MY SPAIN EXPERIENCE
This Privacy Policy explains how personal data may be collected, used, stored and shared when you visit My Spain Experience, contact us, comment, subscribe to available features, or interact with third-party travel services. It is written with the transparency requirements of the EU General Data Protection Regulation (GDPR) in mind.
My Spain Experience – website operator
Website: myspainexperience.com
Privacy contact: myspainexperience.com@gmail.com
1. Scope and legal framework
This policy applies to personal data processed in connection with My Spain Experience. Where applicable, processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), the ePrivacy rules governing electronic communications and storage/access of information on a user’s device, and applicable national data-protection and cookie legislation.
Third-party websites reached through external or affiliate links are responsible for their own processing. Their privacy notices and terms apply after you interact with those services.
2. Personal data we may process
Depending on how you use the website and which features are enabled, the following categories of data may be processed:
- Technical and connection data: IP address, date and time of requests, requested URL, referrer, browser type and version, operating system, device information, language, approximate country or region, HTTP status, and technical/security logs.
- Usage and analytics data: pages viewed, clicks, referring websites or search terms, approximate geographic information, and aggregated performance or traffic information.
- Contact data: name, email address and the content of messages you send to us.
- Comment data: information submitted with a comment, together with technical anti-spam information such as IP address, user agent and referrer where applicable.
- Subscription data: email address and subscription preferences if you choose to subscribe to posts, comments or other updates through an available subscription feature.
- Consent and preference data: choices made through a cookie or privacy preference mechanism, where available, together with technical records needed to demonstrate or remember those choices.
- Affiliate interaction data: referral parameters or partner identifiers contained in outbound links. The destination provider may process click, device, booking or purchase information after you leave this website.
We do not intentionally ask visitors to provide special-category data such as health information, biometric data, religious beliefs or political opinions. Please do not include sensitive information in ordinary contact messages or comments unless it is strictly necessary.
3. How data is collected
Data may be collected directly from you when you contact us, comment or subscribe; automatically from your browser or device when the website is requested; and through service providers that support hosting, security, analytics, anti-spam, subscriptions or embedded content. We may also receive limited technical or referral information from third parties where necessary to operate the site or understand aggregate traffic.
4. Purposes and legal bases
| Purpose | Typical data | Legal basis under GDPR |
|---|---|---|
| Deliver pages and maintain website functionality | Technical requests, IP address, browser/device data | Legitimate interests in operating and delivering a secure website; where a requested service is involved, performance of that service |
| Security, abuse prevention, troubleshooting and fraud/spam control | IP address, logs, login attempts, user agent, comment metadata | Legitimate interests in protecting the website, users and systems; legal obligation where applicable |
| Respond to messages and editorial/privacy enquiries | Name, email, message content | Legitimate interests in handling correspondence; steps at your request where the communication relates to a possible contract; legal obligation for rights requests |
| Comments and community features, when enabled | Comment content, display details, technical metadata | Performance of the requested feature and legitimate interests in moderation and site integrity |
| Email or content subscriptions, when requested | Email address, subscription preference | Consent, or performance of the service you specifically request, depending on the feature and applicable law |
| Audience measurement and optional analytics | Page views, referrer, device/browser data, approximate location, identifiers where used | Consent where required by ePrivacy/data-protection law; limited consent-exempt analytics may be used only where the applicable legal conditions are met |
| Optional embedded third-party content or widgets | IP address, device/browser data, interaction data and third-party identifiers | Consent where the technology is not strictly necessary |
| Compliance, disputes and defence of legal claims | Relevant account, contact, log or transaction-related information | Legal obligation and/or legitimate interests in establishing, exercising or defending legal claims |
Where processing is based on consent, you may withdraw consent at any time for future processing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Server logs and hosting
Like most websites, the hosting environment may automatically record technical information needed to deliver pages, diagnose errors, protect the server and investigate abuse. Server logs can include IP addresses, timestamps, requested resources, response codes, browser/user-agent information and referrers. These logs are retained only for as long as reasonably necessary for security, technical administration, legal compliance and incident investigation, subject to the hosting provider’s configuration and applicable law.
6. WordPress and website administration
My Spain Experience is built with WordPress. WordPress and installed components may use technical cookies or local storage for authentication, security, preferences and administrative functions. Visitors who do not log in will normally encounter fewer WordPress cookies than registered administrators or authenticated users. More detail is provided in our Cookie Policy.
7. Jetpack services
The database contains Jetpack components used for features such as statistics, security/protection and subscriptions. Depending on the enabled modules, Automattic may receive technical and usage information needed to provide those features.
Jetpack Stats
Jetpack Stats may process information such as IP address, visiting and referring URLs, timestamp, browser language, country code, user agent and, where relevant, WordPress.com account information. The site owner primarily sees aggregated statistics rather than a list identifying individual visitors. Jetpack’s current documentation states that Stats logs containing visitor IP addresses and WordPress.com usernames, where available, are retained by Automattic for 28 days for the purpose of operating the feature.
Jetpack Protect / security
Security features may process IP addresses, login attempts, user agents and other technical information to detect malicious activity, brute-force attacks or abuse. Some security information may be shared with the service provider to provide network-level protection.
Jetpack subscriptions
If you request a subscription, the relevant email address and subscription status may be processed by WordPress.com/Automattic to deliver the requested notifications and manage opt-out preferences. You can unsubscribe using the mechanism included with the subscription service.
8. Akismet anti-spam
If comments or forms protected by Akismet are available, anti-spam screening may send information needed to assess whether a submission is spam. Depending on the feature, this may include the commenter’s IP address, user agent, referrer, site URL and the submitted name, email address, website and message/comment content. This processing is used to protect the site from spam and malicious submissions.
9. Contact communications
If you email us, we process the sender address, message content and any information you choose to provide so that we can respond, manage the correspondence and, where necessary, keep an appropriate record. Please avoid sending unnecessary sensitive or confidential information.
10. Comments
Where comments are enabled, data entered in the comment form, the visitor’s IP address and browser user-agent string may be processed to support moderation, spam detection and security. Comments may remain visible with the chosen display name until removed in accordance with editorial or legal requirements. A request to delete personal data does not necessarily require removal of information that must be retained for legal claims, security, or another valid legal basis.
11. Affiliate links and travel partners
My Spain Experience contains affiliate relationships, including links associated with services such as Booking.com, GetYourGuide and DiscoverCars. These links can contain a partner or referral identifier. Clicking an ordinary affiliate link takes you to an external provider; that provider may then set its own cookies or similar identifiers and process booking, account, payment, device or interaction data under its own privacy notice.
Some pages also contain GetYourGuide widgets or embedded resources. Unlike a simple outbound link, an embedded widget can require a connection to a third-party server while you are still on this site. Where such a connection is not strictly necessary, it should be handled in accordance with applicable consent requirements before non-essential tracking is activated.
My Spain Experience does not receive full payment-card details merely because you follow an affiliate link. Purchases, bookings, cancellations and payments are handled by the relevant external provider under its own terms.
12. Cookies and similar technologies
The website may use cookies, local storage, pixels, scripts and similar technologies for necessary functions, security, preferences, analytics and third-party content. Non-essential storage or access on your device is subject to consent where required. For categories, examples, purposes and retention information, read the Cookie Policy.
13. Recipients and service providers
Personal data may be made available only where necessary to recipients such as:
- hosting, infrastructure, backup and technical-maintenance providers;
- Automattic/WordPress.com for enabled Jetpack services and, where used, Akismet;
- email and communications providers used to receive or respond to messages;
- security, anti-abuse and anti-spam providers;
- professional advisers where reasonably necessary for legal, tax, security or compliance matters;
- public authorities, courts or law-enforcement bodies when disclosure is legally required or necessary to protect rights and security;
- third-party travel or affiliate providers when you choose to interact with their links, widgets or services.
Service providers are permitted to process personal data only within the scope allowed by their role, contractual terms and applicable law. Some providers may act as independent controllers for parts of their own services, in which case their own privacy notices govern those processing operations.
14. International transfers
Some technology providers may process data in countries outside the European Economic Area. Where the GDPR requires a transfer mechanism, transfers should be covered by an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where necessary. Where a provider participates in an applicable adequacy framework, that framework may also be relied upon for eligible transfers. The exact mechanism can depend on the provider, service and destination country.
15. Data retention
We do not keep personal data longer than necessary for the purpose for which it was collected, taking account of security, legal and evidentiary requirements. Typical criteria are:
| Data | Retention approach |
|---|---|
| Server/security logs | For the technical or security period configured by the hosting/security provider and only as long as reasonably necessary for administration, abuse prevention or incident investigation. |
| Jetpack Stats identifiable logs | Jetpack documentation currently states 28 days for Stats logs containing visitor IP addresses and WordPress.com usernames, where available. |
| Contact correspondence | For the time needed to respond and manage follow-up, then for a limited period where reasonably necessary for record keeping, legal obligations or potential claims. |
| Comments | Published comments may remain until removed; related moderation/security metadata is retained according to legitimate operational and legal needs. |
| Subscriptions | Until you unsubscribe or the service ends, with limited suppression/record data retained where necessary to respect an opt-out or demonstrate compliance. |
| Consent records | For the period reasonably necessary to remember and demonstrate the user’s choice, subject to renewal when consent must be requested again or the processing materially changes. |
Where a legal dispute, investigation or binding retention obligation applies, relevant information may be kept longer for that specific purpose.
16. Your data-protection rights
Where the GDPR applies, you may have the right to:
- receive clear information about how your personal data is processed;
- request access to your personal data and obtain a copy;
- request correction of inaccurate or incomplete data;
- request erasure where the legal conditions are met;
- request restriction of processing in the circumstances provided by law;
- object to processing based on legitimate interests on grounds relating to your particular situation;
- object at any time to processing for direct marketing, if such marketing is carried out;
- receive certain data in a structured, commonly used and machine-readable format and have it transmitted to another controller where the portability conditions apply;
- withdraw consent at any time where consent is the legal basis;
- not be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects, except where the law permits it and appropriate safeguards apply.
To exercise a right, contact myspainexperience.com@gmail.com. We may request information reasonably necessary to verify identity and protect data from unauthorised disclosure. GDPR requests are generally answered without undue delay and within one month; the period may be extended where permitted for complex or numerous requests, with notice of the extension.
17. Right to complain
If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent data-protection supervisory authority, including the authority in the EU/EEA country of your habitual residence, place of work or the place of the alleged infringement, as applicable. You may also contact us first so that we can review the issue.
18. Automated decision-making
My Spain Experience does not use visitor data to make solely automated decisions that are intended to produce legal or similarly significant effects on ordinary website visitors. Automated tools may, however, help detect spam, malicious traffic or security threats.
19. Children
The website provides general travel information and is not designed as a service directed specifically at children. We do not knowingly seek to collect personal data from children through child-focused account or profiling features. If you believe a child has submitted personal data inappropriately, contact us so that the situation can be reviewed.
20. Security
Reasonable technical and organisational measures are used to protect the website and personal data against unauthorised access, alteration, disclosure, destruction and other risks. No website, network or storage system can guarantee absolute security, so risk cannot be eliminated entirely.
21. Changes to this Privacy Policy
This policy may be updated when the website, service providers, processing purposes or legal requirements change. Material changes may be highlighted where appropriate. The date below identifies the version currently published.
Last updated: October 7, 2026