Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

We collect the following types of personal data:

• Email address and name when creating an account
• Language and navigation preferences
• Anonymous usage data through analytics cookies (with your consent)
• Photographs you voluntarily upload of your experiences

3. Purpose of Processing

We use your data for the following purposes:

• Manage your user account and saved experiences
• Improve our services and content
• Send relevant communications (only with your prior consent)
• Analyze platform usage in an aggregated and anonymous manner

4. Legal Basis for Processing

The legal basis for processing your data is:

• Consent: for account creation, sending communications, and non-essential cookies
• Contract performance: for providing the service requested by the user
• Legitimate interest: for platform improvement and security

5. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Request deletion of your data (right to be forgotten)
• Request portability of your data to another provider
• Object to processing or request its restriction
• Withdraw your consent at any time

To exercise these rights, contact us at info@letsjaleo.com. We will respond within a maximum of 30 days.

If you believe your rights have not been properly addressed, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

6. Third Parties and International Transfers

We share data with the following third parties, exclusively for the purposes indicated:

• Amazon Web Services (AWS) — Hosting and infrastructure. Data may be processed in data centers located in the EU (Ireland). AWS complies with EU Standard Contractual Clauses.
• Amazon Cognito — User authentication service. Credential data is processed in the eu-west-1 region (Ireland).
• Affiliate partners (Civitatis, TheFork, GetYourGuide, DiscoverCars) — We do not share data directly; users access their services through redirect links.
• Google AdSense: advertising service by Google LLC that may set cookies to display personalised ads. Only activated with your explicit consent.

7. Data Retention

We retain your personal data for the following periods:

• Account data: as long as the account is active. You can request deletion at any time.
• Uploaded photographs: as long as the account is active or until the user deletes them.
• Analytics cookies: maximum 13 months from installation.
• Data derived from legal obligations: for the legally established period.

8. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (HTTPS/TLS), restricted data access, and secure storage on AWS certified infrastructure.