Privacy policy
Xacobea privacy policy: what data our forms collect, what we use it for, how long we keep it and how to exercise your rights.
My Camino and your location
The stages you log, GPS tracks and GPX files stay on your phone only. They never reach us and we don’t store them.
What we collect
Only what you type in the forms: email, route, dates, people and, for accommodations, name and phone. We set no tracking cookies; the referral cookie below is only stored if you accept it. If you share the guide, your link carries a code we only use to send you the extra when someone signs up with it.
Why
Quotes: your details go to the partner agency for the chosen route and language, only if you tick the box. Listings: to contact you.
Tips and offers by email
Only if you tick the optional box (never pre-ticked) or join the Community. We send useful tips to prepare your Camino, Holy Year news and, now and then, offers; businesses get ideas to win more bookings. At most about 2 a month. Every email has an unsubscribe link. We rely on your consent (GDPR art. 6(1)(a)). We record the date, form, language and exact wording you accepted, and keep your details until you unsubscribe. If you are already a customer (business signed up, confirmed booking or contracted trip), we may email you about similar Xacobea services without that box (Spanish LSSI art. 21.2); you can object when giving your details and in every email.
How long and your rights
Quote contacts are kept 12 months. Request access, correction or deletion at hello@xacobea.com. Controller: Xacobea. Legal basis: consent (GDPR art. 6(1)(a)).
Lodging bookings
Access links to the business panel are only sent to the booking email registered for each property. If you request a booking via the booking request form, we use your name, email, phone, dates, guests and message only to handle that request: we send them to the chosen property (and, if you tick the alternative box, to the featured property you accept) so they can reply, and we keep you posted. The booking is a contract between you and the property; Xacobea takes no payments. Legal basis: your request and your consent. We keep the request for 12 months and then delete it. Processors: our web hosting and email provider in the EU. One day after your stay we ask whether you stayed there, to improve our recommendations.
Verified reviews
Only people with a booking confirmed through Xacobea or an organised trip closed with us can review: the day after, we send a personal, single-use link (valid for 60 days). We publish your first name, country, month of travel, ratings and text, only with your consent, and nothing else. We check every review before publishing it and only remove personal data, never your words. The property can reply once. Reviews cannot be bought or removed by paying, featured properties included. We keep them while they are published; ask us to delete yours at hello@xacobea.com. Legal basis: your consent.
Businesses and affiliates
If you list a business, we use its details and photos to publish the listing and charge the fee; if you join as an affiliate, to run the program and pay you. We keep them while the relationship lasts and as long as tax law requires.
Referral cookie
If you arrive through an affiliate link (?ref=), we ask whether we may remember that code for 90 days. Only if you accept do we store it in a first-party cookie (xacobea_ref) and in your browser storage, to know who recommended us if you request an organized trip. If you reject or don’t answer, we store nothing: the code only travels with your visit in the site’s own links and in the form. We keep your answer (xacobea_ref_consent, up to 24 months) so we don’t ask again. It holds no personal data and is not shared with third parties. You can withdraw consent at any time by deleting xacobea.com’s cookies and site data in your browser. Legal basis: your consent (Spanish LSSI art. 22.2, ePrivacy Directive art. 5(3)).
Third-party services
Some parts of the site make your browser connect to these services, which receive your IP address and technical browser data. Legal basis: legitimate interest in showing photos, maps and the weather (GDPR art. 6.1.f). We never send them what you type in our forms.
Lodging photos (Google Maps Platform)
Some listings show live photos and details from Google Places, with their attribution. When they load, your browser connects to Google (Google Ireland Ltd.; data may be transferred to the US under standard contractual clauses and the EU-US Data Privacy Framework). Policy: policies.google.com/privacy.
Maps (OpenStreetMap and OpenFreeMap)
Map backgrounds load from OpenFreeMap and, as a fallback, from OpenStreetMap servers. They only receive the request for the map tiles you see. Data © OpenStreetMap contributors (ODbL).
Weather (Open-Meteo)
The forecast for each stage is requested from Open-Meteo with the stage coordinates, never your location.
Our own statistics
We count visits and clicks with our own tool, with no cookies or identifiers: we store the page, language, device type and referring site. It is not shared with anyone. Legal basis: legitimate interest (GDPR art. 6.1.f).
How we measure the site
We count visits, clicks and how far down each page people scroll with our own measurement, without cookies or identifiers. We store the page, the screen type (mobile or desktop), where each click lands and which element was clicked; never what you type in the forms. Your IP address is only used for a moment to stop abuse and is not stored. Detailed data is deleted after 13 months. Legal basis: legitimate interest in improving the site (GDPR art. 6(1)(f)).
