AlanSpeak Travel

Privacy Policy

Last updated: 2 November 2026

At AlanSpeak Travel, I respect your privacy and only collect personal information for genuine business purposes. This policy explains what information I need, why I use it, who may receive it and what rights you have.

I handle personal information in accordance with the EU General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 on Personal Data Protection (LOPDGDD).

1. Who is responsible for your information?

I am David Alan John Egan, an independent travel agent operating under the trading name AlanSpeak Travel. I am responsible for the personal information I collect and use in connection with my business.

  • Trading name: AlanSpeak Travel
  • Data controller: David Alan John Egan
  • NIF: X1088410G
  • Address: Avenida Miramar 13, 7-2, 29640 Fuengirola, Málaga, Spain
  • Travel agency registration: C.I.AN 297805-3 (mayorista-minorista)
  • Email: info@alanspeak.com
  • Telephone/WhatsApp: +34 606 863 414

2. What information do I collect?

The information I need depends on the services you request.

  • Enquiries: Your name, contact details and the information you provide through my website, email, telephone or WhatsApp.
  • Travel bookings: Travellers’ names, dates of birth, nationalities, passport details, travel preferences and other information required to arrange the requested services.
  • Travel documents: Where necessary, copies of passports or supporting documents for visas, immigration formalities or particular reservations.
  • Invoicing: The principal client’s name, address and relevant identification number, such as a NIF, NIE, DNI or passport number.
  • Payments: Information relating to bank transfers. I do not collect clients’ credit or debit card details for payment.

Information normally comes directly from you. It may also be supplied by someone arranging travel on your behalf, such as a parent, family member or travelling companion, or by a supplier involved in your booking.

My website’s contact form sends enquiries directly to my email inbox. It does not create a client account or add your details to a marketing database.

My website hosting services may also process basic technical information, such as IP addresses and connection records, for website operation and security.

3. Why do I use your information?

I use personal information for the following purposes:

  • To answer enquiries and prepare quotations: Taking steps towards a possible booking at your request, or responding to correspondence as part of my legitimate business interests.
  • To organise and manage travel: Fulfilling a booking contract or taking the steps needed to arrange one.
  • To arrange travel for accompanying passengers: Processing the information necessary for their reservations, based on the applicable contractual arrangements or legitimate interests.
  • To meet legal obligations: Preparing invoices, keeping accounting records and complying with applicable tax and other legal requirements.
  • To manage complaints and protect the business: Handling disputes, maintaining necessary records and protecting the website, where justified by legitimate interests or legal obligations.

These are the legal grounds on which I process ordinary personal information under Article 6 of the GDPR. Where I rely on legitimate interests, those interests concern responding to customers, managing necessary arrangements, protecting my business and handling disputes, while respecting the rights of the individuals concerned.

Providing information for a general enquiry is voluntary. However, if you wish to book a trip, certain details are necessary. Without them, I may be unable to arrange the requested services.

I do not maintain a marketing mailing list or send unsolicited newsletters or promotional emails. I may publish travel-related updates through WhatsApp Status, but I do not use this to send direct marketing messages to former clients.

I do not use automated decision-making or profiling to make decisions about clients with legal or similarly significant effects.

4. Who receives your information?

Organising travel often involves sharing necessary information with the companies and organisations providing your holiday arrangements.

Depending on the booking, these may include:

  • Tour operators, travel intermediaries and other organisations involved in a particular booking.
  • Destination management companies (DMCs) and local travel agents.
  • Hotels, airlines, transport companies and activity providers.
  • Visa services, immigration authorities and other relevant public authorities.
  • My accounting adviser and providers of essential business services, including website and email hosting.

I share information only where it is needed for the relevant service or legal requirement.

Sometimes I send the necessary details to a supplier or enter them into its booking system. In other cases, you may provide your information directly to a DMC or another supplier. When you do so, I do not receive a copy unless there is a separate need for me to do so.

Suppliers acting as independent data controllers are responsible for their own handling of the information they receive.

I do not sell personal information or share it with third parties for unrelated advertising.

5. Travel outside Europe

International travel sometimes requires personal information to be sent outside the European Economic Area (EEA). For example, a hotel, airline, local travel organiser or immigration authority may need your details to provide services in the country you are visiting.

Some destinations have data protection arrangements recognised by the European Commission. Others do not offer the same legal protections as the EEA.

International transfers must comply with the GDPR. Depending on the country and circumstances, this may involve an adequacy decision, appropriate safeguards or a specific exception for transfers necessary to arrange travel, where permitted by law.

Only information needed for the relevant arrangements should be transferred. You may contact me for further information about the destination, recipient and applicable transfer arrangements for your booking, including available safeguards.

6. Health information and programmes involving minors

Some travel arrangements require information about health conditions, accessibility needs, medication or other circumstances that may affect a traveller’s safety or the services they need.

For residential educational programmes involving children and teenagers, including my Ireland programmes, I may ask parents or legal guardians to provide relevant information about their child’s health, wellbeing, medication, supervision needs and ability to participate safely in group activities.

This information helps me assess individual requirements, make appropriate arrangements with host families and programme organisers, and prepare for situations that could affect the participant or others.

The admission process may also involve personal and group meetings with prospective participants to assess their readiness for the programme. Confidential medical information is not intended to be shared with other participants.

Where a confidential paper health and emergency information form is used, parents or guardians may be asked to attach relevant supporting documents. I seek information relevant to the programme rather than a complete medical history.

Health information receives additional protection under Article 9 of the GDPR. It is processed only where there is a valid legal basis and an applicable condition for handling sensitive information, including explicit consent where appropriate. The required permissions are obtained from parents, legal guardians or the young person, as applicable.

Relevant details may be shared with the Irish programme organisers, designated supervisors, host families, activity providers or healthcare professionals where necessary for the participant’s safety, care or agreed arrangements. Each receives only the information needed for their responsibilities.

Where a paper health file is used, the intention is to return it to the parents or guardians at the end of the programme. Necessary records of serious incidents may be retained separately where required for safeguarding, complaints or legal reasons.

7. How do I store and retain information?

Most of my business correspondence, booking confirmations and travel documents are handled electronically through email. My business email is hosted by LucusHost.

I do not operate a client account system on my website or maintain a marketing database. I take appropriate measures to protect the personal information I hold and limit access to those who need it for legitimate business purposes.

I retain information according to its purpose and any applicable legal requirements:

  • Enquiries: Emails are retained as needed for correspondence and follow-up. Older messages may remain in my email archives; I do not operate a fixed automatic deletion period for every email.
  • Travel bookings: Relevant confirmations and correspondence may be retained to deal with questions, complaints or potential contractual claims.
  • Passport copies and temporary travel documents: These are needed for particular arrangements and should not be kept longer than necessary for those arrangements, relevant follow-up or a legal obligation. Older copies may remain in stored correspondence pending review.
  • Invoices and accounting records: These are retained for the applicable statutory periods, including the six-year requirement for relevant business documentation under Spanish commercial law, or longer where legally required.
  • Confidential paper records for minors: Where used, health information forms are intended to be returned to parents after the programme, except for records that must legitimately be retained.

Personal information that is no longer needed for a valid purpose should be deleted or securely disposed of. Information that must be retained for legal reasons should not be used for unrelated purposes.

8. Your rights

Under the GDPR, you have rights concerning the personal information I hold about you. Depending on the circumstances, you may:

  • Ask what information I hold about you and request access to it.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of information when there is no valid reason to retain it.
  • Request restrictions on how certain information is used.
  • Object to processing based on legitimate interests.
  • Request data portability where the legal requirements apply.
  • Withdraw consent at any time where consent is the legal basis for processing, without affecting processing carried out lawfully beforehand.

To exercise any of these rights, contact me at info@alanspeak.com. I may need to verify your identity before responding.

I will respond within the legally required period, normally one month.

If you believe your data protection rights have been infringed, you may complain to the Agencia Española de Protección de Datos (AEPD), Spain’s data protection authority.

www.aepd.es

9. Cookies, external websites and updates

My website uses essential cookies and technologies that support its operation and language preferences. I do not use advertising, marketing or analytics cookies.

You can find more information in my Cookies Policy.

Links to external websites and communications through services such as WhatsApp may involve separate privacy practices operated by those providers.

I may update this Privacy Policy if the law, my services or the way I handle personal information changes. The date at the top of this page shows when it was last updated.

For any questions about privacy or your personal information, contact me at info@alanspeak.com.