Privacy Policy

This policy explains how we process the personal data you provide through the By Lifestyle Group website, its forms and communications relating to your travel and experience requests.

Controller and contact
Data controller: By Lifestyle Group, S.L. Spanish tax identification number: B72563455. Address: Calle Alcalde Alonso Patallo 1, 35600 Puerto del Rosario, Las Palmas, Spain. Privacy and data rights contact: info@bylifestylegroup.com.

Data we process
We process the identification and contact details you provide, the contents of your enquiry, dates, destinations, traveller numbers and preferences needed to prepare proposals for tailor-made travel, Private Aviation, Yacht Charter and Horizon. When you book, we may request the traveller, booking, billing and payment details necessary to provide the service.
Browsing may generate technical data such as your IP address and access or incident logs. Mandatory fields are identified on each form. Without that information, we may be unable to handle your request. Do not send identity documents, full payment card details or medical information through free-text fields.
If you provide information about other people, you must be entitled to do so and inform them of this policy. If a service requires health information, for example to arrange a specific adjustment, an appropriate channel will be provided and explicit consent requested where required.

Purposes and legal bases
Enquiries and proposals. We answer requests and prepare quotes or bookings at your request as steps before entering into a contract (GDPR Article 6(1)(b)). General enquiries unrelated to a potential contract are handled on the basis of our legitimate interest in responding to people who contact us (Article 6(1)(f)).
Contracts and legal duties. We manage booked services and related communications to perform the contract (Article 6(1)(b)). We comply with applicable tax, accounting and sector-specific duties on the basis of Article 6(1)(c).
Security. We process only the information needed to protect the website, prevent misuse and address incidents, on the basis of our legitimate interest in keeping our services secure (Article 6(1)(f)). You may object under the conditions set out in the GDPR.
Marketing. If you ask to receive news or offers and give separate consent, we will use your details for that purpose (Article 6(1)(a)). Subscribing is optional. You may unsubscribe through each message or by contacting us.

Who receives your data
Providers of web hosting, maintenance, email, enquiry management and booking services may access data subject to the appropriate contractual data protection terms. Data may also be disclosed to payment providers, professional advisers and authorities where necessary to provide the service or comply with a legal duty.
To prepare or provide services you request, we may share necessary information with hotels, transport providers, private aviation operators, yacht charter businesses and other providers involved in your request. We will identify the specific providers and their roles before the relevant disclosure. If you visit a hotel website or booking engine, please also read the privacy information of the controller identified there.
We will not sell your data. Membership of the same business group does not in itself authorise another entity to use your information for advertising or unrelated purposes.

International transfers
If you request travel or an experience outside the European Economic Area, we may need to share information with providers at the destination. Before doing so, information about the recipient, country and applicable legal mechanism will be provided.
Transfers must rely on an adequacy decision or appropriate safeguards, such as standard contractual clauses, as applicable. GDPR Article 49 exceptions may only be used where their conditions are met. You may ask for information about international recipients and a copy of the applicable safeguards using our privacy contact address.

How long we keep data
We retain enquiries for as long as necessary to answer and follow up on the request. If you enter into a contract, we retain the relevant data during the contractual relationship and afterwards for the statutory retention periods and limitation periods applicable to each type of record.
Data used for marketing communications is retained until you withdraw consent or unsubscribe. Security logs are retained only as long as necessary to detect and resolve incidents. Where required by Spanish law, data is restricted and retained solely to address potential liabilities, then deleted when the applicable periods expire.

Your rights
You may request access to, rectification or erasure of your data, restriction of processing, data portability and the right to object where applicable. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
To exercise your rights, contact the controller using the email or postal address above and explain which right you wish to exercise. We will request further identity information only if there are reasonable doubts about your identity. We will normally respond within one month. If a lawful extension is necessary, we will tell you why and how long it will take.
You may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es, without first having to complain to us.

Automated decisions
Enquiries and quote requests will be handled with involvement from our team. Data from these enquiries will not be used to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Cookies and linked services
Cookies and similar technologies are explained in the website’s Cookie Policy and settings panel. Cookies requiring consent may only be used after that consent has been obtained, and you may change your choices. Sending an enquiry does not mean agreeing to optional cookies or subscribing to marketing.

Updates
We may update this policy to reflect changes to our services or data processing. If a change requires further information or fresh consent, we will provide it before starting the relevant processing.