Privacy Policy

1. Data controller

The data controller is Gonviagui SL (CIF B72557473), with registered office at Pontinental 12, 29620 Torremolinos (Málaga), Spain, holder of travel agency licence C.I.AN-297730-3.

You may contact us regarding any matter relating to the protection of your data by writing to comercial@petruoperador.com or by calling or WhatsApp on +34 952 25 02 09.

2. Data we process

This site is aimed at travel agencies and tourism sector professionals. We only request the information necessary to respond to your enquiry:

• Identifying and contact details: first name and surname, email address and, optionally, telephone number or WhatsApp.
• Professional details: name of the travel agency or company you work for.
• Enquiry details: programme or desired profile, number of travellers, planned month and year of travel, date and time for the meeting, and any message or comments you write to us.
• Proof of consent: date and time you accept this policy, in order to demonstrate it.
• Technical connection data: IP address and browser, used solely to prevent automated submissions and form abuse.

3. Purposes of processing

• Handling enquiries, proposal requests and meeting requests sent to us via forms, email, phone or WhatsApp.
• To prepare and send tailor-made programme proposals and manage the commercial relationship with your agency.
• Organise business meetings scheduled via the website.
• Sending you commercial communications about our programmes and updates, only if you have given us your consent to do so.
• To prevent fraud and automated submissions, and to keep the site available and secure.

4. Legal basis for processing

• Consent of the data subject (Article 6(1)(a) of the GDPR): by checking the box to accept this policy before submitting any form.
• Performance of pre-contractual and contractual measures at the request of the data subject (Article 6(1)(b) GDPR): preparing proposals, managing the relationship with the travel agency, and arranging meetings.
• Legitimate interest of the controller (Article 6(1)(f) of the GDPR): preventing abuse and automated use of forms and maintaining the security of the website.
• Compliance with legal obligations (Article 6(1)(c) of the GDPR): tax, accounting and consumer protection obligations arising from the commercial relationship.

5. Data retention

Data is retained for the time necessary for the purpose for which it was collected:

• Enquiries and proposal requests that do not result in a booking: up to 2 years from the last communication, the standard guideline of the Spanish Data Protection Agency for business contact data.
• Travel agencies and clients with a commercial relationship: for the duration of the relationship and, subsequently, for the applicable statutory limitation periods for tax and commercial matters (6 years, pursuant to Article 30 of the Spanish Commercial Code and tax legislation).
• Commercial communications: until you withdraw consent.
• Proof of consent: for as long as necessary to demonstrate it before the supervisory authority.
• Technical connection data: for the period strictly necessary to detect and block abusive submissions.

6. Recipients and data processors

We do not transfer your data to third parties unless required by law (public authorities, courts and tribunals) or where strictly necessary to provide the service you have requested.

We rely on suppliers who process data on our behalf as data processors (hosting platform and database, email and meeting scheduling services, instant messaging, and local partners at destination), bound by contract in accordance with Article 28 of the GDPR and with appropriate safeguards. We do not sell or rent personal data to third parties for commercial purposes.

7. International transfers

Some suppliers and partners operate outside the European Economic Area. In such cases, the transfer is based on an adequacy decision by the European Commission or, failing that, on appropriate safeguards, such as the European Commission's standard contractual clauses (Article 46 of the GDPR), together with any necessary supplementary measures.

8. Rights of data subjects

You may exercise at any time, free of charge, the rights of access, rectification, erasure, objection, restriction of processing and data portability (Articles 15 to 22 of the GDPR), as well as withdraw any consent granted without affecting the lawfulness of processing carried out prior to its withdrawal.

To exercise your rights, please email us at comercial@petruoperador.com specifying the right you wish to exercise and enclosing a copy of your identity document or other valid proof of identity; you may also contact us by phone and WhatsApp on +34 952 25 02 09. We will reply within one month of receiving your request.

You may object to receiving marketing communications at any time by following the instructions included in each message or by writing to us at the above address.

9. Right to lodge a complaint with the supervisory authority

If you consider that we have not dealt with your request appropriately, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (Paseo de la Castellana 11, 28046 Madrid, www.aepd.es), the supervisory authority for data protection (Article 77 of the GDPR and Article 22 of the LOPDGDD).

10. Security measures

We implement the technical and organisational measures required under Article 32 of the GDPR, appropriate to the level of risk: HTTPS encryption for communications, access controls to information, data minimisation, and regular backups. Access to enquiries received is restricted to authorised members of our team.

11. Accuracy and truthfulness of data

The user guarantees that the details provided are accurate and undertakes to notify any changes. Data submitted via forms must belong to the user; if third-party data is provided, you must have previously informed them in accordance with this policy.

The forms are not intended for minors: we do not deliberately process data of persons under 14 years of age (Article 7 of the LOPDGDD). If such a submission occurs, the data will be deleted without delay.

12. Automated decision-making and profiling

We do not make decisions based solely on automated processing of personal data, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 of the GDPR).

13. Cookies

This site uses technical cookies necessary for its operation and, where applicable, analytical or third-party cookies. You can view what they are, their purpose and how to refuse them in our Cookie Policy, pursuant to Article 22.2 of the LSSI-CE.

14. Updates to this policy

This policy may be revised to adapt to legislative or case law developments or changes in our business activity. The current version is always the one published on this page. Version in effect since October 2026.

15. Contact

For any queries regarding the processing of your personal data, please email comercial@petruoperador.com or call/WhatsApp +34 952 25 02 09.