Visit Salto is an independent site run by me, Mathias Nicola, born in Salto and based in London. This page says what is recorded when you read the site or book through it, why, who else sees it, and how to ask me about any of it. For data protection law I am the controller of the details described here. For anything on this page, write to mathias.nicola@visitsalto.com or WhatsApp +44 7541 534436.
The short version
- If you only read the site, the one thing recorded is anonymous analytics: which pages are read, from which country, on what kind of device.
- If you book an experience, I keep your name, email, phone and the details of your request to arrange it, and I pass those details to the operator who runs the activity in Salto. Nothing else is done with them.
- No payment passes through the site, so I never see a card number.
- There is no advertising, no newsletter and no mailing list. Your details are not sold, rented or shared with anyone other than the operator of what you booked.
What I collect when you book
The booking form on each experience page asks for your full name, your email address, your phone number if you want to give it, the date, the number of people and an optional message. When you send it:
- The request is saved in the bookings database on the site's server, so I can find it again and answer questions about your trip.
- A copy arrives in my email inbox, and you receive a confirmation email with the details you entered.
- I get back to you by WhatsApp or email within 12 hours.
I use these details for that and for nothing else. I keep the request for as long as I may need it to deal with your trip and any question that follows it; if you want it deleted sooner, say so by email and I delete it. In the words of the UK GDPR, the legal basis is that the processing is necessary to take steps at your request before a contract, and then to carry it out.
Who sees your details
To arrange the activity I pass your name, contact details and the details of your request to the operator who runs it: the guide, the boat owner, the spa, the estancia or, for an event with a fixed date, the organiser who sells the tickets. They need them to run the day and to reach you if plans change. I pass nothing else, and I pass your details to nobody else.
The operators are in Uruguay and I am in the United Kingdom. The UK recognises Uruguay as a country with adequate data protection, so your details travel there under the same standard that protects them here. The site and its database are hosted in the United Kingdom by Fasthosts, on shared hosting.
If you message me on WhatsApp or by email
Many bookings start with a WhatsApp message. I keep the conversation as I would any correspondence, to answer you and to arrange the trip, and your number goes on no list. WhatsApp is run by Meta under its own privacy policy; an email you send me sits in my mailbox like any other email.
Analytics and cookies
The site uses Google Analytics 4 (measurement ID G-9VXFS1PYQ6) to see which pages are read, from which countries, on what kind of device and browser, and how people arrive: from a search, from a link or directly. Google Analytics 4 does not log or store IP addresses, and what I see is aggregate: so many readers of a page, so many from Argentina, so many on a phone. I use it to decide what to write next. There is no advertising on the site, and I do not use the data for advertising.
Google Analytics sets two cookies in your browser, named _ga and _ga_ followed by an identifier, so that two page views from the same browser count as one visitor. They last up to 2 years. If you would rather not be counted, Google's opt-out add-on switches Analytics off in your browser for every site, and blocking cookies in your browser settings does the same for this one. Nothing on the site stops working without them.
No other cookie is set for visitors. The booking form keeps bots out with a hidden timestamp and an empty decoy field, not a cookie. The trip planner on the Plan page records, when you finish it, where you are travelling from and what matters most to you, with the date and your browser's language setting, and nothing that identifies you.
Other services that load with a page
As on most sites, part of what you see is fetched by your browser from other companies' servers, and each of them sees your IP address when it serves the file, as any web server does:
- Google Fonts serves the two typefaces, Cormorant Garamond and Manrope, on every page.
- Google Analytics, described above, on every page.
- OpenStreetMap serves the map tiles on the electric car page, the Journal index and the note on Eladio Dieste.
- Trustpilot serves the review box on the About page.
Links to operators, hotels, the Intendencia de Salto, saltouruguay.com and other sites take you to pages run by others, with their own privacy practices.
Your rights
You can ask me what I hold about you, ask me to correct it or delete it, or object to my keeping it. Email mathias.nicola@visitsalto.com and I answer within a month, usually much sooner. If you think I have handled your details badly, you can complain to the Information Commissioner's Office in the UK, and nothing stops you going to the data protection authority where you live.
Security
The site is served over HTTPS, the bookings database sits behind a password on the server, and only I have that password. Booking confirmations go by ordinary email, which is as private as email is: if there is something you would rather not write in the message box, tell me on WhatsApp instead.
Children
The site is written for adults planning a trip, and bookings are made by adults. If a child's details are part of a request, an age for a boat trip for example, they are used for that day only and passed to the operator in the same way.
Changes to this page
If anything here changes, the date at the top changes with it. This version is from 23 October 2026. The terms for booking through the site are on the terms page.