Last updated: September 2026

Privacy Policy

This Privacy Policy explains how personal data is processed when you visit the Barcelona Private Concierge website, submit an enquiry or communicate with us about a possible or confirmed service.

Joint controllers: Carlos Cabasa Lladó, NIF 47882099D, and Carlos Niella Caballé, NIF 47646014L.

Professional address: Carrer del Comte de Salvatierra, 5, despacho 511, Barcelona, Spain.

Privacy contact: hello@barcelonaprivateconcierge.com

1. Data we process

Depending on how you interact with us, we may process:

identity and contact information, such as name, email address and telephone or WhatsApp number;
trip information, such as travel dates, number of guests, origin, hotel-booking status, interests, approximate trip budget and preferences you choose to share;
communications exchanged with us before, during or after the service;
contract, billing and transaction information where you become a client;
technical and security information generated when the website is accessed, such as IP address, browser information and server logs, where processed by our hosting infrastructure.

Please do not submit health information, identification documents, payment-card details or other sensitive personal data through the website enquiry form. If particular information is later required to fulfil a specific request, we will tell you how to provide it appropriately.

2. Why we use your data and legal bases

Responding to enquiries and preparing a proposal

We use the information you submit to understand your trip, contact you, assess your request and prepare or discuss a potential service. The legal basis is taking steps at your request before entering into a contract.

Providing an agreed service

If you become a client, we process data necessary to plan, coordinate and support the services you request. The legal basis is performance of the contract.

Administration, accounting and legal compliance

We may retain invoices, transaction records and other information where required by tax, accounting, consumer-protection or other applicable law. The legal basis is compliance with legal obligations.

Website security and service improvement

Limited technical information may be processed to operate, secure and troubleshoot the website. The legal basis is our legitimate interest in maintaining a secure and functional website.

We do not currently use the enquiry data for email marketing. If we introduce newsletters or promotional communications, we will provide the appropriate information and, where required, request separate consent.

3. Who receives your data

Access is limited to the people and service providers who need the information for the purposes described above. Current service providers may include:

Netlify, used to host the website and, when enabled, receive website form submissions;
Google, where email services are used to receive, store or reply to enquiries;
professional advisers or administrative providers where necessary for legal, accounting or business administration;
travel or hospitality providers only where this is necessary to obtain availability, coordinate a requested service or perform an agreed arrangement, and after the relevant information is available to be shared.

We do not sell personal data.

4. International transfers

Some technology providers may process information outside the European Economic Area, including in the United States. Where required, such transfers are made using a legally recognised transfer mechanism, such as an adequacy decision, participation in the EU–U.S. Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses.

5. How long we keep data

Enquiries that do not become clients: normally for up to 12 months after the last meaningful contact, unless a shorter period is appropriate or retention is needed to establish, exercise or defend legal claims.
Client-service records: for the duration of the relationship and afterwards for the period reasonably required to deal with follow-up, complaints or legal claims.
Invoices and legally required accounting/tax records: for the statutory retention periods applicable in Spain, which may extend to six years for certain business records.

6. Your rights

Subject to the conditions established by applicable data-protection law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

To exercise a right, email hello@barcelonaprivateconcierge.com. We may ask for reasonable information to verify your identity before acting on a request.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or, where applicable, another competent supervisory authority.

7. Joint-controller arrangement

The two controllers jointly determine the purposes and essential means of processing connected with Barcelona Private Concierge. You may exercise your data-protection rights against either controller by using the single contact address above. The controllers allocate their internal responsibilities between them without limiting any rights you have under the GDPR.

8. Cookies and tracking

The current version of the website does not intentionally deploy analytics or advertising cookies. Please see the Cookie Policy for further information. If analytics, advertising pixels or other non-essential tracking technologies are introduced, the policy and consent mechanism will be updated before those technologies are activated.

9. Changes to this policy

We may update this Privacy Policy to reflect changes in the website, service providers or legal requirements. The latest version will always show its update date at the top of this page.