Privacy Policy

Who we are

Touch The Sky Paragliding is an active tourism operator based in Costa Adeje, Santa Cruz de Tenerife, Spain. We operate tandem paragliding flights and training programmes across Tenerife.

This privacy policy explains how we collect, use, and protect your personal data when you use our website or book a flight with us.

What data we collect

When you make a booking or enquiry, we collect:

• Name, email address, and phone number
• Booking preferences (flight type, date, number of passengers, pickup location)
• Payment information (processed securely by Stripe — we never see or store your card number)
• Optional: photo and video consent preference
• Technical data your browser sends automatically (IP address, browser type) via our hosting provider

Legal basis (GDPR)

We process your data under the following legal bases:

• Contract performance: to manage your booking and deliver the service you purchased
• Legal obligation: to comply with Spanish tourism and tax regulations
• Legitimate interest: to respond to enquiries and improve our service
• Consent: for marketing communications (you can opt out at any time)

Who we share your data with

We do not sell your data. We share it only with the service providers necessary to operate our business:

• Stripe — payment processing (PCI-DSS compliant)
• Resend — transactional email delivery
• Vercel — website hosting (EU data residency where available)
• Our pilots and operations staff, strictly for delivering your booked flight

How long we keep your data

Booking records are retained for 5 years to comply with Spanish tax law. Enquiries not resulting in a booking are deleted after 12 months. You may request earlier deletion subject to legal retention requirements.

Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (right to be forgotten)
• Object to or restrict certain processing activities
• Receive your data in a portable format
• Lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es

Cookies

Strictly necessary (no consent required): booking session and admin/agent login cookies, and tts_cookie_consent (1 year), which remembers your cookie choice.

With your consent only (first-party analytics): a visitor identifier stored in your browser (tts_vid) used to count page visits, and tts_utm (30 days), which remembers the campaign that brought you to us. You can refuse or withdraw consent at any time via the cookie preferences on this page.

Referral attribution: if you arrive through a partner or friend referral link, tts_ref attributes your booking to them. We use no third-party advertising or tracking cookies.

Contact & changes

To exercise your rights or ask questions about this policy, contact us at: [TO BE CONFIRMED — add email].

We may update this policy from time to time. The 'Last updated' date above reflects the most recent revision.