PRIVACY POLICY
Dust Devils
Effective Date: 1st January 2025
DD Enduro Spain Tours SL, trading as Dust Devils, is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal data when you interact with us, including when you book with us, visit our website, or communicate via phone, email, or other channels.
1. Who We Are
Dust Devils is a trading name of DD Enduro Spain Tours SL.
Registered Address: Parque Empresarial Nave 14, 29100 Coín, Málaga, Spain.
Data Controller and Handler: The Company Director.
For all data-related inquiries, please contact us at: [insert email address or contact form link if desired].
2. What This Privacy Policy Covers
This Privacy Policy covers personal data collected, used, and processed by Dust Devils in relation to:
Enquiries and bookings made via our website, booking systems, social media, phone, email, or in person
Riders, customers, clients, suppliers, and affiliates
Visitors to our website or associated online platforms
Email subscribers, marketing participants, and social media followers
3. The Data We Collect
We may collect and process the following categories of personal information:
Identity Data: Full name, date of birth, nationality, passport or ID number
Contact Data: Email address, phone number, postal address, emergency contact
Booking Data: Travel dates, package selections, extras booked, group size
Financial Data: Payment details, billing address, transaction records (processed securely via third-party payment providers)
Health and Safety Data: Medical conditions, allergies, dietary requirements, fitness to ride
Technical Data: IP address, browser type, time zone settings, device type
Usage Data: How you use our website, bookings made, preferences, page interactions
Marketing Data: Your preferences in receiving marketing from us and your communication preferences
We do not knowingly collect data from individuals under the age of 18 unless explicitly authorised by a parent or legal guardian.
4. How We Collect Your Data
We may collect your data in a variety of ways, including:
Directly from you when you:
Fill in forms on our website
Make a booking or enquiry
Provide personal details for insurance or travel purposes
Interact with us via email, phone, or messaging services (e.g., WhatsApp)
Opt in to marketing communications
Automatically when you:
Visit our website or social media pages (via cookies and analytics tools)
Interact with our digital platforms, booking systems, or email communications
From third parties, including:
Booking platforms (e.g., Checkfront)
Survey forms (e.g., Google Forms)
Marketing partners (with your consent)
Publicly available sources (e.g., social media)
5. How We Use Your Personal Data
We use your personal data for the following lawful purposes:
Contractual Purposes:
To process your bookings and payments
To manage your riding experience and provide customer service
To send confirmations, itineraries, and safety briefings
Legal and Regulatory Compliance:
To meet insurance, health and safety, and tax requirements
To keep accurate records for accounting and reporting
Legitimate Interests:
To improve our services and website functionality
To contact you about important updates or feedback opportunities
To protect our business, staff, riders, and property
Consent-Based Use:
To send you marketing communications if you’ve opted in
To use images or testimonials with your prior permission
To place cookies and track your use of our site for performance insights
6. Marketing Communications
We only send marketing emails or messages if you have explicitly opted in. You may unsubscribe at any time by:
Clicking the “unsubscribe” link in our emails
Contacting us directly and requesting removal
Adjusting your preferences via your user account or booking form
We will never sell or lease your data to third parties for marketing purposes.
7. Cookies and Website Tracking
Our website uses cookies and similar technologies to:
Improve website functionality and user experience
Measure performance and visitor behaviour
Remember your preferences and previous interactions
Cookies are small data files placed on your device. You can disable cookies via your browser settings, though this may affect site functionality.
8. Sharing Your Personal Data
We may share your data with trusted third parties where necessary for:
Booking and payment processing (e.g., Checkfront, Stripe)
Providing services (e.g., accommodation partners, trainers, guides)
Safety, insurance, or emergency contact purposes
Compliance with legal obligations or responding to law enforcement
IT, web hosting, email marketing, and analytics support
All third parties are required to respect your data and use it only for specified purposes.
9. International Data Transfers
We do not knowingly transfer your personal data outside the European Economic Area (EEA). Should we ever need to do so (e.g., if a platform provider stores data on international servers), we ensure appropriate safeguards are in place, such as:
Standard contractual clauses
Binding corporate rules
Providers certified under GDPR-compliant schemes
10. How Long We Keep Your Data
We retain personal data for up to 7 years after your last interaction with us to meet legal, insurance, and business record-keeping obligations. After this period, we securely delete or anonymise the data.
We may retain data longer if:
We are involved in an active legal dispute or investigation
We have received your consent to do so for ongoing marketing purposes
11. Your Rights Under Data Protection Law
As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:
Access: Request a copy of the personal data we hold about you
Correction: Request that we correct or update any inaccurate or incomplete data
Erasure: Request deletion of your data where there is no legal reason for us to retain it
Objection: Object to processing based on our legitimate interests or for marketing purposes
Restriction: Ask us to suspend processing of your data
Data Portability: Receive your personal data in a structured format for transfer elsewhere
Withdraw Consent: You may withdraw your marketing or cookie consent at any time
To exercise your rights, contact The Company Director using the contact details provided above. We aim to respond within one month.
12. Data Security
We have implemented appropriate technical and organisational measures to protect your data, including:
Encrypted payment processing via third-party providers
Secure access controls to customer records
Regular backups and antivirus systems
Staff training and confidentiality obligations
While we take every reasonable precaution, no system is completely secure. We encourage you to protect your own data (e.g., avoid sharing passwords or accessing platforms on public networks).
13. Third-Party Links
Our website, emails, or booking platforms may contain links to third-party websites or services. Clicking on these may allow third parties to collect or share your data. We are not responsible for the privacy practices of such third parties, and we encourage you to read their privacy policies before providing personal information.
14. Changes to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website and will include a revised “Effective Date.” If significant changes are made, we will notify you via email or an update banner.
We recommend reviewing this policy periodically to stay informed of how we protect your data.
15. Contacting Us
If you have any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact:
The Company Director
Dust Devils (DD Enduro Spain Tours SL)
Parque Empresarial Nave 14
29100 Coín
Málaga, Spain
[Insert contact email or phone number]
If you are not satisfied with our response, you may also lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos) or your local supervisory authority.
All rights reserved.
Dust Devils is a trading name of DD Enduro Spain Tours SL.
This policy is written in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
