Privacy Policy

Contact data: your name and email address, so we can deliver your dossier.

Trip data: destination, travel dates, number of adults, children's age ranges (never names or dates of birth), travel rhythm, nightly accommodation budget, baby gear requirements and any notes you choose to add.

Consent record: the exact consent wording you accepted, the timestamp, and the IP address the request came from. This is a legal record of your agreement and cannot be edited afterwards.

We do not collect payment card data. Payment is handled by our payment processor; we never see or store card numbers.

Performance of a contract (Art. 6(1)(b) GDPR): to prepare and deliver the curation service you ordered.

Consent (Art. 6(1)(a) GDPR): for the storage of the consent record and any optional notes containing health-related detail (for example allergies) that you voluntarily provide.

Legal obligation (Art. 6(1)(c) GDPR): to retain proof of consent, the withdrawal-right waiver and transaction records.

We deliberately request age ranges only. We do not ask for children's names, dates of birth, photographs or medical records, and you should not send them.

We share only the minimum necessary with hotels, transfer providers or clinics when you ask us to make an enquiry on your behalf — typically a first name, dates and gear requirements.

Infrastructure providers (hosting, database, email, payment processing) act as processors under written agreements. We do not sell personal data and we do not run advertising trackers.

Trip and contact data: 24 months after delivery, then deleted.

Consent and transaction records: retained for the statutory period required by accounting and consumer-protection law.

Your published dossier is stored as an immutable snapshot so that what you were delivered can always be reproduced.

You may request access, rectification, erasure, restriction, portability, or object to processing, and you may withdraw consent at any time (this does not affect processing already carried out).

Write to privacy@iberianfamilyconcierge.com. You also have the right to lodge a complaint with your national supervisory authority.

Data is stored on servers inside the European Union. Access is limited to the curation team, protected by individual accounts and role-based permissions. Your dossier link contains a long random token and is not indexed or listed anywhere.