Privacy policy
Last updated: September 2026
At Puffin Project, S.L. (hereinafter, “Destinno”), we are committed to protecting the privacy and security of the personal data of users of our services and website.
This Privacy Policy explains how we collect, use, retain and protect personal data when you use destinno.com, our applications and platforms, or contact us.
This policy applies in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and any other applicable Spanish and European legislation.
1. Data controller
The controller of the personal data processed through this website and Destinno’s services is:
- Puffin Project, S.L.
- Tax Identification Number (NIF): B01746544
- Registered address: Avenida del Maestro Rodrigo, 45 - Oficina 2 - 46015 Valencia, Spain
- Email: hola@destinno.com
- Website: destinno.com
Where Destinno acts as a data processor for a travel agency, destination management company, tour operator or other client company, that company will be the controller of the personal data of its own customers and travellers, while Destinno will process such data in accordance with its instructions and the relevant data processing agreement.
2. What personal data may we process?
Depending on your relationship with Destinno and the services you use, we may process different categories of personal data, including:
- First name and surname.
- Email address.
- Telephone number.
- Professional and company information.
- Login and user account data.
- Information required to manage subscriptions to and the purchase of our services.
- Billing and payment data.
- Information included in proposals, itineraries and bookings.
- Information relating to travel and tourism services.
- Data relating to travellers and accompanying persons when entered into the platform by a client company.
- Travel-related documentation where necessary to provide the service.
- Information provided through contact forms, demo requests, support requests or other communications.
- Data relating to use of the platform and interaction with our services.
- Technical information required to ensure the security and operation of the website and platform.
We do not request special categories of personal data unless they are necessary for a specific purpose and there is an appropriate legal basis for processing them.
When a client company enters its travellers’ data into Destinno, that company is responsible for ensuring that it has the necessary lawful basis to disclose such data to Destinno and for the data to be processed for the relevant purposes.
3. How do we obtain the data?
Personal data may be obtained:
- Directly from the data subject when they contact us, request information, a demo or trial, create an account or purchase our services.
- From the company or organisation for which the user works, when the user uses Destinno as a professional tool.
- From our clients when they enter data relating to their own travellers or customers into the platform.
- Through the use of our websites and platforms.
- Through communications with users or clients.
4. Purposes of processing
Destinno may process personal data for the following purposes:
4.1. Managing requests for information and contact
To respond to enquiries, requests for information, demo requests, free trials and other communications submitted through our website or by other means.
4.2. Managing registration and user accounts
To create and administer user accounts, provide access to the platform and manage the features included in the services purchased.
4.3. Providing the services purchased
To manage our contractual relationship with clients and provide Destinno’s features, including the creation, management and presentation of travel proposals and itineraries and the management of related information.
4.4. Managing clients, billing and payments
To manage subscriptions, billing, collections, payments and other obligations arising from the contractual relationship.
4.5. Managing traveller data
Where Destinno acts as a data processor, to process the personal data of travellers and end customers entered by the client company in order to provide the services purchased.
This data may include information required to manage itineraries, bookings, travel documentation, purchased services, communications and other travel-related matters.
4.6. Providing artificial intelligence-based features
Destinno may use artificial intelligence technologies for certain platform features, such as generating or improving itineraries, proposals, descriptions and other travel-related content.
Data processed through these features will be handled in accordance with the instructions and conditions applicable to the service and with the appropriate security measures.
4.7. Security and operation
To ensure the security, availability and proper operation of our services, prevent fraudulent or unauthorised use, detect incidents and carry out maintenance tasks.
4.8. Improving our products and services
To analyse how our services operate and are used in order to detect errors, improve features and develop new functionality.
4.9. Marketing communications
Where permitted by an applicable legal basis, we may send marketing communications relating to Destinno, its services, news, features, events or content.
Where required, we will obtain the relevant consent beforehand.
Recipients may unsubscribe from marketing communications at any time using the mechanism provided in those communications or by contacting us.
5. Legal basis for processing
The legal bases that may justify processing carried out by Destinno include:
Performance of a contract or steps taken prior to entering into a contract, where processing is necessary to provide the requested services or to manage an account, trial, purchase or business relationship.
Consent, where required for certain purposes, such as certain marketing communications or non-essential cookies.
Compliance with legal obligations, where processing is necessary to comply with tax, accounting, commercial or other legally enforceable obligations.
Legitimate interests, where processing is necessary for certain purposes relating to management, security, fraud prevention, service improvement or maintenance of the business relationship, provided that those interests are compatible with the rights and freedoms of the individuals concerned.
The applicable legal basis will depend on the specific purpose of the processing.
6. Is providing the data mandatory?
Data required to provide a particular service will be identified as mandatory, where appropriate, in the relevant forms or registration processes.
If the required data is not provided, Destinno may be unable to respond to a request, create an account, provide a service or perform a contractual relationship.
Providing data for marketing communications will be voluntary where consent is the applicable legal basis.
7. Recipients of the data
Personal data may be processed by service providers and partners that provide services necessary for Destinno’s operation, including, where applicable:
- Hosting, infrastructure and storage providers.
- Technology and maintenance service providers.
- Email and communications providers.
- Payment service providers.
- Artificial intelligence service providers.
- Analytics and measurement providers.
- Security service providers.
- Professional, accounting, legal or financial advisers.
- Public authorities, courts, tribunals and competent bodies where legally required.
These providers will only access data where necessary to provide the relevant services and, where they act as data processors, will be subject to the obligations established by data protection legislation and the relevant agreement.
Destinno does not sell or disclose personal data to third parties.
8. Data retention
Personal data will be retained for as long as necessary to fulfil the purposes for which it was obtained.
Where there is a contractual relationship, data will be retained while that relationship remains in effect and subsequently for the periods necessary to address any potential legal, contractual, tax or administrative liabilities.
Data processed on the basis of consent will be retained while that consent remains valid, unless another legal basis permits its continued retention.
Once the applicable periods have expired, the data will be deleted or, where appropriate, blocked in accordance with applicable law.
9. Data security
Destinno applies appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access or any other unlawful processing.
These measures are reviewed in light of the risks associated with the processing carried out and the nature of the data processed.
The law requires security measures to be appropriate to the risk presented by the processing.
10. Data relating to our clients’ travellers and end customers
Destinno primarily provides services to companies in the tourism sector, such as travel agencies, destination management companies and tour operators.
When a client company uses Destinno to enter and manage information relating to its own customers or travellers, that company determines the purposes and means of processing and generally acts as the data controller.
In such cases, Destinno acts as the data processor, processing the data solely in accordance with the client’s instructions and the terms set out in the relevant data processing agreement.
The client company is responsible for:
- Having a valid legal basis for processing the data.
- Providing appropriate information to its customers and travellers.
- Ensuring that data disclosed to Destinno may be processed for the relevant purposes.
- Responding to requests to exercise data protection rights, where applicable.
Destinno will apply the security measures and comply with the obligations applicable to data processors.
11. Artificial intelligence
Destinno incorporates features based on artificial intelligence technologies to facilitate the creation, personalisation and improvement of travel itineraries and proposals.
Where these features involve the processing of personal data, Destinno will take the necessary measures to ensure that the processing complies with applicable legislation.
Artificial intelligence features must not be used to enter personal information that is not necessary for the specific purpose of the feature.
Where appropriate, additional information will be provided about how these features operate and the technology providers used.
12. Automated decision-making and profiling
Destinno does not intend to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.
If features involving profiling or automated decision-making subject to specific rights under the GDPR are introduced in the future, the relevant information will be provided and the safeguards required by law will be implemented.
13. Rights of data subjects
Individuals whose data is processed by Destinno may exercise the following rights, where applicable:
- Right of access.
- Right to rectification.
- Right to erasure.
- Right to restriction of processing.
- Right to object.
- Right to data portability.
- Right to withdraw consent where processing is based on consent.
To exercise these rights, you may send a request to:
Where necessary to protect their data, the request must enable us to reasonably verify the identity of the person making it.
Exercising these rights is generally free of charge.
Information about these rights must be provided clearly and accessibly, and the Spanish Data Protection Agency (AEPD) recommends that data protection information be provided using a layered approach.
14. Right to lodge a complaint
If you believe that the processing of your personal data does not comply with applicable legislation, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
Spanish Data Protection Agency
However, we recommend that you contact us before lodging a complaint so that we can try to resolve any issue relating to the processing of your data.
15. Cookies
Destinno’s website may use cookies and similar technologies to ensure that the website operates correctly, improve the browsing experience, obtain usage statistics and, where applicable, carry out certain analytics or marketing activities.
Cookies that are not strictly necessary will, where applicable, be subject to the user’s consent.
Detailed information about the cookies used, their purposes, duration and management is available in our Cookie Policy.
17. Links to third-party websites
Our website or platforms may contain links to third-party websites, services or platforms.
Destinno is not responsible for the privacy policies, content or practices of such third parties.
We recommend reviewing their respective privacy policies before providing personal data.
18. Minors
Destinno’s professional services are primarily intended for companies and professionals.
Destinno does not knowingly request personal data from minors for the purpose of registering them as users of its professional services.
Where a client company processes the data of travellers who are minors through the platform, that company is responsible for ensuring that it has the necessary lawful basis for such processing and that it has complied with the relevant information and, where applicable, consent requirements.
19. Updates to this Privacy Policy
Destinno may amend this Privacy Policy where necessary to reflect changes in legislation, regulations, technology or our services.
The current version will be the version published on this page.
Where changes are material, we may provide notice of them through appropriate means.
20. Applicable law
This Privacy Policy is governed by applicable Spanish and European data protection legislation, including Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), and any other applicable legislation.
Puffin Project, S.L. (DESTINNO)
Tax Identification Number (NIF): B01746544
Avenida del Maestro Rodrigo, 45 - Oficina 2 - 46015 Valencia, Spain
hola@destinno.com