Privacy Policy

Last updated: August 3, 2026

1. Data controller

The controller responsible for personal data collected through this website is:

• Legal name: Giraldilla Investments S.L. (trading as Inbound Spain)
• Tax ID (CIF): B10558393
• Registered address: Calle Sierra Blanca, 2, 3-C, Marbella, Málaga, Spain, 29601
• Privacy contact: [email protected]

Inbound Spain has not designated a separate Data Protection Officer. Privacy inquiries and data subject requests are handled directly at the email above.

2. What data we collect

This website collects personal data in two ways:

• Contact form (/contact/): name, email address, company name, audience type (tour operator, travel advisor, or other), and the message you submit. This form is provided through HubSpot.
• Technical and log data: IP address, browser type, device type, and pages visited, collected automatically by our hosting provider, Cloudflare, for security and site-operation purposes. This data is not used to identify you personally.
• Analytics and marketing cookies: we plan to use Google Analytics and the Meta pixel (Facebook and Instagram) to measure site traffic and marketing performance. As of the date at the top of this page, these tools are not yet active. Once enabled, they will collect browser and device identifiers, pages viewed, and, for the Meta pixel, interactions with our advertising, only where you have given cookie consent. See our Cookie Policy for details.

This website does not sell personal data to third parties.

3. Purpose and legal basis

We process the data described above for the following purposes, each with its corresponding legal basis under Article 6 of the GDPR:

• Responding to your inquiry and taking steps at your request prior to entering a business relationship (Article 6(1)(b)).
• Operating and securing this website, including preventing abuse and maintaining uptime, which we pursue as a legitimate interest (Article 6(1)(f)).
• Maintaining records of trade communications for the ordinary course of business, also on the basis of legitimate interest (Article 6(1)(f)).
• Measuring site traffic and marketing performance through Google Analytics and the Meta pixel, once enabled, based on your consent (Article 6(1)(a)). You may withdraw consent at any time using the "Cookie Preferences" link in the site footer.

4. Who we share data with

We share data with the following processors, each engaged under a data processing agreement:

• HubSpot Ireland Limited: processes and stores contact form submissions in our HubSpot CRM, hosted in HubSpot's EU1 data region.
• Cloudflare, Inc.: hosts this website and provides content delivery and security services.
• Google LLC: once Google Analytics is enabled, processes analytics data as described in our Cookie Policy, governed by Google's Privacy Policy.
• Meta Platforms, Inc.: once the Meta pixel is enabled, processes advertising and measurement data as described in our Cookie Policy, governed by Meta's Privacy Policy.

We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

5. International data transfers

Contact form data is processed and stored within the European Union through HubSpot's EU1 data region. Cloudflare operates a global network and may process technical and log data outside the European Economic Area as part of its content delivery service. Where this occurs, Cloudflare provides appropriate safeguards, including the European Commission's Standard Contractual Clauses. Once enabled, Google Analytics and the Meta pixel may also process data outside the European Economic Area, including in the United States, under their respective standard contractual clauses or equivalent safeguards.

6. Retention

We retain contact form submissions and related correspondence for as long as needed to respond to your inquiry and, where a business relationship develops, for the duration of that relationship plus the period required by Spanish commercial and tax law (generally up to six years). Inquiries that do not lead to a business relationship are retained for up to 24 months from the last contact, after which they are deleted or anonymized.

7. Your rights

Under the GDPR, you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, and to request data portability. To exercise any of these rights, contact [email protected]. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you believe your data has been processed unlawfully.

8. Minors

This website is intended for travel industry professionals and is not directed at minors. We do not knowingly collect personal data from anyone under 18.

9. Security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or alteration, consistent with the nature of the data we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. The date at the top of this page indicates the last revision. We encourage you to review this page periodically.