Privacy and cookies

Basic data protection information

Controller	Costa Oeste Online S.L. · Tax ID B44553006 · Plaza San Mauro 23 Bajo, 36213 Vigo (Pontevedra), España · info@xtadia.com
Data	Email and search (destination and dates) if you provide them in the search tool; IP address and technical browsing data; usage statistics if you accept analytics cookies.
Purposes	Sending you your search results and travel offers; preventing fraud and abuse (usage limits of the AI assistant); measuring and improving the website. The searches and questions you type on the website and in the assistant are stored pseudonymised (without your IP or email) to understand what travellers look for and improve the service. What you do about a destination (questions, guides, hotels viewed and price searches) is stored with an anonymous identifier in a technical cookie to show you your “Your trip” dashboard; you can delete it from that dashboard.
Legal basis	Your consent (email and analytics cookies), which you can withdraw at any time; legitimate interest in the security of the service.
Recipients	Service providers: web hosting and email delivery (own server in the EU), the group's email marketing platform (traveleto.com), Google Analytics (Google Ireland Ltd.) if you accept cookies. Questions you type into the assistant are sent to DeepSeek without personal data to generate the answer. We do not sell your data.
Retention	Email: until you unsubscribe. IP and technical logs: up to 12 months.
Your rights	Access, rectification, erasure, objection, restriction and portability by writing to info@xtadia.com. You may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local authority.

Cookies

We use technical local storage (language preferences, last search, cookie choice) and, only if you accept, Google Analytics cookies. You can change your choice at any time via "Cookie settings" in the footer.

This Privacy Policy describes the policies and procedures of Xtadia.com. Xtadia.com (“Xtadia”) is an Spanish company, based in Pontevedra. Xtadia (“we”, “our” or “us”) on the collection, use and disclosure of your information on Xtadia.com (the “Site”) and the services, features, content or applications we offer (collectively with the Site, the “Services”). We receive information about you from various sources, including: (i) if you register for the Site and the Services, through your user account on the Services (your “Account”); (ii) your use of the Services generally; and (iii) from third party websites and services. When you use the Services, you are consenting to the collection, transfer, manipulation, storage, disclosure and other uses of your information as described in this Privacy Policy.

When you use our services, you’re trusting us with your personal data. We understand this is a big responsibility, so we work hard to protect your personal data and put you in control. This Privacy Policy will help you understand what information we collect, why we collect it, and how you can manage your information.

What Does This Privacy Policy Cover?

This Privacy Policy covers the treatment of personally identifiable information (“Personal Information”), and other information described in this policy, gathered when you are using or accessing the Services. This Privacy Policy also covers our treatment of any Personal Information that our business partners share with us or that we share with our business partners.

This Privacy Policy does not apply to the practices of third parties that we do not own or control, including but not limited to any third party websites, services and applications, such as Facebook (“Third Party Services”) that you elect to access through the Service or to individuals that we do not manage or employ. While we attempt to facilitate access only to those Third Party Services that share our respect for your privacy, we cannot take responsibility for the content, privacy policies, or practices of those Third Party Services. We encourage you to carefully review the privacy policies of any Third Party Services you access.

If you are a resident of the European Union (“EU”), the European Economic Area (“EEA”), or Switzerland, processing of your personal data will always be in line with the General Data Protection Regulation (GDPR).

Xtadia is the Controller of this Site, as defined in the GDPR. All personal data collected by the Site is stored exclusively in secure hosting facilities in the US. Xtadia has data processing agreements in place with our hosting facilities, ensuring compliance with GDPR. Please see our Terms of Service for details. All hosting is performed in accordance with the highest security regulations.

What Information Do We Collect?

The information we gather enables us to personalize, improve and continue to operate the Services. In connection with certain aspects of the Services, we may request, collect, use, share, and/or display some of your Personal Information. We collect the following types of information from our users.

User Content:

Some features of the Services allow you to provide content to the Services, such as written comments. All content submitted by you to the Services may be retained by us indefinitely, even after you terminate your account. We may continue to disclose such content to third parties, as described in this Privacy Policy.

Information Collected Automatically:

We automatically receive and record information from your device or web browser when you interact with the Services. This information may include, your IP address, an ID that we may create and associate with our content, cookie information, and other details. This information is used for fighting spam/malware, to facilitate collection of data concerning your interaction with the Services (e.g., what links you have clicked on and shared with others, including via email and social media), and to otherwise personalize, improve and continue to operate the Services.

We collect information about your device in order to adapt our website to be displayed best on your type of device – smartphone, tablet, laptop or desktop.

Generally, the Services automatically collect usage information, such as the number and frequency of visitors to the Site or mobile application. We may use this data in aggregate form, that is, as a statistical measure. This type of aggregate data enables us and third parties authorized by us to figure out how often individuals use parts of the Services so that we can analyze and improve them.

When you visit the Site, we may also collect information about your online activities over time and across third-party websites or online services. Because there is not yet a consensus on how companies should respond to web browser-based or other do-not-track (“DNT”) mechanisms, we do not respond to web browser-based DNT signals at this time.

Location Data:

Some of our Services, such as mobile applications, may collect geo-location data to provide location-related functionality. We may link location data to other information we have collected about you. You may stop sharing your location data by adjusting your mobile device’s location services settings. For instruction on changing the relevant settings, please contact your service provider or device manufacturer.

Email Communications:

We may receive a confirmation when you open an email from us. We use this confirmation to improve our Services, including customer service.

Information Collected Using Cookies:

Cookies are pieces of text that may be provided to your computer through your web browser when you access a website. Your browser stores cookies in a manner associated with each website you visit. We use cookies to enable our servers to recognize your web browser and tell us how and when you visit the Site, share our content, and otherwise use the Services through the Internet.

We may use cookies and other automated data collection means to identify that your web browser has accessed aspects of the Services and may associate that information with your Account if you have one, the device you use to connect to the Services, or email or social media accounts that you use to share our content.

Most browsers have an option for turning off the cookie feature, which will prevent your browser from accepting new cookies, as well as (depending on the sophistication of your browser software) allowing you to decide on acceptance of each new cookie in a variety of ways. We strongly recommend that you leave cookies active, because they enable you to take advantage the most attractive features of the Services.

This Privacy Policy covers our use of cookies only and does not cover the use of cookies by third parties. We do not control when or how third parties place cookies on your computer. For example, third party websites to which a link points may set cookies on your computer.

Information Related to Advertising and the Use of Web Beacons:

To support and enhance the Services, we may serve advertisements, and also allow third parties advertisements, through the Services. These advertisements are sometimes targeted and served to particular users and may come from third party companies called “ad networks.” Ad networks include third party ad servers, ad agencies, ad technology vendors and research firms. We may engage with ad networks that are members or organizations or programs that manage the advertising privacy choices these ad networks offer consumers.

When you visit our Site or use our mobile applications or other Services, ad networks and other parties may collect information about your online activities over time and across different websites. We are not responsible for the privacy practices of these ad networks and other parties.

Advertisements served through the Services may be targeted to users who fit a certain general profile category may be inferred from information provided to us by a user, may be based on the Services usage patterns of particular users, or may be based on your activity on Third Party Services. We do not provide Personal Information to any ad networks for use other than in connection with the Services.

To increase the effectiveness of ad delivery, we may deliver a file (known as a “web beacon”) from an ad network to you through the Services. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Because your web browser must request these advertisements and web beacons from the ad network’s servers, these companies can view, edit or set their own cookies, just as if you had requested a web page from their site.

Advertising Audience Generation:

Advertising platforms such as Facebook and Google have the concept of an audience, which is a group of people that come to a website over a period of time. Xtadia can utilize audiences in various ways – to have the advertising platforms find people that are similar to the members of an audience, to show the members of an audience additional advertisements, to exclude members of an audience from additional advertisements, etc. Xtadia has a legitimate interest in these systems, since advertising would not be financially feasible without utilizing audience mechanisms. But we understand if you do not wish to participate. You can opt-out of being part of an audience by utilizing opt-out mechanisms provided by Facebook and Google respectively. Advertising Audience Generation data is kept for up to 180 days.

Behavioral Tracking:

Xtadia makes use of third-party behavioral tracking systems such as Google Analytics and Visual Website Optimizer. These systems allow us to observe how people use our websites and enable us to improve how they operate. We also use these systems to perform A/B testing of new features and site improvements. Anonymous Behavioral Tracking data is kept for up to 14 months.

Aggregate Information:

We collect statistical information about how both unregistered and registered users, collectively, use the Services (“Aggregate Information”). Some of this information is derived from Personal Information.

How, and With Whom, Is My Information Shared?

The Services are designed to help you share information with others. As a result, some of the information generated through the Services is shared publicly or with third parties.

Public Information about Your Activity on the Services:

Some of your activity on and through the Services is public by default. This may include, but is not limited to, content you have posted or shared publicly on the Site or otherwise through the Services, such as written posts, comments, or other submissions by you to the Site.

Information concerning the use of the Services (such as what pages they have visited) by unregistered users may be tracked through the use of cookies and other automated data collection means, and stored by us.

Please also remember that by choosing to provide Personal Information using certain public features of the Services, you make your information publicly available. User reading such information may use or disclose it to other individuals or entities without our control and without your knowledge, and search engines may index that information. We therefore urge you to think carefully about including any specific information you may deem private in content that you create or information that you submit through the Services.

IP Address Information:

While we collect and store IP address information, that information is not made public. We do at times, however, share this information with our partners, service providers and other entities with whom we conduct business, and as otherwise specified in this Privacy Policy.

Information You Elect to Share:

You may access other Third Party Services through the Services, for example by clicking on links to those Third Party Services from within the Site. We are not responsible for the privacy policies and practices of these Third Party Services, and you are responsible for reading and understanding those Third Party Services’ privacy policies. This Privacy Policy only governs information we collect in connection with the Services.

Aggregate Information:

We share Aggregate Information with our partners, service providers and other persons with whom we conduct business. We share this type of statistical data so that our partners can understand how and how often people use our Services and their services or websites, which facilitates improving both their services and how our Services interface with them. In addition, these third parties may share with us information about you that they have independently developed or acquired.

Email Communications with Us:

As part of the Services, you may occasionally receive email and other communications from us, such as communications relating to your Account. Communications relating to your Account will be sent for purposes important to the Services, such as password recovery. We may use your email address to contact you for editorial purposes, to advise you of any changes to our Site, and to send you messages about our marketing partners’ products. You may choose not to receive our marketing emails by clicking on the unsubscribe link in the emails you receive from us. Please note that even if you opt out, we may continue sending you service-related information.

Information Shared with Our Service Providers:

We employ and contract with service providers – individuals and entities that perform certain tasks on our behalf. We may need to share Personal Information with our service providers in order to provide products or services to you. We do not authorize our service providers to use Personal Information or other information we share with them beyond what is necessary to assist us.

Information Disclosed Pursuant to Business Transfers:

In some cases, we may choose to buy or sell assets. In these types of transactions, user information, including Personal Information, is typically one of the transferred business assets. Moreover, if we, or substantially all of our assets, were acquired, or if we go out of business or enter bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur. Following the transfer of user information in the circumstances described in this paragraph, all inquiries concerning the processing of user information should be directed to the entity to which the information is transferred.

Information Disclosed for Our Protection and the Protection of Others:

We also reserve the right to access, read, preserve, and disclose any information as it reasonably believes is necessary to (i) satisfy any applicable law, regulation, legal process or governmental request, (ii) enforce our Terms of Service, including investigation of potential violations hereof, (iii) detect, prevent, or otherwise address fraud, security or technical issues, (iv) respond to user support requests, or (v) protect our rights, property or safety, our users and the public. This includes exchanging information with other companies and organizations for fraud protection and spam/malware prevention.

Your Rights under the GDPR:

Here is a list of the rights that all residents of the European Economic Area have under the GDPR. They don’t apply in all circumstances — if you wish to use any of them, we’ll explain at that time if they are engaged or not.

• The right to be informed about the processing of your personal information;
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
• The right to object to processing of your personal information;
• The right to restrict processing of your personal information;
• The right to have your personal information erased (the “right to be forgotten”);
• The right to request access to your personal information and to obtain information about how we process it;
• The right to move, copy or transfer your personal information (“data portability”);
• Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you;
• You have the right to complain to the Data Protection Supervisory Authority which enforces data protection laws in your country;
• You have the right to object to certain purposes for processing, in particular to data processed for direct marketing purposes and to data processed for certain reasons based on our legitimate interests.

With respect to Xtadia and matters relating to privacy and data protection, we can be reached via email at info@Xtadia.com, or at the following address:

Attn: Privacy Matters

Costa Oeste Online S.L.
Plaza San Mauro 23 Bajo
36213, VIGO - PONTEVEDRA
SPAIN

Please email us if you would like your personal data deleted.

You can also contact our Data Protection Officer by sending us an email with a subject line of “DPO Contact Request”.

What Happens When There Are Changes to this Privacy Policy?

We may amend this Privacy Policy from time to time. Use of information we collect now is subject to the Privacy Policy in effect at the time such information is used. If we make changes in the way we collect or use information, we will notify you by posting an announcement on the Services or sending you an email. A user is bound by any changes to the Privacy Policy when he or she uses the Services after such changes have been first posted.

Effective Date of this Privacy Policy

This Privacy Policy is effective as of July 13, 2019 and last updated Jul 13, 2019.