1Who is responsible for your personal data?
Data controller
Legal name: Rodrigo Romojaro Gonzalez
Commercial name: White Houses Tours
NIF: 03132951Y
Travel agency registration: C.I.AN-297872-2 (Retail · Online)
Postal address: C/ Pico Ocejon 39, 19004 Guadalajara, Spain
Email: info@whitehousestours.com
Website: https://whitehousestours.com/
White Houses Tours is the commercial name used for the tourism experiences, bookings, enquiries and wine-shop services offered through this website. It is registered in the Andalusian Tourism Registry as an online retail travel agency under number C.I.AN-297872-2.
We have not appointed a Data Protection Officer because, based on the activities currently carried out, this appointment does not appear to be mandatory. If this situation changes, this policy will be updated.
2What personal data do we collect?
Depending on how you use the website and the service requested, we may process:
- Identification and contact data, such as your name, email address, telephone number and preferred contact method.
- Booking data, such as the date, number of guests, selected experience, language, accommodation or pickup area and messages relating to the booking.
- Payment and transaction data. Card details are processed by the payment provider and are not stored in full by White Houses Tours.
- Billing and tax information when an invoice is requested or must be issued.
- Delivery information for wine-shop orders, such as delivery address, country and shipping details.
- Dietary requirements, allergies, intolerances, accessibility requirements or other information that you voluntarily provide so that we can adapt the experience safely.
- Communications exchanged with us by email, telephone, WhatsApp, contact form or booking platform.
- Technical and usage information, such as IP address, browser, device, approximate location, consent choices and website interactions, when permitted by your cookie preferences.
- Information necessary to prevent fraud, spam, misuse or security incidents.
Please do not send information that is not necessary for the service. If you provide information about another guest, you confirm that you are authorised to do so and that the person has been informed about this policy.
3Why do we use your data and what is the legal basis?
3.1Enquiries and quotations
Purpose: to answer questions, recommend an experience, prepare a quotation and take steps requested before a booking.
Legal basis: taking pre-contractual steps at your request and, where applicable, your consent.
3.2Managing bookings and providing an experience
Purpose: to confirm availability, manage payment, organise the guide, vehicle, host, producer, meeting point, dietary requirements and other practical details, provide the booked service and send operational communications.
Legal basis: performance of a contract or taking pre-contractual steps at your request.
3.3Wine-shop orders and delivery
Purpose: to process the order, payment, taxes, invoice, packaging, shipping, delivery, returns and customer service.
Legal basis: performance of the sales contract and compliance with legal obligations.
3.4Accounting, tax, invoicing and legal compliance
Purpose: to keep legally required records, issue invoices, comply with tax, accounting, consumer, tourism and other applicable obligations and respond to competent authorities.
Legal basis: compliance with legal obligations.
3.5Dietary, allergy, accessibility or health-related information
Purpose: to adapt the food, route or experience and help provide the service safely.
Legal basis: your explicit consent when you voluntarily provide special-category information. Only the minimum necessary information will be shared with the people who need it to provide the service.
You may withdraw this consent, but doing so may make it impossible to provide a requested adaptation safely.
3.6Customer service, complaints and legal claims
Purpose: to deal with incidents, complaints, refund requests, chargebacks, insurance matters and possible legal claims.
Legal basis: performance of the contract, compliance with legal obligations and our legitimate interest in defending and managing claims.
3.7Website security, spam and fraud prevention
Purpose: to protect forms, accounts, transactions and the website from spam, fraud, abuse and security incidents.
Legal basis: our legitimate interest in protecting the website, our guests and our business, and compliance with applicable security obligations.
3.8Analytics
Purpose: to understand how people find and use the website, identify technical or usability problems and improve content and conversion paths.
Legal basis: your consent for analytics cookies or equivalent tracking technologies. Analytics that require consent must not be activated before that consent is given.
3.9Advertising measurement
Purpose: on pages or campaigns where it is expressly enabled, to measure advertising performance, attribute conversions and avoid irrelevant advertising.
Legal basis: your consent. Advertising storage, advertising user data and advertising personalisation must remain denied until the corresponding consent is obtained.
3.10Commercial communications
Purpose: to send news, offers or recommendations when you have expressly requested them or when another lawful basis applies.
Legal basis: consent or, only where legally permitted, an existing customer relationship for similar services. Every message will include an easy way to unsubscribe.
We do not use the information entered in an enquiry or booking form to send unrelated marketing merely because the form was submitted.
4Is it compulsory to provide the data?
Fields marked as required are necessary to answer the request, manage the booking or provide the service. If they are not completed, we may be unable to process the enquiry or booking.
Optional information helps us adapt the experience but is not required unless it is necessary for safety or for a specific service requested by you.
5How long do we keep your data?
- Enquiries that do not result in a booking: normally up to 12 months after the last meaningful communication, unless you ask us to delete them sooner or they must be retained for a possible claim.
- Booking, transaction, invoice and accounting records: for the duration of the relationship and for the statutory limitation and retention periods that apply afterwards.
- Dietary, allergy or accessibility information: only for as long as necessary to organise and provide the experience and, where relevant, to deal with an incident or claim.
- Customer-service and claim records: for as long as necessary to resolve the matter and during the applicable limitation period.
- Marketing data: until you withdraw your consent, unsubscribe or object, or until the data are no longer useful for the stated purpose.
- Analytics and cookie data: according to the retention settings of each service and your consent choices. The current cookie list and duration should be available through the cookie preference panel.
Data may be securely blocked instead of immediately erased when retention is required to comply with a legal obligation or defend a claim.
6Who may receive your data?
We do not sell personal data.
Data may be accessed or received, only when necessary, by:
- White Houses Tours personnel and authorised local guides.
- The vineyard, winery, cooperative, tasting venue, food provider, transport provider or other local partner involved in providing the selected experience.
- Booking and ticketing platforms, including TuriTop and any external platform through which the booking was made.
- Payment providers, including Stripe, and banks or payment institutions involved in the transaction.
- Hosting, website maintenance, email, form, security and anti-spam providers.
- Analytics, consent-management and media providers, including Google and CookieYes, subject to the visitor’s consent choices where required.
- Shipping, customs and logistics providers for wine-shop orders, including the specialist wine-delivery provider used for the relevant destination.
- Accounting, legal, insurance and professional advisers when necessary.
- Public authorities, courts or law-enforcement bodies when disclosure is legally required.
Each recipient receives only the information reasonably necessary for its role. Service providers acting on our behalf must process the data under appropriate contractual and confidentiality obligations.
7International data transfers
Some technology providers may process data outside the European Economic Area. Where an international transfer occurs, we will use a legally recognised safeguard, such as:
- an adequacy decision adopted by the European Commission;
- the EU–US Data Privacy Framework for providers that are validly certified;
- the European Commission’s Standard Contractual Clauses together with supplementary safeguards where required; or
- another mechanism permitted by the GDPR.
Information about the safeguard applicable to a particular provider can be requested at info@whitehousestours.com.
8Automated decisions and profiling
White Houses Tours does not make decisions producing legal or similarly significant effects solely by automated means.
Analytics and advertising services may create audience or interaction segments when the visitor has consented. These segments are used for measurement or advertising optimisation and not to make decisions with legal or similarly significant effects about a person.
9Your data-protection rights
You may request:
- access to your personal data;
- correction of inaccurate or incomplete data;
- erasure of data when legally applicable;
- restriction of processing;
- objection to processing based on legitimate interests;
- portability of data when legally applicable; and
- withdrawal of consent at any time, without affecting processing carried out before withdrawal.
To exercise a right, email info@whitehousestours.com with the subject “Data protection request”. We may ask for information reasonably necessary to verify your identity. Do not send a copy of an identity document unless it is specifically necessary and requested through an appropriate channel.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): https://www.aepd.es/
10Security
We apply reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, disclosure or destruction. Access is limited according to operational need.
No internet service can guarantee absolute security. If we identify a personal-data breach that must be notified under applicable law, we will follow the legally required notification procedure.
11External booking platforms and links
If you book through an external platform such as Viator, GetYourGuide, Airbnb Experiences or another marketplace, that platform processes certain data under its own privacy policy. White Houses Tours receives the information necessary to manage the booked experience.
The website may contain links to third-party websites. Those third parties are responsible for their own privacy practices once you leave our website.
12Children
The website is not intended to collect personal data directly from children under 14 without the involvement of a parent or legal guardian. If a booking includes a minor, the booking must be managed by an adult responsible for that minor.
Alcoholic drinks will only be served in accordance with applicable law and responsible-service requirements.
13Changes to this policy
We may update this policy when the website, providers, processing activities or legal requirements change. The latest version and review date will always be published on this page. Material changes will be communicated when legally required.
Choices, controls and technologies used on this website.
16Services and cookie inventory
Depending on the page and the visitor’s consent choices, the website uses or may use:
- CookieYes for consent management;
- Google Tag Manager for managing measurement tags;
- Google Analytics 4 for general analytics;
- Google Ads on pages or campaigns where advertising measurement is enabled;
- Google reCAPTCHA for form protection;
- YouTube privacy-enhanced embeds loaded after interaction;
- CleanTalk or equivalent anti-spam/security technology;
- TuriTop for booking-calendar functionality;
- Stripe and WooCommerce for wine-shop payment and order functions.
A current detailed list of cookies and similar technologies, including their provider, purpose, category and duration, is available through the cookie preference panel. This inventory is updated when the website’s services or tracking configuration change.
17How do we obtain and manage consent?
On the first visit, the cookie banner should provide equivalent and clearly visible options to:
- Accept all;
- Reject all; and
- Choose or configure preferences.
Rejecting non-essential cookies must be as easy as accepting them. No analytics or advertising cookies requiring consent should be installed before the corresponding choice.
Visitors must be able to withdraw or change their consent at any time through a permanently accessible “Cookie settings” link. Withdrawing consent must be as easy as giving it.
Google Consent Mode v2 should receive a default denied state, where required, for:
- analytics_storage;
- ad_storage;
- ad_user_data; and
- ad_personalization.
The consent-management platform should update those states immediately after the visitor saves a choice.
18How can cookies be deleted in the browser?
Visitors can also delete or block cookies through their browser settings. Browser controls do not replace the website’s obligation to obtain consent before using non-essential cookies.
Instructions are available from the relevant browser provider, including Chrome, Firefox, Safari and Microsoft Edge.
19Contact about privacy and cookies
For questions about this policy, consent choices or personal data, contact:
Email: info@whitehousestours.com
Postal address: C/ Pico Ocejon 39, 19004 Guadalajara, Spain
Last reviewed: 18 July 2026