This is a translation of the Spanish original. In case of any discrepancy, the Spanish version shall prevail.
1. Who is responsible for your data?
Mr Lux Motors SL (trading as MR Offroad Experience) · Tax ID B25927203 · Camí del Papalús, S/N, 17310 Lloret de Mar (Girona), Spain · reservation@mroffroadexperience.com · +34 633 85 94 76.
2. What data we process
- Bookings: first name, last name, email, phone, the experience, the date and the number of participants. Payments are processed by Stripe: we never see or store your card details.
- Check-in and participation agreement: before the activity, identification details (ID card or passport), driving licence and signature of the drivers. This data is stored encrypted.
- Enquiries: the details you give us when you contact us through the form, by email, by phone or on WhatsApp.
- Gift cards: the buyer’s details and the name of the person receiving the gift.
- Browsing: technical data and, only if you accept them, analytics and advertising cookies (see the Cookie Policy).
3. Why we use it and on what legal basis
- To manage and charge your booking and send you the confirmation and reminders by email, WhatsApp or SMS: performance of the contract.
- To complete the check-in and participation agreement and to handle any incident or claim: performance of the contract and compliance with legal obligations.
- To answer your enquiries: your consent and pre-contractual steps taken at your request.
- To ask for your feedback after the experience: legitimate interest. You can object at any time.
- To send you news and offers: only with your consent.
- To measure the use of the website and our campaigns: your consent, given or refused in the cookie banner.
- To meet accounting and tax obligations: legal obligation.
4. How long we keep it
For as long as needed for the purpose it was collected for. After that, booking and billing data is kept blocked for the periods required by law (6 years for commercial records and 4 years for tax records), and check-in data for the period during which liability arising from the activity may be claimed. Enquiries that do not lead to a booking are deleted once they are no longer needed.
5. Who we share it with
We do not sell or pass on your data. Only the providers we need to deliver the service have access to it, under a data processing agreement:
- Hostinger: hosting of the website and booking system.
- Stripe: payments.
- Brevo: email delivery.
- Twilio and WhatsApp (Meta): reminders and messages by WhatsApp or SMS.
- Google and Meta: only if you accept their analytics or advertising cookies.
We may also share it with the insurance company in the event of an accident or incident, with our accountants and tax advisers, and with public authorities where required by law.
6. International transfers
Some of these providers (Stripe, Twilio, Meta and Google) may process data outside the European Economic Area, mainly in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the standard contractual clauses approved by the European Commission.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to reservation@mroffroadexperience.com. If we have reasonable doubts about your identity, we may ask you to prove it. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of your country.
8. Minors
Minors only take part as passengers and always with their parent or legal guardian, who provides their details to us.
9. Security
We apply technical and organisational measures to protect your data: the website always uses an encrypted connection (HTTPS) and check-in data is stored encrypted.
10. Changes to this policy
We may update this policy to reflect legal or service changes. The version in force is always the one published on this page.
Last updated: September 2026.