Your Data Rights

1. Your rights at a glance

Under the EU General Data Protection Regulation (GDPR), the UK GDPR, and Spanish Organic Law 3/2018, you have eight specific rights in relation to the personal data we hold about you. This page explains how to exercise each one with EspanaGo.

• Right of access — get a copy of your data and information about how we process it.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — have your data deleted in certain cases.
• Right to restriction — limit how we use your data in certain cases.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority.

2. How to submit a request

Send your request by email to privacy@espanago.com. To help us identify you and respond accurately, please include:

• Your full name and the email address (and phone number, if used) we have on file;
• The right you wish to exercise — access, rectification, erasure, restriction, portability, objection, or withdrawal of consent;
• The specific data or purpose your request relates to (for example, "marketing emails", "case file from 2025");
• A preferred delivery format (PDF, plain text, CSV/JSON for portability).

We may need to verify your identity by asking for an additional confirmation step — for example, replying from the email address on record. This is required to prevent disclosure of your data to third parties.

3. Response time

We will respond to your request within one month of receipt (Article 12(3) GDPR). For complex or numerous requests this period may be extended by up to two further months — if so, we will let you know within the first month and explain why.

If we cannot act on your request (for example, because retention is required by law), we will tell you the reason and inform you of your right to complain to a supervisory authority.

4. Ready-to-use email template

Copy, edit the bracketed parts, and send to privacy@espanago.com:

To: privacy@espanago.com
Subject: GDPR data rights request — [your name]

Dear EspanaGo,

I am exercising my rights under the GDPR / UK GDPR with respect to the personal data you hold about me.

My details:
  Full name:      [your full name]
  Email on file:  [the email address we hold for you]
  Phone (if any): [phone number]

I am exercising the following right(s) — keep only what applies:
  [ ] Right of access — please send a copy of all personal data you hold about me.
  [ ] Right to rectification — please correct: [describe what needs correcting].
  [ ] Right to erasure — please delete all personal data you hold about me.
  [ ] Right to restriction — please restrict processing of: [describe scope].
  [ ] Right to data portability — please send my data as: [PDF / CSV / JSON].
  [ ] Right to object — I object to processing based on legitimate interests / direct marketing.
  [ ] Right to withdraw consent — I withdraw my consent for: [scope, e.g. marketing emails / analytics cookies].

Preferred response channel: [email / postal address].

Sincerely,
[your name]
[date]

5. Withdrawing cookie consent

The fastest way to change your cookie choice is to reset it here. After reset, the cookie banner will appear on your next visit so you can make a new choice.

You can also block or delete cookies in your browser settings — see Section 6 of our Cookie Policy for direct links.

6. Right to complain to a supervisory authority

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with a data protection supervisory authority. As we are established in Spain, your primary authority is the Agencia Española de Protección de Datos (AEPD):

• Website: aepd.es
• Online complaint form: sedeagpd.gob.es
• Address: C/ Jorge Juan, 6, 28001 Madrid, Spain

If you are based in the United Kingdom, you may also complain to the Information Commissioner's Office (ICO): ico.org.uk. Residents of other EU/EEA states may contact their local data protection authority.

7. Cost

Exercising your rights is free of charge. We may charge a reasonable fee or refuse to act only if a request is manifestly unfounded or excessive (Article 12(5) GDPR), in which case we will explain why in writing.

8. Contact

All data protection requests and questions: privacy@espanago.com.