PRIVACY POLICY
Last updated: 9 September 2026
This policy explains what personal data Vengo Viajando collects through vengoviajando.com, why, on what legal basis, who it is shared with and what rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, Spanish Organic Law 3/2018 (LOPDGDD) and the California Consumer Privacy Act as amended by the CPRA, along with comparable US state privacy laws.
1. WHO IS RESPONSIBLE FOR YOUR DATA
- Controller: Gustavo Correa, operating under the trade name Vengo Viajando.
- Contact: vengoviajando@gmail.com
- Data protection officer: none appointed. A DPO is not required for this activity; write to the address above for any privacy matter.
Under US state privacy laws, Vengo Viajando acts as the “business” that determines the purposes and means of the processing described here.
2. WHAT DATA WE COLLECT
Data you give us
- Newsletter and free downloads: name and email address.
- Consulting and logistics enquiries: name, email, phone number, motorcycle, planned route, target dates and the message you write.
- Purchases of digital products: name, email and the details of the order. Card data is entered directly on Stripe’s payment page and never reaches our servers.
- Direct emails: whatever you choose to include in them.
Data collected automatically
- IP address: processed transiently to rate-limit forms and block abuse. It is not stored in a database.
- Aggregated usage statistics: pages visited, country, device type and loading performance, measured by Vercel Analytics and Vercel Speed Insights without cookies and without cross-site tracking. See the Cookie Policy.
- Email delivery events: whether a message we sent was delivered, bounced or was reported as spam, received from our email provider so we can stop writing to addresses that do not work.
We do not collect special categories of data (health, beliefs, biometrics, precise geolocation) and we do not knowingly collect data from children. We do not buy personal data from data brokers.
3. WHY WE USE IT, AND ON WHAT LEGAL BASIS
| Purpose | Data | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|
| Sending the newsletter and the free resources you request | Name, email | Your consent, confirmed by double opt-in (art. 6.1.a) | Until you unsubscribe, plus 12 months of proof of consent |
| Answering enquiries and preparing quotes | Contact and trip details | Steps taken at your request prior to a contract (art. 6.1.b) | 24 months from the last exchange |
| Selling and delivering digital products | Name, email, order details | Performance of the contract (art. 6.1.b) | For the life of the contract |
| Invoicing, tax and accounting records | Billing data | Legal obligation (art. 6.1.c) | Up to 6 years, as required by Spanish commercial and tax law |
| Protecting the site against spam and abuse | IP address, form metadata | Legitimate interest in keeping the service available (art. 6.1.f) | Transient; minutes |
| Understanding which content works | Aggregated statistics with no identifier | Legitimate interest in improving the site (art. 6.1.f) | Aggregated; no personal data retained |
We never use your data for automated decision-making or profiling that produces legal or similarly significant effects on you, and we do not run advertising or retargeting pixels.
4. WHO WE SHARE IT WITH
We do not sell your data and we do not share it for cross-context behavioural advertising. We do rely on the following service providers, who act as processors under a data processing agreement and may only use the data to serve us:
| Provider | What it does | Where |
|---|---|---|
| Vercel Inc. | Website hosting, cookieless analytics, storage of the files you buy | EU and USA |
| Stripe, Inc. / Stripe Payments Europe | Payment processing (acts as an independent controller for payment data) | EU and USA |
| Resend (Plus Five Five, Inc.) | Sending transactional and newsletter emails | USA |
| Google LLC / Google Ireland | Spreadsheets and email inbox where enquiries are recorded | EU and USA |
| Cloudflare, Inc. | Turnstile: anti-bot check on the forms, so nobody can use them to send email in your name. It runs without showing anything unless it needs you to act. Governed by the Cloudflare Turnstile Privacy Addendum. | EU and USA |
Beyond that, we only disclose data when a law, a court or a competent authority requires it, or to establish or defend a legal claim.
5. INTERNATIONAL TRANSFERS
Some of these providers process data in the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, by the EU–US Data Privacy Framework, together with the additional technical measures the providers document. You may request a copy of the safeguards in place by writing to vengoviajando@gmail.com.
6. YOUR RIGHTS IN THE EU, THE EEA AND THE UK
- Access: to know whether we process your data and obtain a copy of it.
- Rectification: to correct data that is inaccurate or incomplete.
- Erasure: to have your data deleted when it is no longer needed.
- Restriction: to have processing paused while a dispute over your data is resolved.
- Portability: to receive the data you gave us in a structured, machine-readable format.
- Objection: to object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without affecting the lawfulness of what was done before. Every newsletter carries a one-click unsubscribe link.
To exercise any of them, write to vengoviajando@gmail.com from the address concerned, or from any address if you can identify yourself another way. We answer within one month, extendable by two more if the request is complex. We will not ask you for an ID document unless we genuinely cannot identify you otherwise.
If you believe we have not handled your request properly you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es), to the supervisory authority of your country of residence, or to the UK Information Commissioner’s Office.
7. YOUR RIGHTS IN CALIFORNIA AND OTHER US STATES
If you are a resident of California, Colorado, Connecticut, Virginia, Texas or another state with a comprehensive privacy law, you have the right to know what personal information we collect and why, to access a copy of it, to correct it, to delete it, to obtain it in a portable format, and not to be discriminated against for exercising any of these rights. We do not charge different prices or provide a different level of service to people who exercise them.
Categories collected in the last 12 months
- Identifiers: name, email address, phone number, IP address.
- Commercial information: products purchased and services enquired about.
- Internet activity: aggregated page views and performance data with no persistent identifier.
These are collected directly from you, or generated when you use the site, for the business purposes described in section 3, and disclosed only to the service providers listed in section 4.
We do not sell or share your personal information
Vengo Viajando has not sold personal information, and has not shared it for cross-context behavioural advertising, in the preceding twelve months, and does not do so today. There is therefore no “Do Not Sell or Share My Personal Information” mechanism to offer: the opt-out is our default. We do not collect sensitive personal information, so the right to limit its use does not arise. We do not knowingly sell or share the personal information of anyone under 16.
To exercise a right, write to vengoviajando@gmail.com. We verify requests by matching the details you provide against our records and reply within 45 days, extendable once. An authorised agent may act for you with written permission that we can verify.
8. BROWSER PRIVACY SIGNALS
We do not track you across websites, so there is nothing for a Global Privacy Control or Do Not Track signal to switch off. Where such a signal reaches us we treat it as a valid opt-out request in any case.
9. CHILDREN
This site is aimed at adults planning motorcycle travel. We do not knowingly collect data from anyone under 16 in the EU or under 13 in the United States. If you believe a minor has given us data, write to vengoviajando@gmail.com and we will delete it.
10. SECURITY
The site is served entirely over HTTPS, credentials are held as server-side environment variables and never exposed to the browser, purchased files are delivered through signed links that expire, and forms are rate-limited. No system is perfectly secure, but if a breach affects your rights we will notify the competent authority within 72 hours and tell you directly when the law requires it.
11. SOCIAL PLATFORMS
Vengo Viajando publishes on TikTok, Instagram, Facebook, Threads and YouTube using its own tooling and the platforms’ official APIs. What that tooling accesses and stores is set out in the Platform Data Use page.
12. CHANGES TO THIS POLICY
We update this policy whenever the processing changes. The date at the top always reflects the version in force; material changes affecting people already on the newsletter are announced by email before they take effect.