Privacy Policy

1 · Data controller

The controller of your personal data is Altura Expeditions, S.L., Calle Gutiérrez Herrero 52, 33402 Avilés (Asturias), Spain, tax ID B22687750. For any privacy question, or to exercise your rights, contact us at info@alturaexpeditions.com.

2 · The data we collect

• Identity and contact — name, email, phone/WhatsApp number, country.
• Booking details — party size, dates, chosen or custom trip, fitness level, dietary requirements, accommodation preferences and emergency-contact details.
• Payment data — handled by Stripe. We receive confirmation and limited details (such as the last four digits and card brand); we do not store your full card number.
• Communications — the messages, emails and WhatsApp chats you exchange with us.
• Technical and usage data — IP address, device and browser type, and how you use the site, collected through cookies and similar technologies.
• Marketing preferences — whether you’ve opted in to our newsletter.

3 · How and why we use it (legal bases)

• To plan and deliver your trip and process payment — performance of our contract with you.
• To respond to enquiries, support you on the trail and run our business safely — our legitimate interests.
• To send marketing emails and set non-essential cookies — your consent, which you can withdraw at any time.
• To meet tax, accounting and other legal duties — compliance with a legal obligation.

4 · Who we share it with

We never sell your data. We share it only with service providers who help us run the business, under contract and only as needed:

• Stripe — payment processing.
• Supabase — secure database and hosting for routes and bookings.
• HubSpot — scheduling planning calls and managing enquiries.
• MailerLite — sending our newsletter, if you’ve subscribed.
• WhatsApp (Meta) — the messaging channel for enquiries and on-trip support.
• Accommodation, transfer and luggage providers and local partners — only the details needed to fulfil your trip.
• Meta (Facebook/Instagram) and TikTok — where you interact with our social pages or advertising, these platforms may process limited data for audience and advertising measurement.
• Professional advisers and authorities — where required by law.

5 · International transfers

Some providers (including Stripe, HubSpot, MailerLite, Meta and TikTok) may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision or by Standard Contractual Clauses approved by the European Commission.

6 · How long we keep it

We keep booking and financial records for as long as needed to deliver your trip and to meet legal retention periods (tax and accounting records are generally kept for up to six years). Enquiry data that doesn’t become a booking is deleted within a reasonable period, and marketing data is kept until you unsubscribe.

7 · Your rights

Under the GDPR you may ask us to give you access to, correct, delete, restrict or port your data, and you may object to certain processing or withdraw consent at any time. To exercise any of these, email info@alturaexpeditions.com. You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

8 · Cookies

We use cookies that are strictly necessary for the site and booking flow to work, plus — with your consent — analytics and marketing cookies. Embedded tools such as the Stripe checkout and the HubSpot scheduler set their own cookies when you use them. Full detail is in our Cookie Policy. You can manage or block cookies through your browser settings; blocking essential cookies may break parts of the site.

9 · Children

Our services are not directed at children. Under-18s may only travel as part of a party booked and supervised by a responsible adult, who provides their details on their behalf.

10 · Changes to this policy

We may update this policy from time to time. The “last updated” date above always shows the current version; significant changes will be highlighted on this page.