Legal
Last updated: 21 March 2026
The data controller responsible for your personal data is:
If you have any questions about how we handle your data, contact us at orders@alhambra-booking.com.
We collect only the data necessary to fulfil your booking:
a) Booking & identity data
What: First name, last name, email address, ticket type, visit date, time slot, visitor count.
Why: To process your booking, secure tickets on your behalf, and deliver them to you.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
b) Payment data
What: Payment card details are collected and processed exclusively by Stripe, Inc. We never see or store your full card number, CVV, or expiry date. We only store the Stripe Payment Intent ID and the charged amount.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
c) Communication data
What: Emails you send us and our replies.
Why: To respond to your enquiries and resolve issues.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
After the retention period, data is securely deleted or anonymized.
We share only the minimum necessary data with the following third-party processors, each bound by a Data Processing Agreement:
We do not sell, rent, or trade your personal data with any third parties for marketing purposes.
Some of our processors (Stripe, Resend, Vercel) are based in the United States. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including:
You can request a copy of the relevant safeguards by emailing us at orders@alhambra-booking.com.
As a data subject under the GDPR, you have the following rights. To exercise any of them, contact us at orders@alhambra-booking.com — we will respond within 30 days.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish data protection authority:
We would, however, appreciate the chance to address your concern directly before you contact the AEPD — please email us first.
Our website uses only functional, session-based storage (via the browser'ssessionStorage) to carry your booking selection across steps. This data is never sent to a server and is cleared automatically when you close the browser tab.
We do not use advertising trackers, third-party analytics cookies, or any persistent cross-site tracking cookies.
We take appropriate technical and organizational measures to protect your data, including:
Our service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently done so, please contact us and we will delete the data promptly.
We may update this privacy policy from time to time. The date at the top of this page reflects the most recent revision. Where changes are material, we will notify you by email if we hold your contact details.