Legal information
Privacy policy
1. Who processes your data
Dragonfly Hub Agency, S.L. (NIF B22445860), Paseo Alameda 19H, local A, 29315 Villanueva de Tapia (Málaga, Spain). For any question about your data: df@dragonflyhubagency.com.
2. What data we process, why and on what basis
| When | Data | Purpose | Legal basis | How long |
|---|---|---|---|---|
| You write to us via the form, by email or by phone | Name, company, email, phone (if you give it) and whatever you tell us | To answer your enquiry and, if you ask, prepare and send you a proposal | Your consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and 6(1)(b) GDPR) | As long as needed to deal with your request; if no contract follows, a maximum of 2 years |
| You hire a service from us or provide one to us | Contact and billing details of the company and its contact persons | To manage the contract, invoice and comply with legal obligations | Performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR) | For the duration of the relationship and then the legal periods (6 years for commercial records, 4 years for tax) |
| You take part in an experience | Whatever the programme requires (for example, name, emergency contact or dietary needs), which will be requested separately | To organise the experience safely | Performance of the contract; for health data, your explicit consent | Until the experience ends and any possible claims are settled |
| We photograph or film you during an experience | Your image and voice | To share the experience on the website, on social media and in Dragonfly materials | Your consent, requested separately for each experience (Art. 6(1)(a) GDPR) | Until you withdraw it |
| You join the Expediciones waiting list, with or without the quiz | Name and email; phone and how you heard about us, if you give them; the expeditions you are interested in and, if you took the quiz, your answers | To let you know when places open, with the dates, the price and how to sign up, and to reply if you write to us | Your consent (Art. 6(1)(a) GDPR) | Until you unsubscribe or, at most, 2 years after you signed up |
| You browse the website and accept analytics | Cookie identifier, pages viewed, device and approximate location | To know how many people visit the website and which pages they use | Your consent (Art. 6(1)(a) GDPR) | 14 months in Google Analytics (see the Cookie policy) |
Messages you send us through the forms are also stored in the website’s database, hosted by Dinahosting (Spain), for the same period.
We do not make automated decisions or create profiles with your data. Fields marked with an asterisk are required so that we can reply.
3. Who we share it with
- We do not share your data with third parties unless required by law.
- If you book an experience that includes travel, we will pass on to the organising travel agency the data needed to manage your booking.
- We are supported by providers that process data on our behalf under contract: Dinahosting, S.L. (website hosting, in Spain), Google Ireland Ltd. (email and, if you accept it, web analytics) and, when you take part in an experience with an app, Exyt Control SL (the app platform).
- Google may process data outside the European Economic Area. It does so under the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
4. Marketing communications
We will only send you information about our experiences if you ask us to or, if you are already a client, about services similar to those you hired. You can unsubscribe at any time from the message itself or by writing to us.
5. Other people’s data
If you give us data about other people (for example, members of your team), you must have informed them beforehand and have their permission.
6. Your rights
You can request access to your data, its rectification or erasure, object to its processing, request its restriction or portability, and withdraw your consent at any time by writing to df@dragonflyhubagency.com with the subject “Data protection”. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We will reply within one month; if we have reasonable doubts about your identity, we may ask you to prove it.
7. Minors and security
The website is not aimed at children under 14. We apply technical and organisational measures to protect your data, such as encrypted connections (https) and restricted access to information.
8. Changes to this policy
If the way we process your data changes, we will update this policy and the date shown at the end.
This English version is a translation provided for information. In the event of any discrepancy, the Spanish version prevails.
Last updated: 23 October 2026.