GDPR Compliance

Last Updated: August 13, 2026

goncldemetra is committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR). This page outlines how we handle your personal data in accordance with GDPR requirements.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance: Processing necessary to fulfill our travel services
• Consent: Where you have given explicit permission
• Legitimate interests: For business operations and service improvement
• Legal obligation: When required by law

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• Right to access: You can request copies of your personal data
• Right to rectification: You can request correction of inaccurate data
• Right to erasure: You can request deletion of your data
• Right to restrict processing: You can request limitation of processing
• Right to data portability: You can request transfer of your data
• Right to object: You can object to certain types of processing
• Rights related to automated decision-making: Protection from automated decisions

Data Protection Officer

For questions regarding data protection and GDPR compliance, please contact our data protection team at [email protected].

Data Processing Activities

We process personal data for the following purposes:

• Managing travel bookings and reservations
• Customer communication and support
• Payment processing through secure third parties
• Service improvement and analytics
• Legal compliance and fraud prevention

International Data Transfers

When necessary for providing our services, we may transfer your data to countries outside the European Economic Area. We ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Travel booking records are typically retained for seven years for legal and accounting purposes.

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection

Third-Party Processors

We work with third-party service providers who process data on our behalf. All processors are carefully selected and bound by data processing agreements that comply with GDPR requirements.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, this period may be extended by two additional months with explanation.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO).

Updates to This Page

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised date.