1. Data controller

• Controller: Alexander Lengyel (sole trader / self-employed)
• Trade name: Aventurator
• Tax ID (NIF/NIE): Z4021977-H · VAT: ESZ4021977H
• Address: Calle Vía Mare 12, 35510 Tías (Puerto del Carmen), Lanzarote, Las Palmas, Spain
• Privacy contact: hello@aventurator.com (subject: “PRIVACY”)
• DPO: Not designated — not required by processing volume (Art. 37 GDPR). Privacy matters are handled internally; contact: hello@aventurator.com.

2. Data processed and purposes

End users: email, name, optional phone, language, approximate country, booking history. Payment data is handled directly by Stripe — Aventurator only stores the transaction ID. Base: contract performance (Art. 6(1)(b)). Retention: 5 years (tax law).

Adventure Passport subscribers: email, name, country, Stripe Customer/Subscription ID and billing history, to manage the subscription. Retention: 5 years.

WhatsApp Business: if you contact us via WhatsApp, we process your number and message content to reply. This channel runs through Meta (WhatsApp Cloud API) — see sections 3 and 8.

Operators / restaurants (B2B): business name, tax ID, address, contact, IBAN, licence. Retention: 6 years after end of relationship.

Visitors: anonymous, aggregated cookieless analytics via Umami Cloud (no cookies, no IP stored, no fingerprinting, no individual profiling). No consent banner is shown.

3. Recipients and processors

• Publishing operator / restaurant (activity delivery).
• Stripe Payments Europe (Ireland) — payments. DPA + SCCs.
• Supabase (EU, Frankfurt) — database & storage. DPA.
• Vercel (web hosting, EU region — Paris). DPA.
• Umami Software Inc. — “Umami Cloud” (USA) — cookieless, aggregated, anonymous analytics (URL, country, device type); stores no cookies and identifies no individual users. DPA + SCCs (transfer to US — see section 8).
• Meta Platforms Ireland Ltd. (WhatsApp Business) — messaging; number, message content and aggregated metrics. DPA + SCCs (transfer to Meta US — see section 8).
• Transactional email provider (EU).
• Spanish Tax Authorities — legal obligation.

Aventurator does not sell data or share it for third-party commercial purposes.

Viator is not a recipient of personal data from Aventurator: affiliate links are an exit to Viator's site, not a disclosure of data by us. See section 9.

4. Retention

• Booking & subscription data: 5 years (tax obligation).
• Operator data: 6 years after end of relationship.
• Security logs: max 12 months.
• Aggregated analytics: indefinite (anonymous after aggregation).

5. Your rights

Access, rectification, erasure, objection, restriction, portability and withdrawal of consent. Write to hello@aventurator.com. Response within 30 calendar days (extendable +60 in complex cases). To erase your data see also the Data Deletion page. You may complain directly to the Spanish DPA — AEPD (aepd.es).

6. Security

TLS 1.3 in transit, AES-256 at rest, passwordless auth, Row Level Security, daily encrypted backups (30-day retention), breach notification < 72h.

7. Minors

Services are not directed at children under 14.

8. International transfers

Infrastructure generally stays within the EEA (Supabase Frankfurt, Stripe Ireland, Vercel EU). There are two transfers outside the EEA, both covered by EU Standard Contractual Clauses (SCCs): (a) WhatsApp Businessmessaging via Meta (US servers), limited to your number, message content and aggregated metrics; and (b) cookieless analytics via Umami Cloud(Umami Software Inc., USA), limited to aggregated, anonymous data (URL, country, device type), with no cookies and no individual identification (Umami DPA). See also the WhatsApp/Meta Privacy Policy.

9. Links to Viator (affiliate)

When you tap a link to a Viator experience, you leave Aventurator and go to Viator's site (Viator, Inc., a Tripadvisor company). From that point Viator processes your data as an independent controller under its own privacy policy, including setting its own attribution cookies on its domain.

Aventurator passes no personal data to Viator and sets no tracking cookies of its own: the link opens in your system browser and attribution happens on Viator's domain. If you complete a booking there, Aventurator receives aggregated commission information from Viator (amount and transaction reference), not the buyer's identity. See the Viator Privacy Policy.

10. Changes

Material changes notified by email to registered users.