Last updated: 28 August 2026
At ERROA EXPERIENCE, S.L. (trading as Lagarioja) we process the personal data of our customers, users and partners transparently and with the utmost respect for their privacy, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
| Controller | ERROA EXPERIENCE, S.L. |
|---|---|
| NIF (tax ID) | B88739545 |
| Registered address | Lapuebla Errepidea 5, Pabellón 11 — 01300 Laguardia (Álava), Spain |
| info@lagarioja.com | |
| Telephone | 614445732 |
2. Where we obtain the data
We process data provided to us directly by the data subject through:
- Contact, information request and quotation forms on the website.
- The online booking form or booking engine, and the payment process.
- Bookings made by telephone, email, WhatsApp or social media.
- The participation contract and the data form completed before the activity begins.
- Newsletter subscription.
- Communications with partners (wineries, accommodation providers, restaurants, local producers, agencies and suppliers).
We may also receive data from third-party intermediaries where the booking is made through travel agencies, booking centres, activity platforms or partner accommodation providers. In such cases, the person making the booking warrants that they have informed the other participants in advance and have their consent to pass on their data to us.
3. Categories of data we process
- Identification and contact data: full name, national ID/foreigner ID/passport number, date of birth, postal address, email address and telephone number.
- Booking data: date and time slot, number of participants, vehicle assigned, language, preferences and remarks.
- Data relating to eligibility to drive: number and validity of the category B driving licence, checked on the day of the activity in accordance with the participation conditions.
- Financial data: amount, means of payment and billing details. We do not store full card numbers: payment is processed directly by the financial institution or the payment gateway.
- Data relating to the safety of the activity: information the participant gives us about physical limitations, illnesses, medical treatment or other circumstances that may affect their ability to drive or take part, as well as emergency contact details if provided.
- Images: photographs and videos taken during the activity, only where the data subject has expressly authorised this.
- Browsing data: IP address, device and browser type, pages visited and data obtained through cookies, on the terms of our Cookie Policy.
Special category data (health)
Information about physical limitations, illnesses or treatments that the participant discloses to us constitutes special category data (Article 9 GDPR). We process it for the sole purpose of ensuring the safety of the participant and of the group, on the basis of their explicit consent (Article 9(2)(a) GDPR) and, in emergencies, the protection of vital interests (Article 9(2)(c) GDPR). This data is treated in strict confidence, is accessible only to the staff running the activity, and is deleted once the activity has ended, unless it needs to be retained because an incident has occurred.
Minors
Minors may take part only as passengers, never as drivers. Their data is provided by their parent or legal guardian, who signs the contract on their behalf and who, where applicable, gives consent for the use of their image. We do not direct our online booking services at children under 14, nor do we process their data without the involvement of their legal representative.
4. Purposes and legal bases for processing
| Purpose | Legal basis (Article 6 GDPR) | Retention |
|---|---|---|
| Handling enquiries, information requests and quotations | Pre-contractual measures at the data subject’s request (6(1)(b)) and legitimate interest in responding to communications (6(1)(f)) | 1 year from the last communication, unless it leads to a contract |
| Managing the booking, payment and delivery of the activity | Performance of the contract (6(1)(b)) | Duration of the relationship and statutory limitation periods |
| Verifying participation requirements (minimum age, driving licence) | Performance of the contract (6(1)(b)) and compliance with a legal obligation (6(1)(c)) | Verification only; no copies are kept unless justified |
| Ensuring safety during the activity | Explicit consent (9(2)(a)) and vital interests (9(2)(c)) | Until the activity ends, unless an incident occurs |
| Arranging and managing the associated insurance and handling claims | Performance of the contract (6(1)(b)) and legal obligation (6(1)(c)) | Limitation periods for actions arising from the claim |
| Invoicing and compliance with accounting and tax obligations | Legal obligation (6(1)(c)) | 6 years (Spanish Commercial Code) and provincial tax limitation periods |
| Handling complaints and legal defence | Legitimate interest (6(1)(f)) and legal obligation (6(1)(c)) | Until actions become time-barred |
| Sending the newsletter and marketing communications | Consent (6(1)(a)) or legitimate interest in respect of customers, for similar services (Article 21(2) LSSI) | Until unsubscription or withdrawal |
| Publishing photographs and videos for promotional purposes | Express consent (6(1)(a)) | Until consent is withdrawn |
| Managing partners and suppliers | Performance of the contract or relationship (6(1)(b)) and legitimate interest (6(1)(f)) | Duration of the relationship and statutory periods |
| Statistical analysis of website use and service improvement | Consent through cookies (6(1)(a)) | See Cookie Policy |
| Compliance with requirements of the competent authorities on tourism, traffic or use of rural tracks | Legal obligation (6(1)(c)) | The period required by law |
The periods indicated are without prejudice to the blocking of data at the disposal of the competent authorities during the limitation periods for any liabilities, in accordance with Article 32 LOPDGDD.
5. Disclosure of data to third parties
We do not sell or transfer personal data for commercial purposes. We may disclose it to:
- Insurance companies and insurance brokers, for cover of the activity and the handling of claims.
- Financial institutions and payment gateways, for collecting booking payments.
- Tax, accounting and employment advisers and, where applicable, law firms.
- Public authorities, law enforcement bodies and the courts, where there is a legal obligation (for example, in the event of an accident, a penalty or a formal request).
- Emergency and healthcare services, where necessary to protect a person’s life or physical integrity.
- Tourism partners (accommodation providers, wineries, restaurants, agencies), only where this is essential in order to deliver a combined service requested by the customer.
In addition, certain service providers access the data as processors, under a contract signed in accordance with Article 28 GDPR: our web hosting and email provider, our booking and customer management tool, our newsletter platform and our web analytics tools.
6. International data transfers
Some of the tools we use (for example Google Analytics, Meta, Gmail, WhatsApp Business and the booking engine) may involve transfers of data to countries outside the European Economic Area. Where this is the case, such transfers are covered by an adequacy decision of the European Commission — such as the EU-U.S. Data Privacy Framework — or, failing that, by standard contractual clauses approved by the European Commission together with any appropriate supplementary measures. You may request information about the safeguards applied by writing to info@lagarioja.com.
7. Rights of data subjects
You may exercise the following rights at any time:
- Access: to find out what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request the deletion of your data where it is no longer necessary.
- Objection: to object to certain processing, including direct marketing.
- Restriction of processing: to request that your data be retained without being processed, in the cases provided for by law.
- Portability: to receive your data in a structured, commonly used format, or to request its transmission to another controller.
- Withdrawal of consent: to withdraw consent at any time (for example, for the use of your image or for the newsletter), without this affecting the lawfulness of processing carried out beforehand.
How to exercise them: by writing to ERROA EXPERIENCE, S.L., Lapuebla Errepidea 5, Pabellón 11 — 01300 Laguardia (Álava), Spain, or by email to info@lagarioja.com, stating the right you wish to exercise and enclosing a copy of a document proving your identity. We will reply within a maximum of one month, which may be extended by a further two months in particularly complex cases.
Complaint to the supervisory authority: if you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), without prejudice to contacting us first.
8. Marketing communications
If you have authorised us to do so, or if you are a customer and the communications relate to services similar to those you have contracted, we may send you information about new tours, seasonal experiences, promotions or news. You may unsubscribe at any time through the link included in every communication or by writing to info@lagarioja.com, free of charge and without difficulty.
9. Use of images
We may take photographs and videos during the activity. They are published on the website, on social media or in promotional material only with the express consent of the data subject, obtained in the participation contract by means of a specific tick box. This consent is free of charge, may be withdrawn at any time, and refusing it has no effect whatsoever on participation in the activity. If consent is withdrawn, we will remove the image from our own channels within a reasonable period, although we cannot guarantee the deletion of copies that third parties may have made.
10. Social media and messaging apps
We have social media profiles and may respond to enquiries through messaging apps. When you interact with us through these channels, your data is also processed in accordance with the privacy policies of the respective platforms, over which we have no control. We recommend that you do not provide sensitive data or payment details by these means.
11. Security measures
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including access control, staff training, signed confidentiality undertakings, encryption of website communications by means of an SSL/TLS certificate, and back-ups. In the event of a security breach posing a high risk to your rights, we will notify you without undue delay.
12. Automated decision-making and profiling
We do not take automated decisions producing legal effects on data subjects, nor do we carry out profiling of that kind. Web analytics are used solely for statistical and aggregated purposes, subject to prior consent.
13. Updates to this policy
This Privacy Policy may be updated to reflect legislative changes, new processing activities or changes to our services. We will always publish the version in force on this page, stating the date of the last update. If the changes are substantial, we will notify you through the contact details available.