Privacy policy

Privacy policy · version 1.3 · in force from 28 October 2026

This policy is published in Spanish, Catalan, English and Portuguese. All versions say the same thing and have the same value; if they differ, the interpretation most favourable to you applies. The Spanish version is the one we maintain and from which the others are translated, with its version number and date.

This policy explains what personal data we process, what for, who else receives it, how long we keep it and how you can exercise your rights, including the right to ask us to delete it. It applies to everything you do with us: the website and our assistant, messaging (WhatsApp, Instagram and Messenger), email, telephone, video calls, booking and the trip.

1. Who processes your data

Viatges Experiencia 2010, SL (“Travel Xperience”), tax registration number (NRT) L-711815-P, registered in the Registre de Comerç i Indústria (Register of Commerce and Industry) of the Principality of Andorra (Principat d'Andorra) under number 927262T.

• Registered office: Carrer dels Pradassos 3, 1r pis, porta 2, AD300 Llorts, Principat d'Andorra.
• Office: Avinguda Tarragona 51, AD500 Andorra la Vella, Principat d'Andorra.
• Telephone: +34 911 875 940.
• Email for anything to do with your data: info@travel-xperience.com.

We are a travel agency established in Andorra. We process personal data in accordance with the Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Andorra's personal data protection act) and its implementing Regulation. When we offer our trips to people who are in the European Union, we also apply Regulation (EU) 2016/679 (GDPR). When we offer them to people who are in Brazil, we also apply the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's general data protection act).

2. What data we process and where it comes from

• Identification and contact details: first name and surname, telephone, email address, country and city of residence, language.
• For booking and travelling: identity document or passport and its expiry date, date of birth, nationality, address, billing details and, if we have to refund you money, the account in which you want to receive it. The details of the people travelling with you and their relationship to you, including minors.
• Health and accessibility: see section 3.
• What you tell us: the content of the messages, emails, calls, video calls and conversations with our website assistant, by text or by voice, and the files you send us.
• Your trip: proposals, bookings, tickets, vouchers, insurance, payments, incidents and complaints.
• Images: photos and videos of the trip (section 10).
• Browsing: cookies, only if you accept them (section 17), and, if you arrive from an advert or a link, the campaign tags carried in the page address (section 7 bis).
• If you are a supplier: the business contact details of your company and of the people we deal with, and payment details.

The data is given to us by you, by the person who contracts or books on your behalf (a relative, your travel agency) or by the service providers for your trip (for example, the airline that notifies us of a schedule change). We do not look for data about you on social media or in other sources.

3. Health and disability data

We are a travel agency specialising in accessible travel. To organise your trip we need to know, for example, how you get around, what assistive equipment you use (wheelchair, mobility scooter, hoist, batteries), what assistance you need, your degree of disability or, for a hoist or an adapted vehicle, your weight and height. This is health data, a special category of data, and we treat it as follows:

• Only with your explicit consent. We ask you for it in writing, through the same channel in which you tell us about it, the first time this data comes up in the conversation (for example, with a message to which you reply “Yes”), and again in the travel contract. We keep your reply together with its date.
• What that consent authorises: storing the data in your record, using it to prepare and accompany you on your trip and passing it on to those who have to provide you with assistance (airlines, airports, hotels, carriers, ground handlers, guides and insurers), also outside Andorra and the European Union when your trip takes you there, including assistance in an emergency during the trip.
• Only what is necessary: what you need, not your diagnosis. If you send us a medical report that is not needed for the trip, we do not keep it.
• You can choose not to give it, or withdraw it whenever you wish, as easily as you gave it: in the same conversation or by writing to us, and at no cost. What was done before remains valid; from that moment on we stop using that data and will not be able to arrange any assistance that depends on it.
• If you write to us about another person (a relative, someone you are accompanying, a client of your agency), we also need that person's consent, and we will ask them for it. For children under 16, and for anyone who has a legal representative, that representative gives the consent.

4. What we use your data for and on what basis

Our legitimate interest is to attend to those who write to us, to run our business properly and to defend ourselves if there is a claim; it does not override your rights, and you can object (section 14). Some data is essential for booking: for example, without the exact name that appears on your passport we cannot issue a flight ticket.

5. Messaging: WhatsApp, Instagram and Messenger

This section explains what we do with what you write to us on WhatsApp, on Instagram (@t_xperience) and on Messenger (the “Travel Xperience Turismo Accesible” page), and how to ask us to delete it.

• Who: Viatges Experiencia 2010, SL (Travel Xperience), with the details given in section 1. Contact: info@travel-xperience.com.
• What data: your telephone number and your WhatsApp profile name; the identifier, name and username that Instagram and Messenger provide to us; the content of the messages, voice notes, photos and documents you send us; the date and time of each message; and the name of the team member who replies to you.
• What for: to answer your enquiry, prepare your proposal, manage and accompany you on your trip and keep the conversation in your customer or supplier record, so that anyone on the team can pick it up. We do not use these messages for advertising, we do not sell or pass them on, and we do not send automated or bulk messages: it is always a member of the team who writes to you.
• On what basis: the pre-contractual steps you ask us to take and your travel contract; if you do not go on to book, or you are a supplier, our legitimate interest in attending to those who write to us. Any health data you tell us, only with your explicit consent, which we will ask you for in the same conversation (section 3).
• Where it is kept and who sees it: WhatsApp messages arrive at our own messaging server, hosted by OVHcloud in France. Messages from all three channels are stored, together with their files, in our database (Supabase, servers in the European Union, Ireland). Only the Travel Xperience team sees them, each person with their own user account.
• The platforms: WhatsApp, Instagram and Messenger are Meta services. On WhatsApp, WhatsApp Ireland Limited provides the WhatsApp Business service to our account and processes on our behalf the contact details (such as your number) that we use to communicate with you. On Instagram and Messenger, Meta processes your data as the controller of its platform. In all three cases, the data of your own account is processed by Meta under its terms and its privacy policy, which you accepted when you used the app; that is not something we decide.
• How long: 30 days if we cannot link the message to any person; 2 years from the last message if you do not go on to book; and, if you book, the retention period of your trip file (section 13).

How to ask us to delete your messages and your data:

1. Write to us at info@travel-xperience.com with the subject line “Deletion of messaging data”, or ask us in the same WhatsApp, Instagram or Messenger conversation.
2. Tell us the channel and your telephone number or username.
3. If you ask us from a different address or account, we may ask you to confirm it from the original conversation, to make sure it is you.
4. Within one month at most, we remove your messages, files and data from our working tools, delete the conversation from our WhatsApp, Instagram and Messenger accounts and confirm this to you in writing. Only if the request were particularly complex might we need two more months, and we would tell you so within the first month.

Andorran law requires us to block what has been deleted: it is set aside, so that no one on the team can see or use it, solely to make it available to judges and authorities for the period during which we could be held liable for having processed it; once that period has passed, it is destroyed. If you have a trip booked, we keep the contract, the invoices and the documentation that the law requires us to keep, and whatever is needed for an open claim, and we tell you what that is. Our encrypted backups renew themselves: deleted data disappears from them within 12 weeks. The copy of the conversation in your own app, and whatever Meta keeps, are not under our control: you can delete them from the app.

6. Calls, video calls and email

• Calls. Calls with customers and suppliers on our telephone line are recorded and transcribed automatically (the transcription is done by OpenAI on our behalf), so that nothing you ask us for is lost; we tell you this at the start of the call. The transcription and its summary are kept in your record; the recording and the transcription on the switchboard (3CX) are deleted there after 15 days. If you do not want the call to be recorded, tell us: the adviser will take notes and we will delete the recording.
• Video calls. If we have an appointment by video call (Google Meet), the notes are generated by Google's tool (Gemini) and kept in your record. We will tell you so at the start.
• Email. The emails you send us and those we send you are kept in your record. Our email runs on Google Workspace.

The legal basis is the same as for messaging (section 5); any health data you tell us, only with your explicit consent.

7. Our website assistant and appointments

At conversa.turismoaccesible.travel you are assisted by an artificial intelligence assistant that guides you and, if it is a good fit, offers you an appointment with an adviser. It processes your name, telephone, email and place of residence, what you tell it about the trip you have in mind and, if you arrive from an advert or a link and accept this in the cookie notice, the campaign data. If you speak to it by voice, the audio is transcribed by Mistral AI and we do not keep it: we keep only the text. What you tell it is passed to the adviser who will look after you. Appointments are booked through Koalendar. Basis: the pre-contractual steps you ask us to take.

7 bis. Group trips: “Sign me up” and “Let me know”

In our group trip catalogue you can sign up for a departure (“Sign me up”) or ask us to let you know if a place becomes available (“Let me know”). For this we process your name, telephone, city, email and how many people would be travelling. With “Sign me up”, an adviser will call you to tell you about the trip. With “Let me know”, we keep your details to let you know if a place comes up. Basis: the pre-contractual steps you ask us to take.

Your needs. If you tell us what you need in order to travel (for example, your mobility equipment or the assistance you use), this is health data and we treat it as explained in section 3. We only keep it if you authorise this in the box that appears when you type it. Until you book, only the team preparing the trip sees it. If you book, it is passed on to those who have to provide you with assistance. You can withdraw that authorisation whenever you wish, by writing to us or by telling your adviser.

To curb abusive submissions, we keep an encrypted fingerprint of the address from which the form is sent, not the address itself. Basis: our legitimate interest in protecting the form.

News. If you tick the news box, we will email you information about our upcoming group trips (section 9). We keep the date on which you ticked it. You can unsubscribe at any time and free of charge, using the link in each email or by writing to us.

Which advert you came from. If you reach the catalogue from an advert, the page address carries some campaign tags (for example, the campaign name or the number that Google or Meta assign to each click). When you sign up or ask us to let you know, we keep them with your registration so that we know which campaigns bring us the people who travel with us. We do not use them for anything else, nor do we give them to anyone, including Google or Meta. Basis: our legitimate interest in measuring our advertising. You can object by writing to us (section 14).

Cookies. In the catalogue we use measurement and advertising cookies from Google, Meta and Microsoft (Clarity) only if you accept them in the cookie notice. Until you make a choice, Meta's and Clarity's cookies are not loaded, and Google only receives cookieless signals. If you accept only the measurement cookies, Google's advertising may still receive those cookieless signals. If you accept the measurement cookies, we also store in your browser, for 90 days, which advert you came from, so that it is not lost if you sign up another day. If you accepted and you sign up or ask to be notified, we tell those companies that someone has signed up for one of our trips, and which one. Meta and Google may also receive, in encrypted form, the contact details you enter in the form (name, email, telephone and city), to recognise that you came through one of their adverts; never your needs. What you type in the form is not recorded. You can change your choice whenever you wish in “Cookie settings”, at the foot of each page.

8. Artificial intelligence

We use artificial intelligence tools to help the team, not to replace it:

• the website assistant (section 7);
• in our internal tool: reading a document you send us (for example, your passport or your insurance certificate) to copy the details without errors; summarising calls and meetings; sorting emails; drafting replies; and preparing proposals that take your accessibility needs into account;
• aggregated analyses of conversations, which do not identify anyone, to find out which destinations, needs or questions come up repeatedly, to improve our trips and to answer the most frequent questions on our website.

We do not make automated decisions about you: a member of the team always reviews and decides. The artificial intelligence providers (Anthropic, with its Claude model; OpenAI, for transcribing calls; Mistral AI, for the assistant's voice; Google, for video call notes) work on our behalf (section 11).

9. Information about our trips

We only send you information about our trips by email or message if you have agreed to it or, if you have already been a customer, about trips of ours similar to the ones you booked, and provided you did not object when we offered you the option of not receiving it. You can unsubscribe at any time and free of charge, using the link included in each email or by writing to us.

10. Images of the trip

During the trip, the team, the tour leader or the guides may take photos and videos in which travellers appear and use them on our website, on our social media and in our marketing material. By signing the contract you are informed of this and authorise it. If you do not want to appear, write to us at info@travel-xperience.com at any time: we will stop using your image, remove it from our publications within a reasonable time and take no more for that purpose. Images of minors and of anyone who cannot give consent for themselves are only used with the written authorisation of their parents or representatives. If you share photos in your trip album, we keep your acceptance of its terms together with its date.

11. Who receives your data

• Those who provide your trip: airlines, airports, hotels, carriers, ground handlers, guides, wholesalers and booking platforms, in the country of destination or transit, with the data needed to book and provide each service.
• Insurance: Aon, the broker through which we arrange your travel insurance, and the insurer of your policy, when you take out insurance or report a claim.
• The travel agency that books on your behalf, if that applies to you.
• Claims against airlines: if an airline owes you compensation and you agree to let our partner Wings to Claim claim it, we pass the details of the case to them.
• Banks, to take payments from you and refund you.
• Public administrations and authorities, when the law requires it.
• Suppliers who work on our behalf (processors), under a contract that requires them to use the data only for what we engage them to do and in accordance with our instructions:

We do not sell your data or pass it on to anyone for their advertising.

12. Transfers outside Andorra and the European Union

Our database and our servers are in the European Union, which Andorran law recognises as providing an adequate level of protection. Data leaves it in the following cases:

• Your trip: the service providers in the country of destination or transit receive what they need to provide you with the service, because it is necessary for the performance of your contract; health data, in addition, because you have expressly consented to it. Some of those countries do not have a level of protection recognised as adequate.
• Technology suppliers in the United States: Google, Vercel, GitHub, Meta (including WhatsApp), Microsoft and Amazon Web Services are certified under the EU-US Data Privacy Framework, which the European Commission recognises as adequate; with Anthropic, OpenAI and Supabase, the transfer is covered by the standard contractual clauses approved by the European Commission, included in our contract with them. You can ask us for a copy of those safeguards at info@travel-xperience.com.
• If you are in Brazil: your data leaves Brazil for Andorra and the European Union because it is necessary to deal with your enquiry and to perform your contract; health data, in addition, because you have expressly consented to it in the knowledge that it travels outside Brazil.

13. How long we keep your data

Once the period has passed, the data is deleted. If there is an open claim, we keep what is necessary until it is resolved.

14. Your rights and how to exercise them

You can ask us for access to your data, its rectification, its erasure, the restriction of its processing and its portability, and you can withdraw any consent you have given us, without this affecting what was done before.

Right to object. You can object at any time to our using your data to send you information about our trips, and we will stop doing so. You can also object, on grounds relating to your particular situation, to our processing data about you that you did not give us yourself (for example, data given to us by the person who booked on your behalf) and, if you are in the European Union, to any processing based on our legitimate interest.

How. Write to us at info@travel-xperience.com or by post to our registered office (section 1), stating which right you are exercising. We will only ask you for a document proving your identity if we have reasonable doubts about it. If you are acting on behalf of another person, provide proof of your authority to represent them. It is free of charge. We reply within one month at most from the day after we receive your request, and by the same means if you write to us electronically; if the request were particularly complex, we might need two more months, and we would tell you so within the first month, giving the reason. We also reply if we cannot act on your request, explaining why.

What happens to what we erase or rectify. Andorran law requires us to block it: it is set aside, so that no one on the team can see or use it, available only to judges, the public prosecutor's office and authorities for the limitation period of any liabilities arising from its processing; afterwards it is destroyed. Nor do we delete what the law requires us to keep, such as the contract and the invoices for a trip, or what is needed for an open claim; we will tell you what that is.

If you are in Brazil. In addition to the rights above, you can ask us to confirm whether we process data about you, to anonymise any that is not necessary and to tell you with whom we have shared it; and you can choose not to give us a consent, with the consequences we explain to you when we ask for it. We give you the confirmation and the access within 15 days. Our data protection officer (encarregado) is Rodrigo Moreno, info@travel-xperience.com. If you are not satisfied, you can lodge a complaint with the Agência Nacional de Proteção de Dados (ANPD) and with Brazil's consumer protection bodies.

If you are not satisfied, you can lodge a complaint with the Agència Andorrana de Protecció de Dades (APDA, www.apda.ad, tel. +376 808 115, C. Doctor Vilanova 15-17, planta -5, Andorra la Vella) and, if you live in the European Union, with the data protection authority of your country (in Spain, the Agencia Española de Protección de Datos, www.aepd.es).

15. Children under 16

We only process the data of a child under 16 with the consent or authorisation of their legal representative, who is the person who books the trip and who exercises the child's rights. If a child under 16 writes to us on their own, we will ask that their legal representative do so.

16. Security

Each member of the team logs in with their own user account and only accesses what they need; communications are encrypted; identity documents are stored with restricted access; backups are encrypted; and we log who reads and modifies the data.

17. Cookies

On our websites we use technical cookies, which are necessary for them to work, and, only if you accept them, analytics cookies (Google Analytics and Microsoft Clarity) and advertising cookies (Google and Meta), which those companies process as controllers, and one of our own that remembers which advert you came from. You can change your choice at any time in “Cookie settings”, at the foot of each page, where you will also find the list of cookies and how long each one lasts.

18. Changes to this policy

If we change anything important, we will publish a new version and date here and, if you have a trip booked, we will let you know.