de Ilusión a Recuerdo
ES EN

Privacy Policy

Last updated: 15 October 2026

1. Data Controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), we inform you of who is responsible for processing your personal data on this website:

  • Owner: Patricia Velasco
  • NIF: 02654372B
  • Address: Avenida de Guadalajara, 28032 Madrid (Spain)
  • Contact email: patricia@deilusionarecuerdo.com
  • Website: https://deilusionarecuerdo.com

2. Data We Collect and Purposes

2.1. Newsletter subscription

  • Data: name and email address.
  • Purpose: sending editorial and commercial communications related to family travel, blog updates, destination recommendations, and travel advisory offers.
  • Legal basis: express consent (Art. 6.1.a GDPR).
  • Retention: until consent is withdrawn. Unsubscribe at any time via the link in each email.
  • Processor: Brevo (Sendinblue SAS, France, EU), newsletter provider.

2.2. Contact form and travel advisory request

  • Data: name, email, optional phone, message, trip details (destination, dates, number of travellers including minors, approximate budget).
  • Purpose: responding to enquiries and, for travel advisory requests, preparing a personalised proposal.
  • Legal basis: consent and performance of a service contract (Art. 6.1.a and 6.1.b GDPR).
  • Daily copy: every day a copy of the requests and their status is kept on a server of the controller’s own, in Spain. It shows how many enquiries end in a trip. If you ask to be erased, you are removed from that copy too.
  • Processor: Fluent Forms (form plugin) integrated with Brevo for notification delivery.

2.3. Blog comments

  • Data: name, email, optional website, IP address, comment.
  • Purpose: moderation and publication of comments.
  • Legal basis: consent upon submission (Art. 6.1.a GDPR).
  • Processor: Akismet (Automattic Inc., USA) for spam filtering.

2.4. Statistical analysis and site usage (cookies)

  • Data: anonymised IP, device identifiers, pages visited, traffic source, visit duration, interaction events.
  • Purpose: analysing aggregate visitor behaviour to improve content and user experience.
  • Legal basis: express consent via cookie banner with Consent Mode v2 (Art. 6.1.a GDPR). Analytics cookies are not loaded until consent is obtained.
  • Retention: the analytics data collected by Google Analytics is kept for 14 months from the moment it is recorded and is then deleted automatically. That period does not reset when you visit the site again: each piece of data expires fourteen months after it was collected, even if you are a regular visitor. The two measurement cookies of our own described below have their own expiry periods.
  • Processor: Google LLC (Google Analytics 4 and Google Search Console).
  • Our own measurement cookies: besides the Google Analytics ones, this site writes two cookies of its own, only with your statistics consent and deleted if you withdraw it: dia_first_touch_utm (90 days), which remembers the campaign or search engine you first arrived from, the page you landed on and the date; and dia_recorrido (90 days from your last visit), which stores the path of the last 5 articles you have read —paths only: no titles, no timings, no scroll—. They tell us which content leads to a trip enquiry. Category: statistics.
  • More info: see our Cookie Policy.

2.5. Affiliate programmes

This website includes affiliate links to accommodation booking platforms, activities, travel insurance, car rental and eSIMs. When you click these links, the destination platform may set its own tracking cookies (not controlled by this site) to attribute any booking. Active programmes at the time of last update include Booking.com, Heymondo, Civitatis, GetYourGuide, Holafly, Discover Cars, Autoeurope, Klook and SimLocal (the latter via AWIN network). The site owner receives no personal data from these bookings, only aggregate commissions and, in some cases, anonymised technical metrics.

2.6. Travel agency clients

  • Data: first name and surnames, ID card or passport, date of birth, nationality, contact details, address, trip details and payments. For minors travelling, we ask for the same data as for an adult, provided by their parents or guardians. If you tell us about allergies or diets, that is health data and we only keep it with your explicit permission.
  • Purpose: to prepare your proposal, book and organise the trip, assist you before, during and after the trip, and invoice.
  • Legal basis: performance of the travel contract and of the pre-contractual steps you ask for (Art. 6(1)(b) GDPR) and compliance with our accounting and tax obligations (Art. 6(1)(c) GDPR). Allergies and diets: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time. Agency news and offers: only if you tick the box that asks for it (Art. 6(1)(a) GDPR).
  • Recipients: the suppliers who provide the travel services, such as airlines, hotels, ground handlers, wholesalers and insurers. If the destination is outside the European Economic Area, sending them the data is necessary to perform the trip (Art. 49(1)(b) GDPR).
  • Retention: while the trip is being prepared and carried out. After that, the signed contract and its annexes for six years from your return, to handle any claim. Invoices, for the periods set by tax and accounting law. Allergies and diets are deleted once they are no longer needed for the trip.
  • Processors: those in section 3 marked “agency”.

2.7. Push notifications and local storage (WonderPush)

The Brevo plugin loads the WonderPush SDK, the browser push notification service. That SDK leaves two entries in your browser’s local storage, functional in category and with no expiry (they stay until you clear your browsing data): __wpfvdk, the timestamp of the SDK’s first load, which avoids repeating its 2.75-second start-up delay on later visits; and _wpinitialpermissionstate, which remembers whether your browser’s notification permission was granted, denied or still undecided the first time. They are not cookies, and neither identifies you nor records your browsing. More information in the WonderPush privacy policy. Legal basis: as purely technical entries that neither identify you nor record your browsing, they are stored without asking for your consent, under the exception in article 22.2 of the Spanish LSSI.

2.8. Instagram comments and messages

On some posts and ads of @ilusionrecuerdo you can comment a word to get a link by private message. When you do, we keep a record of that message.

  • Data: the identifier Instagram gives your account, the identifier of your comment, the post or ad you wrote it on, the date and whether the message arrived. We do not keep the text of your comment.
  • Purpose: sending you the link you asked for, once, and knowing which posts and ads bring enquiries.
  • Legal basis: the controller’s legitimate interest in answering what you ask for and in measuring which content works (Art. 6.1.f GDPR). You can object at any time.
  • Retention: no fixed term, until you ask to be erased.
  • How to ask for erasure: email patricia@deilusionarecuerdo.com or send a private message to @ilusionrecuerdo. We remove you from this record, from the daily copy and from the contact manager, and you do not come back into them. Backups that already held you expire on their own within six months at most.
  • Processors: Meta Platforms Ireland Ltd. (Ireland, EU), which runs Instagram and its messages, and Supabase Pte. Ltd. (Singapore; data stored in Paris, EU), where the record is kept.

3. Processors and Providers

To provide the service, the owner works with the following providers, which may process your personal data as processors. Those marked “agency” only process data of travel agency clients:

  • Webempresa (Spain, EU) – website hosting.
  • Cloudflare Inc. (USA) – CDN, DNS, DDoS protection.
  • Sendinblue SAS / Brevo (France, EU) – newsletter and transactional email provider.
  • Google LLC (USA) – Google Analytics 4, Google Search Console, Gmail SMTP and Google Gemini API; and, for the agency, Google Workspace for the agency’s email.
  • Automattic Inc. (USA) – Akismet spam filtering.
  • Google Drive (Google LLC, USA) – encrypted website backup storage (UpdraftPlus).
  • Meta Platforms Ireland Ltd. (Ireland, EU) – Instagram and its private messages.
  • Supabase Pte. Ltd. (Singapore; data stored in Paris, EU) – database of the Instagram message record and, for the agency, of the trip management tool.
  • Gesintur Innovación y Gestión, S.L. (Spain, EU) – GIAV, booking files and invoicing. Agency.
  • Mogu Global, S.L. (Spain, EU) – proposal and trip pages the client sees. Agency.
  • Vercel Inc. (USA; functions run in Paris, EU) – hosting of the trip management tool. Agency.
  • Stripe Payments Europe, Ltd. (Ireland, EU) – card payment of the trip design fee. Agency.
  • Anthropic (USA) – sorting the agency’s incoming email with artificial intelligence. Agency.

4. Data Retention

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and to meet statutory retention obligations (tax records: 4 years; accounting: 6 years; claims: until the statutory limitation period expires). After these periods, data will be deleted or anonymised.

5. International Data Transfers

Some processors (Google, Cloudflare, Automattic and Vercel) are based in the United States. Supabase is based in Singapore, although it stores the data in Paris. Stripe may send payment data to Stripe, LLC, in the United States. Transfers are covered by the EU-US Data Privacy Framework approved by the European Commission in July 2023, and by Standard Contractual Clauses (SCCs) where applicable. Anthropic, in the United States, receives the agency emails it sorts with artificial intelligence.

6. Your Rights

  • Right of access: to obtain confirmation of whether we process your data and, if so, to receive a copy.
  • Right to rectification: to correct inaccurate or incomplete data.
  • Right to erasure: to request deletion of your data when it is no longer necessary.
  • Right to restriction of processing: to request that processing be limited in certain circumstances.
  • Right to object: to object to processing, particularly for profiling or direct marketing.
  • Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

7. How to Exercise Your Rights

You may exercise your rights by emailing patricia@deilusionarecuerdo.com, identifying yourself and specifying which right you wish to exercise. If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security Measures

The site owner has implemented the necessary technical and organisational measures to guarantee the security of personal data, including HTTPS encryption, two-factor authentication, encrypted backups, periodic malware scans, and a Web Application Firewall (WAF) at Cloudflare level.

9. Changes to this Privacy Policy

The site owner reserves the right to modify this Privacy Policy to adapt it to legislative or jurisprudential changes, or to changes in the services provided. Modifications will be published on this page with an updated date at the top.

Note: The Spanish version (Politica de Privacidad) is the authoritative version of this document.