Privacy policy

Effective date: 8 October 2026. Updated 10 October 2026: the enquiry form’s automated-submission check (section 5).

1. Who is responsible for your information

The data controller is Ramin Jafari, trading as Avelia Travel. His domicile and tax number are in our legal notice. For privacy questions, or to exercise your rights, contact info@aveliatravel.com or +1 332-291-7686.

This policy covers our website, enquiries, proposals, bookings and client communications, including information about other travellers given to us by the person arranging a trip. Hotels, airlines, insurers and other businesses you deal with have their own privacy notices.

2. What we collect

For an enquiry, we need your name, contact details, travel dates, destination, party size, interests and budget. To arrange a booking we may also need traveller names, dates of birth, nationalities, passport or identity document details, billing details, emergency contacts and service preferences. We ask for travel-document details only when a booking or the law requires them. Our website and its providers also record technical information such as IP addresses.

Please don’t put passport numbers, financial details or medical information in the enquiry form, and enter card details only in the payment provider’s own secure page.

3. Why we use it, and on what legal basis

• Replying to your enquiry and preparing a proposal: steps you ask us to take before a contract, Article 6(1)(b) GDPR.
• Arranging and delivering your trip: performing our contract with you, Article 6(1)(b). For fellow travellers who are not party to the contract, the legitimate interest, theirs and ours, in organising the trip they are part of, Article 6(1)(f).
• Legal obligations, such as accounting, tax and consumer law: Article 6(1)(c).
• Security, fraud prevention and legal claims: our legitimate interest in protecting our clients and our business, Article 6(1)(f).
• Marketing emails: only if you have agreed to receive them, separately from your enquiry, Article 6(1)(a). You can unsubscribe at any time, and messages about your enquiry or booking never depend on it.
• Website analytics: our legitimate interest in understanding and improving our website, Article 6(1)(f). See Cookies.

4. Health and other sensitive information

Accessibility needs, allergies, health conditions and some dietary requirements can be sensitive information. We ask for your explicit consent before we use them, under Article 9(2)(a) GDPR. You may withdraw it, though we may then be unable to arrange the related service. We share only what a supplier needs to meet your request, and never use it for advertising.

5. Who receives it

We share what is needed with the hotels, guides, transport operators, restaurants and other suppliers of your trip, who may also use it under their own legal obligations. Our service providers act on our instructions, under processing agreements:

• Cloudflare hosts this website, and holds an enquiry for up to 90 days while it is delivered to HubSpot. Its Turnstile service checks, without showing you anything, that the enquiry form is sent by a person rather than an automated program; see Cloudflare’s Turnstile Privacy Addendum.
• HubSpot is our customer-relationship system.
• Google provides our email, documents and file storage, and our website analytics.
• Lovable hosts our client itinerary portals at trips.aveliatravel.com.
• Jotform hosts the form through which clients with a confirmed booking send us copies of their travel documents, and stores what is sent on its servers in the European Union.
• Other providers handle electronic signatures, payments, hotel reservations and accounting.

Banks, insurers, professional advisers and public authorities may receive information as independent controllers. We never sell personal information.

6. Transfers outside Europe

Cloudflare, Google, HubSpot and Jotform are United States companies that participate in the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection. Any other transfer outside the European Economic Area relies on the Commission’s standard contractual clauses. You can ask us for details, and a copy, at info@aveliatravel.com.

7. How long we keep it

We keep your information for as long as we need it to reply to you, to plan and deliver your trip and to meet our legal obligations, and delete it when it is no longer needed, or sooner if you ask and the law allows. Accounting and booking records are kept for six years, as the Spanish Commercial Code requires. Health and travel-document details are deleted once your trip and its follow-up are complete. Marketing details are kept until you unsubscribe. Our hosting provider keeps the website’s request logs for up to seven days.

8. Your rights

You can ask us for access to your information, and for its correction, erasure, restriction or transfer to you, and you can object to processing based on our legitimate interests. You can withdraw consent at any time, without affecting processing that took place before.

Write to info@aveliatravel.com, or by post to the domicile in our legal notice. We reply within one month, which the law lets us extend by two further months for complex requests, telling you why. You can also complain to the Agencia Española de Protección de Datos, or to the data protection authority where you live.

9. Other travellers and children

If you give us information about other travellers, please share this policy with them. Our services are for adults; we use children’s information only to arrange their travel with an authorised adult, and never for marketing.

10. Other things you should know

We need the information marked as required to reply to you or to perform a booking; without it we may be unable to help. We make no decisions about you by automated means alone. We protect your information with appropriate technical and organisational measures, though no system is completely secure. We update this policy when our practices or the law change.

Cookies

Our website uses Google Analytics, which sets two cookies on your device when you visit: _ga, which distinguishes one visitor from another, and _ga_XFE942JSNS, which keeps the state of a visit. Both expire after two years.

We have set Google Analytics not to use Google signals or ad personalisation, and to remove everything but campaign parameters from the page addresses it records, so that a web address cannot carry your name or email to Google.

You can block or delete these cookies in your browser settings, and you can stop Google Analytics measuring your visits with Google’s opt-out browser add-on.