In short: the only personal data collected is what you type into the planning request form. It is used to answer your request and prepare your itinerary, it is never sold, and you can ask for it to be deleted at any time by emailing hello@elsalvadoruncovered.com.
1. Who is responsible for your data
El Salvador Uncovered is operated by Martin Pujol, acting as the data controller for the purposes of the EU General Data Protection Regulation (GDPR). Contact: hello@elsalvadoruncovered.com.
2. What data is collected
Through the planning request form: first name, last name, email address, the country or city you are travelling from, your planning stage, approximate arrival and departure dates, trip duration, number of travellers, travel style, the type of booking guidance you need, and the free-text notes you choose to write.
Through hosting infrastructure: your IP address, browser type and the pages you visited, collected automatically by the hosting provider in server logs for security and availability purposes.
No advertising cookies, analytics cookies or third-party tracking scripts are used on this website. Your language preference is served by the URL you visit rather than stored on your device.
3. Why it is collected and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Replying to your planning request and preparing a quote or itinerary | Steps taken at your request prior to entering a contract (Art. 6(1)(b)) |
| Performing the planning service once agreed | Performance of a contract (Art. 6(1)(b)) |
| Keeping records of correspondence and invoices | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Website security and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
You are never added to a marketing list on the basis of a planning request. Any newsletter would require separate, explicit consent.
4. Who processes it
Form submissions are received and stored by Netlify, which also hosts this website (Netlify, Inc., United States). Netlify acts as a data processor and transfers are covered by the EU Standard Contractual Clauses. Email correspondence is handled through a standard business email provider. No data is sold, rented or shared with advertisers.
Where your itinerary requires it, and only with your knowledge, limited details (for example the number of travellers and dates) may be shared with a hotel or activity provider in order to check availability or conditions. Your contact details are not passed to providers without your agreement.
5. How long it is kept
- Unanswered or declined requests: deleted within 12 months.
- Client files and correspondence: kept for the duration of the service and up to 3 years afterwards, for follow-up and dispute purposes.
- Invoices and accounting records: retained for the period required by applicable tax law.
- Server logs: retained by the hosting provider for a short technical period, typically under 30 days.
6. Your rights
Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable format. You may also withdraw consent where consent is the basis for processing, and lodge a complaint with your national data protection authority.
To exercise any of these rights, email hello@elsalvadoruncovered.com. Requests are answered within 30 days.
7. Security
The site is served over HTTPS. Form data is transmitted encrypted and stored in Netlify's access-controlled infrastructure. Access is limited to Martin Pujol. No payment card data is ever collected through this website.
8. Children
This service is not directed at children. Requests should be submitted by an adult, who may include the ages of accompanying children where relevant to the itinerary.
9. Changes to this policy
Any material change will be reflected in the "updated" date at the top of this page. The current version was published on 9 August 2026.