Privacy Policy

1. Who we are

Tenerife, Curated, operating from Tenerife, Canary Islands, Spain, is the data controller for the personal data described in this policy. Given our size, we do not currently have a statutory obligation to appoint a Data Protection Officer; privacy matters are handled personally. Contact us about privacy at hello@tenerifecurated.com.

2. What data we collect

To design and deliver a personalised holiday, we typically collect:

• Contact details: name, email, phone/WhatsApp number, country of residence.
• Travel details: dates, party size and ages, budget, arrival/departure flight times (for coordinating transfers only — we do not book flights).
• Preference data: accommodation style, food and drink preferences, interests, pace, occasions, and things to avoid, as provided through our enquiry chat or in conversation.
• Special category data, where you choose to share it: dietary requirements, allergies, and health or accessibility needs relevant to planning your trip (e.g. mobility requirements, a medical condition relevant to an excursion). We only collect this where necessary to deliver the service you request, and treat it with additional care under Article 9 GDPR.
• Payment information: processed via our payment provider (to be named here once confirmed); we do not store full card details ourselves.
• Communications: messages, emails, WhatsApp and call notes relating to your enquiry, booking, or Holiday Helpline contact during your stay.
• Website/technical data: IP address, device and browser type if you use our website (see Section 9).

3. Why we use your data and our legal basis

4. Where your data is stored

Client and trip records are held in our internal booking system, with access restricted to the people running Tenerife, Curated. We keep a working local backup of this data; it is not published or made accessible to the public. We do not sell your personal data, and we do not use it for any purpose beyond delivering and supporting your trip and, where you've agreed, future marketing.

5. Who we share your data with

We share the minimum data necessary with the third-party Suppliers involved in your specific trip — for example, an accommodation provider needs your arrival time and party size; a restaurant needs your reservation details and any allergies; a driver needs your flight details and contact number. We also use trusted service providers to run our business (e.g. payment processing, email/communication tools, accounting). We do not sell your personal data.

Where a service provider is located outside the European Economic Area, we will ensure an appropriate safeguard is in place (such as the European Commission's Standard Contractual Clauses) before transferring your data.

6. How long we keep your data

• Enquiry and preference data: retained for 2 years from your last contact with us, so we can help plan a future trip, unless you ask us to delete it sooner.
• Booking and payment records: retained for 5–6 years to meet Spanish tax and accounting obligations.
• Special category data (dietary/health/accessibility): retained only for the duration needed to deliver the specific trip it relates to, then deleted unless you separately consent to us keeping it for future trips.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data, subject to our legal retention obligations.
• Restrict or object to certain processing, including marketing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent, without affecting processing already carried out.

To exercise any of these rights, contact us at hello@tenerifecurated.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or your local supervisory authority.

8. Security

We apply appropriate technical and organisational measures to protect your data, including restricted access to client records, secure payment processing via our provider, and confidentiality obligations for anyone handling client data on our behalf. No online system is completely secure, and we encourage you to contact us immediately if you suspect any unauthorised access to your data.

9. Cookies and website data

Our website does not use analytics, advertising, or any tracking cookies — it runs entirely client-side and does not track visitors across sessions. The only thing stored on your device is a small technical flag (via your browser's local storage, not a tracking cookie) that remembers you've dismissed the cookie notice, so it doesn't reappear on your next visit. If this changes (for example, if we add visitor analytics), we will update this cookie notice and this policy first. Data you type into the trip-brief chat is only sent to us when you choose to send it (by email or copy); it is not transmitted or stored automatically as you type.

10. Children

We do not knowingly collect personal data directly from children. Where a booking includes children travelling with you, you provide their details (e.g. age, dietary needs) as their parent or guardian, for the sole purpose of planning age-appropriate parts of the trip.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available on our website, dated at the top.

12. Contact