Privacy Policy

Updated: 1 October 2026

1. Introduction

Welcome to CanaryVIP.com. The protection of your personal data and your privacy are fundamental priorities for us. This Privacy Policy describes the categories of personal information we collect, the purposes for which we use it, how we share and store it, and the security measures we apply to keep it safe. All processing activities are carried out in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR).

2. Data Controller

Under the GDPR, the entity responsible for processing your personal data is the company that operates CanaryVIP:

TURIMEDIA SL, NIF B23873052, Calle El Sauce 9, Local 3, 38670 Adeje, Santa Cruz de Tenerife, Spain. Email: info@canaryvip.com.

3. Legal Basis for Processing

In accordance with Article 6 of the GDPR, CanaryVIP relies on the following legal grounds to process personal data:

3.1 Performance of a Contract (Art. 6.1.b)

We process personal data when it is necessary to fulfil a contract with you or to take steps at your request before entering into a contract. This covers:

Processing bookings and managing reservations.
Providing customer support in connection with booked services.
Handling cancellations, refunds, and itinerary changes.

Where required by law, we obtain your explicit consent before processing personal data. This applies in particular to:

Sending promotional emails, newsletters, or other marketing communications.
Collecting additional information through optional forms on our website.

You may withdraw your consent at any time without affecting the lawfulness of any processing carried out before the withdrawal.

3.3 Legal Obligation (Art. 6.1.c)

We may process personal data to comply with legal obligations binding on CanaryVIP, including:

Tax and financial regulations related to invoicing and transactions.
Consumer protection legislation.
Responding to lawful requests from public authorities or law enforcement bodies.

3.4 Legitimate Interest (Art. 6.1.f)

We may process data on the basis of our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include:

Improving our services through analytics and customer feedback.
Fraud prevention and cybersecurity.
Responding to general inquiries and customer service requests.

You have the right to object to processing based on legitimate interest at any time. To exercise this right, contact us at info@canaryvip.com.

4. Information We Collect and How We Use It

4.1 Categories of Personal Data

We may collect and process the following types of personal data:

Identity Data: Name, surname, date of birth.
Contact Data: Email address, phone number.
Booking Data: Excursion details, reservation information, and associated payments.
Communication Data: Emails, messages, and records of customer service interactions.
Contact Form Data: The name, email address, optional subject and message you send through our contact form.
Review Data: The name, optional email address, rating, written review and any photos you submit when you review an activity.
Transaction Data: Payment information processed securely through third-party payment providers.
Usage Data: With your consent, statistics about how you use the website, collected through analytics cookies (see our Cookie Policy).

4.2 Purposes of Processing

We use the personal data we collect for the following purposes:

Processing and managing bookings and reservations.
Providing customer support before, during, and after excursions.
Sending service-related communications (confirmations, reminders, updates).
Handling enquiries sent through the contact form, and publishing approved reviews.
Meeting legal and regulatory obligations.

4.3 Contact Form, Reviews and Hosting

When you use our contact form, the name, email, optional subject and message are stored in our database (Cloudflare D1) and emailed to our team (through SendGrid, a Twilio service) so that we can reply. We keep these messages only for as long as needed to handle your enquiry.

When you submit a review of an activity, your name, optional email, rating, review text and any photos are stored (in Cloudflare D1 and Cloudflare R2) and shown publicly only after our team has approved them. You can ask us to remove your review at any time.

Both forms are protected against spam by Cloudflare Turnstile, which may process technical data such as your IP address for that purpose. Our website and our booking platform (booking.canaryvip.com), including the booking platform's database, run on servers that we manage ourselves with Coolify, rented from Hetzner Online GmbH in Germany (EU). The contact form and review database, review photo storage and anti-spam service run on Cloudflare (D1, R2 and Turnstile). Payments on the booking platform are processed by Stripe and PayPal.

We share personal data only when strictly necessary and always in compliance with GDPR. Recipients may include:

Payment Processors: To process transactions securely (e.g., Stripe, PayPal).
Server Hosting: Hetzner Online GmbH, which provides the servers in Germany (EU) on which we run our website and our booking platform.
Database, Storage and Anti-spam: Cloudflare, which provides our database (D1), file storage (R2) and the Turnstile anti-spam service.
Email Delivery: SendGrid (a Twilio service), to deliver contact form messages to our team.
Analytics: Google, for Google Analytics. It loads under Google Consent Mode with all storage set to "denied" by default, so it stores no analytics or advertising cookies on your device until you accept analytics cookies. The Meta Pixel is not loaded at all until you accept.
Regulatory Authorities: When disclosure is required by law.
Service Providers: For fraud prevention, security, and operational support.

For information about data shared through cookies and tracking technologies, please refer to our Cookie Policy.

5.2 International Data Transfers

In order to deliver our services, CanaryVIP may share personal data with third-party providers located outside the European Economic Area (EEA). When this occurs, we ensure compliance with Articles 44 to 50 of the GDPR through appropriate legal safeguards:

For providers not covered by the DPF, such as Stripe and PayPal, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to guarantee an adequate level of data protection.

If you have questions about international data transfers, please contact us at info@canaryvip.com.

5.3 How Long We Keep Your Data

Personal data is retained only for as long as necessary to fulfil the purposes described in this policy.
Booking records are kept for a minimum of 5 years to comply with legal and tax obligations.
You may request deletion of your data at any time, subject to any legal retention requirements that may apply.

6. Data Security

We apply technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include:

SSL/TLS encryption: All data transmitted through our website is encrypted in transit.
Access controls: Only authorized personnel with a legitimate need can access sensitive data.
Data minimization: We collect and store only the personal data that is strictly necessary.

The General Data Protection Regulation grants you the following rights over your personal data:

Right of access: You may request confirmation of whether we process your data and obtain a copy of it.
Right to rectification: You may request correction of any inaccurate or incomplete data we hold about you.
Right to erasure: You may ask us to delete your personal data, subject to applicable legal retention obligations.
Right to restriction: You may request that we limit how we process your data in certain circumstances.
Right to object: You may object to processing carried out on the basis of legitimate interest.
Right to data portability: You may request a copy of your data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, contact us at info@canaryvip.com.

8. The CanaryVIP Mobile App

This section applies to the CanaryVIP app for iOS and Android. Everything else in this policy applies to the app as well, with the details below.

8.1 No Account

The app has no customer accounts, no sign-up and no password. A booking is identified by its reference and the email address it was made with.

8.2 What Stays on Your Device

The app keeps the following only on your phone, in the app's private storage:

Your bookings: the reference and email address of each booking you make or add in the app, together with the latest booking details received from our booking platform, so that your ticket opens without an internet connection.
Saved experiences and your chosen island.
A copy of our catalogue, so the app works offline.

We do not receive this information from your device. Saved experiences are not synchronised to any server.

8.3 What the App Sends

Catalogue: the app downloads activity descriptions, photos and prices from canaryvip.com. These requests contain no personal data, although, like any internet request, they reveal your IP address to our servers.
Bookings: when you book, the details you enter (name, email address, phone number, the information the activity asks for, such as a pickup location, and your choice about marketing emails) are sent to our booking platform, booking.canaryvip.com, and processed as described in this policy.
Finding a booking: when you add a booking, the app sends its reference and email address to our booking platform to retrieve it.
My bookings: if you use it, the app sends the email address you type to our booking platform, which emails you a one-time 6-digit code. After you enter the code, the app receives a session token, which it stores in your device's secure storage (the iOS Keychain or the Android Keystore). The session expires after 24 hours without use, and in any case 7 days after you entered the code. Signing out of My bookings ends the session and deletes the token from your device.

8.4 Payments

Card payments in the app are handled by Stripe's payment form. Your card details go directly to Stripe and are never stored by the app or by us. The camera is used only if you choose to scan your card to fill in its details.

8.5 Trip Reminders

If you allow notifications, the app schedules reminders about your upcoming trips on your device itself. We do not run a push notification server, and the app does not send us any device or notification token.

8.6 No Tracking

Optional usage and error reports sent to TURIMEDIA SL. No names, emails, phone numbers, documents or payment details. No advertising. You can turn this off at any time.

This setting is off initially. Reports contain technical screen and activity identifiers, allowed error codes, app/build version and response times. Session identifiers rotate when the app restarts and are not linked to bookings. Reports are deleted after 30 days. The app does not use advertising identifiers, track you across other apps or websites, or access your location.

8.7 Deleting Your Data

You can remove local tickets and pending purchases, sign out and cancel reminders under Data and privacy in the app. This does not cancel your bookings.

Uninstalling the app deletes everything it stored on your device. To request access to, or deletion of, the booking data held by our booking platform, write to info@canaryvip.com, subject to the legal retention periods described in section 5.3.

9. Changes to This Policy

By using our services, you consent to the collection and use of your personal data as described in this policy.

CanaryVIP reserves the right to update this Privacy Policy at any time. Any changes will be published on this page. We encourage you to review this policy periodically to stay informed.

This Privacy Policy does not cover the use of cookies or tracking technologies. Please refer to our Cookie Policy for details on those topics.

10. Contact

If you have any questions about this Privacy Policy or about how we handle your personal data, you can reach us at:

Email: info@canaryvip.com

Website: www.canaryvip.com