Privacy policy

Last updated: August 26, 2026

This policy explains how 4U Madrid Walking Tour processes the personal data of those who visit this website, book a tour, or contact us. It is drafted in accordance with the Regulation (EU) 2016/679 (GDPR) already the Organic Law 3/2018 Personal Data Protection and guarantee of digital rights.

1. Who processes your data

The data controller is:

We have not appointed a data protection officer, Because our activity does not fall under the categories required by Article 37 of the GDPR. For any questions regarding your data, please write to us directly at the address above.

2. What data do we process and for what purpose?

We only process the data you give us. We do not buy listings or obtain your data from third parties.

We do not make automated decisions that affect you, nor do we create profiles with your data.

3. With whom do we share them?

We do not sell your data or share it with third parties for their own purposes. We do use services from companies that process it on our behalf, or that install their own technologies on this website:

To manage reservations

Google Ireland Limited — Your booking is saved in Google Calendar and a Google Drive spreadsheet, and reminders are sent using Gmail and Google Apps Script.

For the website to function and be measured

Google — Google Tag Manager and Google Analytics (analytics), Google Fonts (typography), and Google Maps (the map on the contact page). When these services load, they receive your IP address.
Microsoft Corporation — Microsoft Clarity, which record your browsing session (mouse movements, clicks and scrolling) to understand how the website is used. It is only activated if you accept it in the cookie notice.
Meta Platforms Ireland Limited — Facebook pixel, to measure the results of our campaigns. It is only activated if you accept it in the cookie notice.
Our web hosting provider, which stores the site and its backups.

You can view the details of each cookie, and change your decision whenever you want, in the cookie policy.

4. Transfers outside the European Union

Some of these providers may process data in USA. These transfers are based on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework., to which these companies are affiliated, and, in a complementary manner, in the standard contractual clauses approved by the Commission.

5. How long do we keep them?

Booking details: Data is retained for the duration of the relationship and, afterwards, for the periods during which liabilities may be claimed. Data with accounting or tax implications is kept for the number of years required by tax regulations.
Inquiries via email or WhatsApp: the time needed to address them and, at most, one year from the last message, unless they result in a reservation.
Analytics and advertising data: the period set by each tool, and in any case until you withdraw your consent.

When they are no longer needed, we get rid of them.

6. Your rights

You can exercise the following rights at any time, free of charge:

Access: to know what data we have about you and what we do with it.
Rectification: correct any that are inaccurate or incomplete.
Suppression: ask us to delete them when they are no longer needed.
Limitation: ask us to keep them but stop using them while a disagreement is being resolved.
Portability: receive the data you gave us in a commonly used and machine-readable format, or have us send it to another responsible party.
Opposition: to object to treatment for reasons related to your particular situation.
Withdraw your consent at any time, without affecting the lawfulness of the processing prior to withdrawal.

7. How to claim

If you believe that we have not handled your request as we should have, or that we have processed your data improperly, you can file a complaint with the supervisory authority:

Before that, we'd appreciate it if you told us: almost everything can be resolved by talking.

8. Security

We implement reasonable technical and organizational measures to protect your data: encrypted connections across the entire website, restricted access to the accounts where reservations are stored, and regular backups. No system is infallible, but if a breach occurs that poses a high risk to your rights, we will inform you and notify the Spanish Data Protection Agency as required by the GDPR.

9. Minors

This website is not intended for children under 14 years of age, and we do not knowingly collect their data. Children may participate in tours accompanied by an adult, and in that case There's no need to include them in the reservationWe do not process any of your data.

10. Changes to this policy

If we change how we process your data, we will update this page and change the date in the header. We recommend checking it from time to time.