de Ilusión a Recuerdo
ES EN

Privacy Policy

Last updated: 23 August 2026

1. Data Controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), we inform you of who is responsible for processing your personal data on this website:

  • Owner: Patricia Velasco
  • NIF: 02654372B
  • Address: Avenida de Guadalajara, 28032 Madrid (Spain)
  • Contact email: deilusionarecuerdo@gmail.com
  • Website: https://deilusionarecuerdo.com

2. Data We Collect and Purposes

2.1. Newsletter subscription

  • Data: name and email address.
  • Purpose: sending editorial and commercial communications related to family travel, blog updates, destination recommendations, and travel advisory offers.
  • Legal basis: express consent (Art. 6.1.a GDPR).
  • Retention: until consent is withdrawn. Unsubscribe at any time via the link in each email.
  • Processor: Brevo (Sendinblue SAS, France, EU), newsletter provider.

2.2. Contact form and travel advisory request

  • Data: name, email, optional phone, message, trip details (destination, dates, number of travellers including minors, approximate budget).
  • Purpose: responding to enquiries and, for travel advisory requests, preparing a personalised proposal.
  • Legal basis: consent and performance of a service contract (Art. 6.1.a and 6.1.b GDPR).
  • Processor: Fluent Forms (form plugin) integrated with Brevo for notification delivery.

2.3. Blog comments

  • Data: name, email, optional website, IP address, comment.
  • Purpose: moderation and publication of comments.
  • Legal basis: consent upon submission (Art. 6.1.a GDPR).
  • Processor: Akismet (Automattic Inc., USA) for spam filtering.

2.4. Statistical analysis and site usage (cookies)

  • Data: anonymised IP, device identifiers, pages visited, traffic source, visit duration, interaction events.
  • Purpose: analysing aggregate visitor behaviour to improve content and user experience.
  • Legal basis: express consent via cookie banner with Consent Mode v2 (Art. 6.1.a GDPR). Analytics cookies are not loaded until consent is obtained.
  • Retention: the analytics data collected by Google Analytics is kept for 14 months from the moment it is recorded and is then deleted automatically. That period does not reset when you visit the site again: each piece of data expires fourteen months after it was collected, even if you are a regular visitor. The two measurement cookies of our own described below have their own expiry periods.
  • Processor: Google LLC (Google Analytics 4 and Google Search Console).
  • Our own measurement cookies: besides the Google Analytics ones, this site writes two cookies of its own, only with your statistics consent and deleted if you withdraw it: dia_first_touch_utm (90 days), which remembers the campaign or search engine you first arrived from, the page you landed on and the date; and dia_recorrido (90 days from your last visit), which stores the path of the last 5 articles you have read —paths only: no titles, no timings, no scroll—. They tell us which content leads to a trip enquiry. Category: statistics.
  • More info: see our Cookie Policy.

2.5. Affiliate programmes

This website includes affiliate links to accommodation booking platforms, activities, travel insurance, car rental and eSIMs. When you click these links, the destination platform may set its own tracking cookies (not controlled by this site) to attribute any booking. Active programmes at the time of last update include Booking.com, Heymondo, Civitatis, GetYourGuide, Stay22, Holafly, Discover Cars, Autoeurope, Klook and SimLocal (the latter via AWIN network). The site owner receives no personal data from these bookings, only aggregate commissions and, in some cases, anonymised technical metrics.

2.6. Maps and embedded content

Some pages integrate the Stay22 interactive map (USA / Canada) to display accommodation options near the destination. This resource is loaded only if you have given prior consent via the cookie banner. Stay22 may collect technical data (IP, browser, language) to display relevant content.

2.7. Push notifications and local storage (WonderPush)

The Brevo plugin loads the WonderPush SDK, the browser push notification service. That SDK leaves two entries in your browser’s local storage, functional in category and with no expiry (they stay until you clear your browsing data): __wpfvdk, the timestamp of the SDK’s first load, which avoids repeating its 2.75-second start-up delay on later visits; and _wpinitialpermissionstate, which remembers whether your browser’s notification permission was granted, denied or still undecided the first time. They are not cookies, and neither identifies you nor records your browsing. More information in the WonderPush privacy policy. Legal basis: as purely technical entries that neither identify you nor record your browsing, they are stored without asking for your consent, under the exception in article 22.2 of the Spanish LSSI.

3. Processors and Providers

  • Webempresa (Spain, EU) – website hosting.
  • Cloudflare Inc. (USA) – CDN, DNS, DDoS protection.
  • Sendinblue SAS / Brevo (France, EU) – newsletter and transactional email provider.
  • Google LLC (USA) – Google Analytics 4, Google Search Console, Gmail SMTP and Google Gemini API.
  • Automattic Inc. (USA) – Akismet spam filtering.
  • Google Drive (Google LLC, USA) – encrypted website backup storage (UpdraftPlus).

4. Data Retention

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and to meet statutory retention obligations (tax records: 4 years; accounting: 6 years; claims: until the statutory limitation period expires). After these periods, data will be deleted or anonymised.

5. International Data Transfers

Some processors (Google, Cloudflare, Automattic, Stay22) are based in the United States. Transfers are covered by the EU-US Data Privacy Framework approved by the European Commission in July 2023, and by Standard Contractual Clauses (SCCs) where applicable.

6. Your Rights

  • Right of access: to obtain confirmation of whether we process your data and, if so, to receive a copy.
  • Right to rectification: to correct inaccurate or incomplete data.
  • Right to erasure: to request deletion of your data when it is no longer necessary.
  • Right to restriction of processing: to request that processing be limited in certain circumstances.
  • Right to object: to object to processing, particularly for profiling or direct marketing.
  • Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

7. How to Exercise Your Rights

You may exercise your rights by emailing deilusionarecuerdo@gmail.com, identifying yourself and specifying which right you wish to exercise. If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security Measures

The site owner has implemented the necessary technical and organisational measures to guarantee the security of personal data, including HTTPS encryption, two-factor authentication, encrypted backups, periodic malware scans, and a Web Application Firewall (WAF) at Cloudflare level.

9. Changes to this Privacy Policy

The site owner reserves the right to modify this Privacy Policy to adapt it to legislative or jurisprudential changes, or to changes in the services provided. Modifications will be published on this page with an updated date at the top.

Note: The Spanish version (Politica de Privacidad) is the authoritative version of this document.