalf and in compliance with GDPR.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. However, no internet transmission is 100% secure.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website. Significant changes will be communicated via email where applicable.

11. Contact & Complaints

For privacy-related enquiries, contact us at [email protected]. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.