At Excursiones Blue Tenerife, the privacy of Users and customers is a priority. This Privacy Policy describes how personal data is collected, used, stored and protected, in accordance with Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: Gustavo Marcelo Navarrete Torres, under the trade name Excursiones Blue Tenerife.
- NIF/NIE: Z2546884F
- Tourism intermediary code: I-0005335.1
- Address: C. Asturias 6, 38660 Costa Adeje, Santa Cruz de Tenerife, Spain
- Technology provider/data processor: Blue Horizon AI LLC
- Email: [email protected]
- Telephone: WhatsApp +34680873589
- Website: Excursiones Blue Tenerife
For any question related to the processing of personal data, the User may contact [email protected].
2. Personal data we process
Depending on the relationship the User has with Excursiones Blue Tenerife, we may process the following categories of data:
- Identification and contact data: full name, document number (ID card, NIE or passport), nationality, date of birth, address, telephone number and email address.
- Driving licence data: number, category, validity and country of issue.
- Booking and contract data: vehicle, dates, place of pick-up and return, extras, insurance taken out and rental history.
- Payment and billing data: data necessary to process payments, deposits or security deposits (full card details are processed directly by the payment gateway; see section 6).
- Data derived from vehicle use: incidents, damage, traffic fines, accident reports or roadside assistance, where applicable.
- Browsing data: IP address, device identifiers, cookies and analytical data, in accordance with the Cookies Policy.
- Data provided in communications: information the User includes when contacting us by WhatsApp, email, telephone call or in reviews.
At present, the website does not have data collection forms: communication and booking requests are mainly made through WhatsApp, email and telephone. When using WhatsApp, the processing of messages is also governed by the terms and privacy policy of its provider (Meta).
The User guarantees that the data provided is true, accurate and up to date, and undertakes to notify any changes. If the User provides data of third parties, the User declares that they have their consent and have informed them of the content of this Policy.
3. Purposes and legal bases for processing
- Purpose: Manage User enquiries, requests and communications — Legal basis: Data subject's consent or pre-contractual measures requested by the User (Art. 6.1.a and 6.1.b GDPR)
- Purpose: Process bookings and formalise the rental contract — Legal basis: Performance of the contract or pre-contractual measures (Art. 6.1.b GDPR)
- Purpose: Verify identity and driving licence — Legal basis: Performance of the contract and compliance with legal obligations (Art. 6.1.b and 6.1.c GDPR)
- Purpose: Manage payments, deposits, security deposits and billing — Legal basis: Performance of the contract and legal, tax and accounting obligations (Art. 6.1.b and 6.1.c GDPR)
- Purpose: Manage incidents, damage, accidents, fines and assistance — Legal basis: Performance of the contract and legitimate interest in defending rights (Art. 6.1.b and 6.1.f GDPR)
- Purpose: Handle complaints and consumer law obligations — Legal basis: Compliance with legal obligations (Art. 6.1.c GDPR)
- Purpose: Record and communicate rental data to the competent authorities (documentary register of driverless vehicle rentals, Royal Decree 933/2021) — Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR)
- Purpose: Send commercial communications regarding own services — Legal basis: Legitimate interest or consent, as applicable (Art. 6.1.f or 6.1.a GDPR)
- Purpose: Manage published reviews and opinions — Legal basis: Consent and legitimate interest (Art. 6.1.a and 6.1.f GDPR)
- Purpose: Ensure website security and prevent fraud — Legal basis: Legitimate interest (Art. 6.1.f GDPR)
Where processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
4. Retention periods
Data will be kept for the time necessary to fulfil the purpose for which it was collected and, afterwards, for the legally required periods:
- Enquiry data not converted into a contract: up to 1 year from the last contact.
- Contractual and billing data: during the contractual relationship and, once it ends, for the limitation periods of the applicable civil, commercial, tax and accounting obligations (for guidance purposes, between 4 and 6 years depending on the relevant regulations).
- Data for the exercise or defence of claims: until the legal actions are time-barred.
- Data processed on the basis of consent (e.g. marketing): until the User withdraws consent or objects.
Once those periods have elapsed, the data will be deleted or anonymised.
5. Recipients of the data
Personal data may be disclosed to:
- Providers rendering services to Excursiones Blue Tenerife (data processors), such as web hosting, management tools, payment gateways, messaging services, consultancy or customer service providers, which process the data on behalf of the controller and under a contract in accordance with Art. 28 GDPR.
- Insurance and assistance companies, where relevant in relation to vehicle insurance or claim handling.
- Public administrations, law enforcement bodies and competent authorities, where there is a legal obligation (for example, communication of the documentary rental register pursuant to Royal Decree 933/2021 or processing of traffic fines before the Dirección General de Tráfico).
- Financial institutions and payment gateways, to process charges and refunds.
- The website's own technology providers, which currently include font services (Google Fonts) and content delivery resources (CDN), which may receive the User's IP address when those resources are loaded. Communication through WhatsApp also implies the processing of messages by its provider (Meta).
No personal data is disclosed to third parties for their own commercial purposes, unless there is a legal obligation or the User's express consent.
6. Payments
Payment of the booking deposit and rental amount may be made, depending on the case, in cash, by card, bank transfer, Bizum or through an online payment gateway.
When payment is made through a payment gateway or external provider, full card or payment method data is processed directly by that provider in accordance with its own policies and the applicable security standards (e.g. PCI-DSS). Excursiones Blue Tenerife does not store full card data.
7. International data transfers
The controller is Gustavo Marcelo Navarrete Torres. Blue Horizon AI LLC acts as technology provider/data processor and is incorporated in the United States. Some technology providers may be outside the EEA, so processing may involve international transfers subject to the applicable safeguards.
Such transfers will only take place where there is a valid basis under Chapter V of the GDPR, which may include:
- An adequacy decision of the European Commission (in particular, the importer's adherence to the EU-U.S. Data Privacy Framework, approved by Implementing Decision (EU) 2023/1795, where the importer is certified under that framework).
- The Standard Contractual Clauses (SCCs) approved by the European Commission, together with any additional safeguards that may apply.
- Any other appropriate safeguard or exception provided for in Articles 46 to 49 of the GDPR.
Transfers are covered by the safeguards of Chapter V of the GDPR: the adequacy decision of the EU-U.S. Data Privacy Framework where the importer is certified under that framework and, failing that, the Standard Contractual Clauses approved by the European Commission or any other appropriate safeguard.
The User may request information on the safeguards applied by writing to [email protected].
These international transfers are carried out under the safeguards set out in Chapter V of the GDPR. Specifically, depending on the provider concerned, the transfer relies on the European Commission's adequacy decision regarding the EU-U.S. Data Privacy Framework, where the importer adheres to and is certified under that framework, and, in all other cases, on the Standard Contractual Clauses approved by the European Commission, together with any additional measures that may be necessary. Users may request information about the safeguards applied and obtain a copy of them by writing to [email protected].
8. Users' rights
The User may exercise, under the terms provided for in the legislation, the following rights:
- Access to their personal data.
- Rectification of inaccurate data.
- Erasure ("right to be forgotten").
- Objection to processing.
- Restriction of processing.
- Data portability.
- Withdrawal of consent, where processing is based on it.
- Not to be subject to automated individual decisions with significant legal effects.
To exercise these rights, the User may send a request to [email protected] or to the postal address indicated in section 1, proving identity where necessary.
The User has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) if they believe that the processing of their data does not comply with the regulations, especially if they have not obtained satisfaction in the exercise of their rights.
9. Commercial communications
Excursiones Blue Tenerife may send commercial communications about its own services where there is a legal basis to do so (consent or prior contractual relationship, under the terms of Article 21 of Law 34/2002, LSSI-CE).
The User may object to these communications at any time, free of charge, through the link provided in each communication or by writing to [email protected].
10. Automated decisions and profiling
As a general rule, Excursiones Blue Tenerife does not take automated decisions that produce legal effects or significantly affect the User.
If this type of processing is used in the future (for example, automated verification or fraud prevention systems), the User will be informed and the safeguards provided for in Article 22 of the GDPR will be respected.
11. Data security
Excursiones Blue Tenerife applies reasonable and proportionate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or destruction, taking into account the state of the art and the nature of the data processed.
However, the User acknowledges that no internet transmission or storage system is completely secure.
12. Cookies
The website may use its own and third-party cookies. Detailed information on their use, purpose and how to configure or reject them is available in the Cookies Policy: Excursiones Blue Tenerife
13. Minors
The website and services are not directed at minors. No data from minors is knowingly collected without the consent of their parents, guardians or legal representatives.
The contracting of rental services is limited to persons who meet the applicable legal and contractual requirements, including the minimum age and a valid driving licence.
14. Changes to the Privacy Policy
Excursiones Blue Tenerife may modify this Privacy Policy to adapt it to legal, technical or operational changes. Changes will be published on the website and will indicate the date of update. Users are advised to review it periodically.
15. Last update
Last update: September 7, 2026.