Privacy Policy
1. Identification of the Data Controller
The data controller responsible for processing personal data collected through this website is:
- Name/Owner: Cloister Club Spain / Hannah Palfreyman
- Commercial Address: 37 La Viña, GR- 4202, 18418 Orgiva, Granada, Spain
- NIF/NIE: ESY3444155B
- Contact Email: info@cloisterclubspain.com
2. Applicable Legal Framework
Given that our economic activity is carried out physically and is registered in Andalusia, Spain, our data practices comply strictly with the European General Data Protection Regulation (EU GDPR) and the Spanish Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de Derechos Digitales (LOPDGDD).
Furthermore, because we also actively target and market our tourism, wellness, and accommodation services to clients residing in the United Kingdom, we recognize and guarantee the rights established under the UK GDPR.
3. Data We Collect and Purpose (Lawful Basis)
We process personal data exclusively to offer a safe, legal, and personalized experience at our accommodation and wellness facilities:
- Accommodation Bookings and Inquiries: We process your name, contact details (phone and email), billing details, and passport/ID information for the purpose of managing your stay booking, executing the hospitality contract, and fulfilling mandatory local police registration laws for lodging providers in Spain. (Lawful basis: Performance of a contract and compliance with a legal obligation).
- Safety, Health, and Wellness Data: With the sole purpose of ensuring your physical safety, preventing injury, and tailoring our yoga classes, retreats, or therapies to your physical capabilities, we may request sensitive personal data such as relevant medical conditions, recent injuries, pregnancy, or severe food allergies. (Lawful basis: Explicit consent of the user).
- Marketing and Communications: If you grant us your consent, we will use your email address to send you updates regarding future wellness retreats, yoga workshops, or accommodation offers. You can unsubscribe at any time with immediate effect. (Lawful basis: Consent of the data subject).
4. Storage and International Data Transfers
Your personal data is securely stored within the European Economic Area (EEA) and Spain.
We do not use third-party cloud tools or software that process or transfer your information outside the EU/UK zone. Although the United Kingdom operates independently of the EU, data exchanges between our business and our British clients are carried out under the reciprocal framework of the adequacy decisions currently in force between the EU and the UK.
5. Data Retention Period
We will retain your physical or digital booking data for the time strictly necessary to complete your stay or wellness program, and subsequently, during the mandatory legal periods required to comply with tax, accounting, and official tourist accommodation registration regulations in Andalusia, Spain (generally up to 5 years). Health questionnaires and medical disclaimer forms are safely archived and deleted once they are no longer legally required to defend against potential liability claims.
6. Image Rights and Social Networks (Instagram/Facebook)
During the course of yoga classes, workshops, or retreats, we may take photographs or videos of the participants and the environment. We will never publish your image on our website or on our social media channels (such as Instagram or Facebook) without having previously obtained your explicit written consent at our facilities.
Given that Instagram is a platform owned by Meta Platforms, Inc. (USA), by accepting the publication of your photo, you assume that your data may be processed in the United States under the independent privacy frameworks of that platform. You can revoke this image consent at any time by sending us an email, and we will remove the publication immediately.
7. Your Legal Rights
Regardless of whether you reside in Spain or the United Kingdom (or other countries), you hold full control over your data. You have the right to request access, rectification, restriction, portability, or permanent erasure of your data from our systems.
To exercise any of these rights, please contact us at [Insert your contact email]. If you consider that your data has not been processed correctly, you have the right to lodge a formal complaint with the Spanish Agencia Española de Protección de Datos (AEPD) or with the UK Information Commissioner’s Office (ICO).