The short version. This website sets no tracking cookies on its own. Nothing belonging to a third party loads until you actively allow it. If you never touch the cookie banner and never open the booking calendar, the only data that leaves your browser is the ordinary server log our host keeps.
1. Who is responsible for your data
The data controller for this website is:
Hugo de los Santos Gutiérrez (Valhalla Adventures)
Cruz Verde 22, 02200 Casas-Ibáñez, Albacete, Spain
NIF: ES53602858R
Email: info@valhallaadventures.com
Telephone: +34 655 303 524
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Questions about data protection go to the email address above.
2. The principle we work to
We only process personal data where we need it to answer you, to organise an experience you have asked for, to keep the website running, or where you have given us permission. We do not sell personal data, and we do not share it with anyone other than the providers listed in this policy.
3. Visiting the website: server logs
Our host records technical information automatically each time a page is served: the IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is what makes it possible to deliver the site and to identify attacks or faults.
Legal basis: our legitimate interest in operating a secure,
functioning website (Article 6(1)(f) GDPR).
Retention: these logs are kept by our host for a short period and
are not combined with any other data or used to identify you.
4. Hosting — Cloudflare
The site is hosted on Cloudflare Pages (Cloudflare, Inc., USA, and Cloudflare's European entities), which also provides the network and security layer in front of it. Cloudflare processes the connection data described above on our behalf as a processor under Article 28 GDPR.
Legal basis: legitimate interest in secure and reliable hosting (Article 6(1)(f) GDPR).
5. Contacting us
If you write to us by email, WhatsApp or Instagram, or book a call, we process the details you send us — typically your name, contact details, group size, preferred dates and whatever else you tell us — in order to answer and to plan the experience.
Legal basis: steps taken at your request before entering into a
contract, and performance of that contract (Article 6(1)(b) GDPR); otherwise our
legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).
Retention: enquiries that do not lead to a booking are deleted
once the conversation is clearly finished. Where a booking goes ahead, Spanish
commercial and tax law requires us to keep the relevant records — generally for
four to six years.
Please note that WhatsApp (WhatsApp Ireland Ltd.) and Instagram (Meta Platforms Ireland Ltd.) are run by Meta. If you choose to contact us through them, Meta processes that conversation under its own privacy terms, which we do not control. Email or telephone are always available as alternatives.
6. Booking calls — Calendly
We use Calendly (Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA) to schedule the free planning call.
The Calendly widget is not loaded when the page opens. It appears only after you click "Load calendar & pick a time", or switch the booking calendar option on in the cookie banner. Until you do, no request is made to Calendly and no Calendly cookie is set. Once loaded, Calendly receives your IP address and sets cookies of its own; if you then book, it also receives the name, email address and appointment details you enter.
Legal basis: your consent for loading the embed (Article 6(1)(a)
GDPR), and performance of pre-contractual steps for the booking itself
(Article 6(1)(b) GDPR).
More information:
calendly.com/privacy.
7. Cookies and local storage
We store one item in your browser's local storage, va_consent_v1, which
records the choices you made in the cookie banner. It contains no identifier and is
never sent to a server — without it we would have to ask you the same question on
every page.
All other cookies come from the third-party services below, and only once you have allowed them. The full breakdown is in our Cookie Policy.
8. Meta Pixel (Facebook and Instagram advertising)
We advertise on Facebook and Instagram. To measure whether those ads actually bring people to this site, the page is prepared to load the Meta Pixel, provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
The pixel allows us to see that a visit followed an ad click, and to reach similar audiences later. It loads only if you switch marketing on in the cookie banner. Marketing is off by default, and if you leave it off the pixel never loads at all. Data collected this way may be transferred to Meta servers in the United States.
Legal basis: your consent (Article 6(1)(a) GDPR), which you can
withdraw at any time via "Cookie settings" in the footer.
More information:
facebook.com/privacy/policy.
9. Google Ads and conversion tracking
On the same basis, the page is prepared to load Google Ads conversion tracking from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, so that we can tell which advertisements lead to an enquiry. It also loads only with your marketing consent, and data may be transferred to Google servers in the United States.
Legal basis: your consent (Article 6(1)(a) GDPR).
More information:
policies.google.com/privacy.
10. Fonts and other assets
The typefaces used on this site are served from our own domain. No request is made to Google Fonts or any other font provider, so your IP address is not disclosed to one.
11. Transfers outside the EU
Calendly, Cloudflare, Meta and Google may process data in the United States. Those transfers are based on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework. You can request a copy of the safeguards that apply by writing to us.
12. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Article 15)
- have inaccurate data corrected (Article 16)
- have your data erased (Article 17)
- restrict how we process it (Article 18)
- receive it in a portable format (Article 20)
- object to processing based on legitimate interest (Article 21)
- withdraw any consent you have given, with effect for the future (Article 7(3))
An informal message to info@valhallaadventures.com is enough. We answer within one month.
13. Complaints
If you believe we have handled your data incorrectly, you can complain to the Spanish supervisory authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6, 28001 Madrid, Spain
www.aepd.es
You may also complain to the supervisory authority where you live or work.
14. Changes to this policy
We update this policy when the services behind the website change. The date at the top always shows the current version.