Privacy Policy

This policy should be reviewed and adapted by a qualified Spanish lawyer (abogado) before publication. The controller's Tax ID and Companies Register data are shown as pending because the company was recently incorporated (5 August 2026) and these are being finalised.

1. Data Controller (Responsable del Tratamiento)

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), the controller of your personal data is:

• Legal name: PRIVA SPA, S.L. (sociedad unipersonal), trading as "Spafindo"
• NIF / CIF: pending — to be confirmed following incorporation
• Registered address: Paseo Jesús Santos Rein 2, Edificio Ofisol, 2º-A, Fuengirola (Málaga), Spain
• Email: info@spafindo.com (contact address pending)
• Companies Register: Registro Mercantil de Málaga — registration in progress; Volume, Folio and Sheet to be added once inscribed.

2. What Data We Collect

• Identification & contact data: name, surname, email, phone number.
• Booking data: chosen venue, city, date, time slot, party size and any notes you add.
• Payment data: processed directly by our licensed payment service provider (PSP). Spafindo does not store full card numbers; we receive only a tokenised reference and transaction status.
• Technical data: IP address, device and browser type, and usage data collected via cookies (see our Cookie Policy).

3. Purposes & Lawful Bases

We process your personal data for the purposes below, each under the corresponding lawful basis:

• Manage your booking and connect you with the venue (service provider) — performance of a contract (Art. 6.1(b) GDPR).
• Process payment and commission via the PSP — contract & legal obligation (Art. 6.1(b)/(c)).
• Fraud prevention and platform security — legitimate interest (Art. 6.1(f)).
• Comply with tax, accounting and consumer-law duties — legal obligation (Art. 6.1(c)).
• Send marketing communications & analytics cookies — your consent (Art. 6.1(a)).

4. Processors & Recipients

We share data only with processors who act on our instructions under Art. 28 GDPR contracts:

• Payment service provider: Stripe Payments Europe Ltd. (PSD2/SCA-compliant processing).
• Hosting & infrastructure: our cloud hosting provider, with servers located in the EU/EEA.
• Analytics: privacy-respecting web analytics, activated only with your cookie consent.
• The venue you book: receives the booking details required to deliver the service.

Where any transfer outside the EEA occurs, it is protected by an adequacy decision or the European Commission's Standard Contractual Clauses.

5. Data Retention

Booking and contact data are kept for the duration of the relationship and then blocked for the legally required limitation periods (up to 6 years for accounting/tax obligations under the Código de Comercio and tax law). Marketing data are kept until you withdraw consent.

6. Your Rights

You may exercise the following rights free of charge by emailing info@spafindo.com with proof of identity:

• Access, rectification and erasure of your data.
• Restriction and objection to processing.
• Data portability.
• Withdrawal of consent at any time, without affecting prior processing.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

Last updated: 20 June 2026.

Related: Cookies · Terms · Legal notice