Privacy Policy

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we explain how we process your personal data when you use this website or book with us.

1. Who is the data controller?

• Identity: ALHAMBRA VALPARAISO OCIO Y CULTURA S.L. ("the Agency")
• Tax ID: B18609719
• Address: C/ San Antón 72, Ed. Real Center, 1º Izq. – Local 39, 18005 Granada, Spain
• Phone: +34 958 918 029
• Data protection email: info@guiapolis.com

2. Why do we process your data?

1. Booking and service management (main purpose): to process your request and payment, issue invoices and send vouchers or tickets. Bookings are made on our platform Guiapolis.
2. Nominal tickets (compulsory): for monuments with identity control, such as the Alhambra and Generalife or the Real Alcázar of Seville, we use your data to issue the nominal tickets their regulations require.
3. Customer service: to answer your questions or incidents through our contact channels (phone, WhatsApp, email).
4. Commercial communications (optional): only if you give your express consent by ticking the corresponding box.
5. Website analytics and advertising (optional): only if you accept the corresponding cookies. See our cookie policy.

3. Legal basis

• Performance of a contract (art. 6.1.b GDPR): we need your data, including ID or passport, to provide the service you buy.
• Legal obligation (art. 6.1.c GDPR): tax, tourism and security regulations require us to keep records of transactions and travellers.
• Consent (art. 6.1.a GDPR): for advertising and for analytics and marketing cookies. You can withdraw it at any time without affecting your booking.

4. Who receives your data?

• Monument managers: your identification data (name, surnames, ID/passport, nationality, age and gender) must be passed to the Patronato de la Alhambra y Generalife or the Patronato del Real Alcázar de Sevilla to issue nominal tickets and for security at the entrances.
• Tax authorities: to comply with tax obligations.
• Service providers (processors): companies that provide IT services (booking platform, hosting, management), under strict confidentiality agreements.
• Google: if you accept analytics or marketing cookies, Google Ireland Ltd. processes browsing data; Google may transfer data to the United States under the EU–US Data Privacy Framework.

We never sell your data to third parties.

5. How long do we keep your data?

• Booking data: for as long as the service is provided and then blocked for 5 years to meet legal and tax obligations, after which they are securely deleted.
• Advertising data: until you unsubscribe or withdraw your consent.
• Cookie data: see the periods in our cookie policy.

6. Your rights

You have the right to access, rectify and erase your data, to object to processing, to restrict processing and to data portability. To exercise them, email info@guiapolis.com with a copy of your ID. If you believe we have not processed your data correctly, you can complain to the Spanish Data Protection Agency (www.aepd.es).