Privacy policy

This Privacy Policy explains how Elyxta ("we", "us", "our") collects, uses and protects your personal data when you use this website and contact us about water-sports experiences. We are the data controller for the personal data described here.

1. Who we are and how to contact us

Elyxta operates this marketplace, which connects travellers with independent, licensed local operators. For any privacy question, or to exercise your rights, contact us at hello@elyxta.io.

2. What data we collect

• Details you provide: your name, email address and the content of any message or booking enquiry you send through our contact form, WhatsApp or partner platforms.
• Booking information: the experience, date, group size and preferences you share so that an operator can respond to you.
• Technical and usage data: IP address, device and browser type, and the pages you view, collected through cookies and similar technologies.
• Analytics data: aggregated, privacy-friendly statistics about how the site is used — only if you accept analytics cookies.

3. Why we use your data, and our legal basis

We process your data to respond to your enquiries and put you in touch with the relevant operator (to take steps at your request before entering into a contract — GDPR Article 6(1)(b)); to operate, secure and improve the website (our legitimate interests — Article 6(1)(f)); to send you updates or marketing where you have specifically asked us to (your consent — Article 6(1)(a)); and to comply with our legal obligations (Article 6(1)(c)). Where we rely on consent, you can withdraw it at any time.

4. Who we share your data with

We share your enquiry and booking details only with the independent operator needed to fulfil your request. We also use trusted service providers — for example website hosting, messaging and analytics — who process data on our behalf under written agreements. We never sell your personal data. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

5. How long we keep your data

We keep enquiry and booking correspondence only for as long as needed to handle your request, and for a reasonable period afterwards to answer follow-up questions and to meet legal, tax and accounting obligations. After that it is deleted or anonymised.

6. Your rights

Under the GDPR you have the right to access your data and to have it corrected or deleted; to restrict or object to its processing; to data portability; and to withdraw consent at any time. To exercise any of these rights, email hello@elyxta.io. You also have the right to lodge a complaint with your local data protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es); in Germany, your competent regional authority; or the supervisory authority in your country of residence.

7. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You control non-essential cookies through the consent banner shown on your first visit.

8. How we protect your data

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, but we work continuously to safeguard your information.

9. Children

This website is not directed at children under 16, and we do not knowingly collect their data. Bookings that involve minors are made by a responsible adult.

10. Changes to this policy

We may update this policy from time to time. The date shown above indicates when it was last revised, and any material change will be highlighted on this page.