Privacy policy

01

Who is responsible for your data

Inside Experiences is the trading name of [LEGAL NAME], tax number [VAT NUMBER], registered office [REGISTERED ADDRESS]. The business operates in Madrid, Spain. These three details are confirmed and filled in before the site is published.

For anything to do with your personal data, write to concierge@insideexperiences.com. We do not publish a telephone number, so email is the only channel and it is the one we read.

02

What we collect

Only what a proposal needs. We do not buy lists and we do not add you to anything you did not ask for.

• Enquiry form: your name, your email address, your country of residence, the dates you are in Madrid, the number of guests, the occasion, an indicative budget if you choose to give one, and your message.
• Correspondence: whatever you send us by email afterwards while we design and confirm your days.
• Commission file: the practical details of a confirmed booking, such as meeting points, timings, dietary requirements and access requirements.
• Technical data: the standard records kept by our hosting provider so that the site stays available, and, only if you accept them, the measurement tools described in our cookie policy.

Please do not send us documents or details we have not asked for. If you tell us about a health condition, a mobility need or a dietary restriction, we treat that as given with your explicit consent, we keep it to the commission it belongs to, and we pass on only the part a supplier needs in order to do their job.

03

Why we use it, and on what legal basis

• To answer your enquiry and prepare a written proposal. Legal basis: steps taken at your request before entering a contract, Article 6(1)(b) GDPR.
• To design, book and run a confirmed commission. Legal basis: performance of our contract with you.
• To invoice and keep accounts. Legal basis: our legal obligations under Spanish tax and commercial law.
• To keep the site secure and to deal with a complaint or a claim. Legal basis: our legitimate interest in running and defending the business, weighed against your rights.
• To measure how the site is used, and any advertising measurement. Legal basis: your consent, given through the cookie notice and withdrawable at any time.
• Health, mobility or dietary information, where you choose to give it. Legal basis: your explicit consent, Article 9(2)(a) GDPR.

We do not make automated decisions about you and we do not build profiles.

04

How long we keep it

• Enquiries that do not become a commission: [RETENTION PERIOD].
• Files and correspondence for commissions we have run: [RETENTION PERIOD], so that we can answer a claim and so that a returning guest does not have to explain everything twice.
• Invoices and accounting records: for as long as Spanish tax and commercial law require.
• Your cookie choice: 365 days from the moment you make it, or until you change it.

When a period ends we delete the file, or reduce it to the minimum the accounts need.

05

Who else sees it

Two kinds of recipient: the suppliers who deliver part of your day, and the companies that run our email, our website and our measurement.

• Suppliers: guides, drivers, photographers, florists, restaurants and venues. They receive the minimum, which is usually a first name, the size of the party, a time and a meeting point, plus any access or dietary requirement that affects their work.
• Service providers acting on our instructions under a data processing agreement, covering website hosting, email, delivery of the enquiry form and, subject to your consent, analytics: [PROCESSORS TO BE CONFIRMED].
• Public authorities, courts and our own advisers, where the law requires it or a claim makes it necessary.

We do not sell your data and we do not pass it to anyone for their own marketing. We do not publish a client name, a photograph or an occasion without written permission.

06

Transfers outside the European Economic Area

We prefer providers inside the European Economic Area. Where a provider processes data outside it, we rely on a European Commission adequacy decision or on standard contractual clauses, together with the technical measures that go with them.

The final list of providers, and of any transfer, is part of the review that is still pending: [INTERNATIONAL TRANSFERS TO BE CONFIRMED]. You can ask us for the current list at any time.

07

Your rights

You have the right to ask us for the following, free of charge:

• A copy of the personal data we hold about you, and an explanation of what we do with it.
• Correction of anything that is wrong or out of date.
• Deletion, where we no longer need the data and no legal obligation makes us keep it.
• Restriction of what we do with it while a disagreement is being settled.
• Objection to processing we base on our legitimate interest.
• A portable copy, in a common format, of the data you gave us yourself.
• Withdrawal of a consent you gave, including your cookie choice.

Write to concierge@insideexperiences.com, ideally from the address you contacted us with, or give us enough detail to recognise your file. We answer within one month. Withdrawing consent does not undo what was lawful while the consent was in force.

08

If you are not satisfied

Tell us first: most of it is a misunderstanding we can settle in a day.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, at www.aepd.es. If you live in another country of the European Union you may complain to your own supervisory authority instead.

09

How we look after it

Correspondence and commission files are kept to the people working on your commission, and suppliers receive only the extract they need to do their part.

No payment is taken through this website. There is no checkout here and we do not hold card details. The full set of technical and organisational measures is part of the pending review: [SECURITY MEASURES TO BE CONFIRMED].

10

Children

Our services are arranged by adults. We ask for a child's details only where a booking needs them, for example an age for a car seat or a museum ticket, and we expect the adult making the enquiry to have the authority to give them.

11

Changes to this policy

If this policy changes we publish the new version on this page and update the date at the top. Where a change affects a commission already confirmed, we tell you by email rather than leaving you to find it.