Privacy Policy

Last Updated June 30, 2026

  1. Who is responsible for your data

Canary Islands Insider is operated by José David Blázquez Arranz, a Sole Proprietor («autónomo») based in Lanzarote, Canary Islands, Spain.

Professional address: Lanzarote, Canary Islands, Spain Contact email: david@canaryislandsinsider.com

For the purposes of data protection law, José David Blázquez Arranz is the data controller for the personal data described in this policy.

  1. What this policy covers

This policy explains what personal data Canary Islands Insider collects when you visit canaryislandsinsider.com, contact us, book a discovery call, fill out an intake form, sign a service agreement, or otherwise interact with us, and how that data is used, stored, and protected.

This policy applies regardless of where you are located, including if you are visiting from the United States, Canada, or elsewhere.

  1. What data we collect

Depending on how you interact with us, we may collect:

Contact information: name, email address, and, if provided, phone number.

Travel planning information: travel dates, destinations of interest, budget range, group size, accommodation preferences, and other details you share through our intake form so we can design your itinerary.

Communication records: messages sent by email, Instagram, Reddit, or other channels, and the content of those messages.

Scheduling information: details related to booking a discovery call, including date, time, and time zone.

Contract and payment-related information: name, email, signature, and contract terms when you sign a service agreement. Note: we do not directly collect or store full payment card details; payments are processed through third-party payment providers (Stripe and PayPal).

Server log data: Our hosting provider automatically logs standard technical information (such as IP address, browser type, and access times) for security and website functionality purposes. We do not currently use any dedicated analytics or tracking tool.

  1. How we use your data

We use your personal data to:

Respond to inquiries and provide information about our services.

Schedule and conduct discovery calls, including follow-up communications related to those calls.

Design and deliver personalized travel itineraries and guides.

Prepare, send, and manage service agreements, including electronic signature.

Communicate with you before, during, and after your trip planning process.

Comply with legal, tax, and accounting obligations under Spanish and EU law.

Improve our website and services based on aggregated, anonymized usage trends.

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you. We do not sell your personal data to third parties.

  1. Legal basis for processing

Where the GDPR applies, we rely on the following legal bases, depending on the type of processing:

Discovery call scheduling — Pre-contractual measures / Legitimate interest Travel Design Service Agreement execution and management — Performance of a contract Newsletter / lead magnet emails — Consent Accounting and tax records — Legal obligation General inquiries — Legitimate interest

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Information required to provide our services

Certain information, such as your name, email address, and travel planning details, is required for us to provide our services. If you do not provide this information, we may be unable to deliver the requested service.

  1. Who we share your data with

We use a small number of third-party service providers to operate our business. These providers process personal data on our behalf, under their own privacy and security terms. Current service providers include:

Tally — for intake forms and lead capture.

Calendly — for scheduling discovery calls.

Dropbox Sign (HelloSign) — for electronic signature of service agreements.

Google Workspace — for email communication and document storage.

Kit (formerly ConvertKit) — for sending the lead magnet email sequence and newsletter communications.

Hostinger — for website hosting.

Stripe and PayPal — for processing payments. We do not store full payment card details; these providers process payment information directly under their own security and privacy terms.

We do not share your data with advertisers, data brokers, or any party for marketing purposes outside of the providers listed above.

  1. International data transfers

Some of the providers listed above are based in or process data in the United States. Where personal data is transferred outside the European Economic Area, we rely on the safeguards provided by these providers, which generally include Standard Contractual Clauses approved by the European Commission or equivalent legal mechanisms. You can request more information about these safeguards by contacting us at the email address above.

Data may be stored on secure servers located within the European Union and, where necessary, in the United States through our service providers.

  1. Third-party websites

Our website and services may contain links to third-party websites or booking platforms, such as hotels, airlines, ferry operators, restaurants, online booking platforms, or other third-party travel services. We are not responsible for the privacy practices or content of those third-party services. We encourage you to review their respective privacy policies before providing any personal information.

  1. How long we keep your data

Lead and inquiry data (contacts who do not become clients): kept for up to 24 months from the last interaction, after which it is deleted unless you have asked to stay subscribed to ongoing communications.

Client and contract data: kept for the duration of our working relationship plus the period required by Spanish commercial and tax law, generally up to 6 years from the end of the relevant fiscal year, or longer where required by applicable law.

You can request earlier deletion of your data at any time, subject to our legal retention obligations described above.

  1. Cookies

Our website does not currently use cookies or any analytics/tracking tool. Standard technical data (such as IP address) may be processed automatically by our hosting provider’s server logs for security purposes. If we add any tool that uses cookies or similar tracking technology in the future (such as analytics or advertising pixels), we will update this policy and display a cookie consent banner before any such technology is activated.

Children

Our services are intended for adults. We do not knowingly collect personal information from children under 18 years of age. If you believe a minor has provided us with personal data, please contact us so we can delete it.

Newsletter and marketing emails

Every marketing email we send, including lead magnet and newsletter content, contains an unsubscribe link. You can opt out of these communications at any time.

  1. Your rights

If the GDPR applies to you, you have the right to:

Access the personal data we hold about you.

Request correction of inaccurate or incomplete data.

Request deletion of your data, subject to our legal retention obligations.

Request restriction of how we process your data.

Object to processing based on legitimate interest.

Request a copy of your data in a portable format.

Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at david@canaryislandsinsider.com. Privacy requests are normally answered within 30 days, as required by law.

If you believe your data protection rights have not been respected, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, https://www.aepd.es), or with the data protection authority in your own country of residence.

Additional rights for U.S. and Canadian residents

If you reside in the United States or Canada, you may have additional privacy rights under applicable local law. Where applicable, these may include the right to access, correct, or delete your personal information, and to opt out of certain uses of your data.

For Canadian residents, our processing of personal data is carried out in accordance with applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable.

We do not sell or share personal information as defined under California privacy law (CCPA/CPRA).

  1. Security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. These measures include, where appropriate, encrypted connections (HTTPS), restricted access to client data, password-protected systems, and multi-factor authentication where available, along with the use of reputable third-party service providers implementing appropriate security measures for hosting, scheduling, and document signature.

  1. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The «Last updated» date at the top of this page indicates when it was last revised. Material changes will be communicated to active clients by email.

  1. Contact

For any questions about this Privacy Policy or how your data is handled, contact:

José David Blázquez Arranz Canary Islands Insider Lanzarote, Canary Islands, Spain. david@canaryislandsinsider.com

We will respond to privacy-related requests as soon as reasonably possible and, where applicable, within the timeframes required by law.