Privacy policy

Who is responsible for your data?

Tapas Tour Barcelona is operated by GOLASHA EXPERIENCE, S.L., the data controller for personal data processed through this website and while providing our tours. In this policy, “we”, “us” and “our” mean this company.

Registered address: Carrer Güell i Ferrer, 94–100, planta 2, Badalona, Barcelona, Spain.

Privacy enquiries and data-rights requests can be sent to info@tapastourbarcelona.com or by WhatsApp/telephone on +34 690 036 640.

Information we process

• Booking information: name, email address, phone number, selected tour, date, participant details, booking reference, payment status and information you add to the booking.
• Messages: your name, phone number and anything you include when you contact us through WhatsApp, email or telephone.
• Dietary and accessibility information: only when you choose to provide it so we can assess whether a tour or venue can meet your needs. This may reveal health or belief-related information.
• Technical information: IP address, browser, device, referring page, requested pages, timestamps and security logs generated when you use the website or booking service.
• Optional measurement information: page visits, advertising interactions and, where used by the service you allow, advertising identifiers for website measurement or personalised advertising, only for the category you accept in our cookie settings.

We do not offer customer accounts on this website and we do not intentionally collect information that is unrelated to choosing, booking or receiving our services.

How and why we use information

To provide a booking or answer a request

We process booking and contact information to take steps at your request and perform our contract with you. This includes checking availability, taking or confirming a booking, delivering the tour, handling changes and providing customer support.

To meet legal obligations

We retain transaction and booking records where required for tax, accounting, consumer-protection, safety or dispute-handling obligations.

For legitimate business interests

We may use limited information to secure the website, prevent fraud, manage complaints and improve our operations, provided those interests are not overridden by your rights.

With your consent

Optional website analytics, Google advertising measurement and personalised advertising run only after you allow the relevant cookie category. When configured, Google Tag Manager delivers only tags covered by your choices. We also rely on your consent when you voluntarily provide sensitive dietary, health or accessibility details. You can withdraw consent at any time without affecting earlier lawful processing.

Booking and payments

Bókun provides live availability and manages tour reservations. Our on-site checkout sends booking and contact information to Bókun and uses Stripe to process payments and, when selected, save a card for payment later. Card details go directly to Stripe; we do not receive your complete card number.

We use a private HttpOnly cookie and a receipt in your browser tab to verify and recover checkout and avoid duplicate payment attempts. These support the booking service you request. Read the Bókun privacy policy.

Contacting us through WhatsApp

The contact form on this website creates a pre-filled WhatsApp message in your browser. It is not submitted to our website server. If you continue in WhatsApp, the message, your phone number and related metadata are processed by WhatsApp and become available to our team so we can reply.

Your use of WhatsApp is also governed by the WhatsApp privacy policy. You can contact us by email instead if you prefer.

Google Maps meeting points

Tour pages show the meeting-point address without contacting Google. An interactive Google Map loads only after you choose the load-map button, or you can follow the external Google Maps link. When you do, Google receives technical information such as your IP address, browser and device details and may use cookies or similar technologies under its own terms.

Read the Google privacy policy.

Analytics, advertising and cookies

• Necessary: stores your privacy choice and supports booking, payment, security and checkout recovery functions. These cannot be disabled through our banner because the requested service cannot operate without them.
• Improve the site: Simple Analytics measures page use after permission. When configured, Google Analytics also measures consented visits, confirmed bookings, verified payments and refunds.
• Advertising measurement: loads Google Ads tags only after marketing permission, for advertising measurement and personalised advertising. Google Tag Manager, if configured, follows the separate categories you allow.

With analytics permission, our server sends Google Analytics a pseudonymous client identifier, an opaque booking or transaction identifier, the tour item, verified value and currency, and confirmation, payment or refund time. We report a confirmed booking once whether you pay now or later. Its value is the full booking total, not necessarily money collected; a paid purchase is reported only after payment collection. We do not include your name, email address, phone number or card details. No optional analytics tag loads on private checkout pages. Separate advertising permission controls advertising use. On public pages, analytics permission also allows a limited landing-page path, the referring website’s origin, campaign source, medium and name, and an existing Google session identifier. Advertising click identifiers require advertising permission. This consent-bound tab record expires after 30 minutes.

Withdrawing advertising permission also stops future advertising use of queued reports while analytics reports may continue if you still allow analytics. A new opt-in does not expand permission for earlier booking records. Withdrawal takes effect when our service receives the update; it cannot recall a report already being transmitted.

We check the consent record again before queued reporting is sent. Withdrawing analytics permission stops future unsent measurement when the preference update reaches our service; temporary network failures are retried. Withdrawal does not remove reports already lawfully sent or change records needed to deliver, secure or account for your booking.

We store your choice in your browser for up to 12 months. See the cookie policy for further details.

Who receives information?

We share information only when it is necessary with:

• Bókun and Stripe for availability, reservations, payments and selected saved-card services;
• guides, venues and tour partners who need details to deliver the booked experience;
• WhatsApp/Meta when you choose to use WhatsApp;
• Simple Analytics and Google for the optional category or interactive map you choose;
• Vercel for website hosting, Resend for booking and service emails, and database, security and professional service providers acting under appropriate obligations; and
• public authorities where disclosure is legally required.

We do not sell personal data.

International transfers

Some service providers may process information outside the European Economic Area. Where required, the relevant provider and we rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Provider privacy notices explain their specific locations and safeguards.

How long we keep information

• Booking and transaction records: generally up to six years where required for accounting or claims.
• Unbooked enquiries: generally no longer than 24 months after the last meaningful contact.
• Operational WhatsApp messages: for as long as needed to answer or manage the related booking.
• Cookie choices: up to 12 months, unless you change them sooner.

We may retain information longer where a complaint, legal claim or statutory obligation requires it, and delete or anonymise it when it is no longer needed.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. Contact us using the details above. We may need to verify your identity before completing a request.

You also have the right to complain to the Spanish Data Protection Agency (AEPD), or the supervisory authority where you live or work.

Children and alcohol

We do not knowingly collect children’s information through this website without an appropriate legal basis or required parental authorisation. Alcohol is served only to guests aged 18 or over; identification may be requested. Tour-specific age and accompaniment requirements are shown during booking.

Security and policy changes

We use proportionate technical and organisational measures to protect information, but no internet service is completely risk-free. We may update this policy when our services, providers or legal obligations change. The latest version and effective date will always appear on this page.