Privacy policy

1. Data controller

• Controller: Pol Farràs Sanchez
• Tax ID (NIF): 39947902F
• Address: C/ Mossèn Andreu, 11, 08304 Mataró (Barcelona)
• Email: info@ccaevents.es
• Phone: +34 650 67 19 54

We have no data protection officer as we are not required to appoint one. For any question about your data, write to info@ccaevents.es.

2. What data we process

• Contact form: name, email, phone, event date and town, event type, what you need and your message.
• Email, phone and WhatsApp: the data you send us when you write or call.
• Clients: contact and billing details (name or company name, tax ID, address), event details and, where applicable, payment details.
• Browsing: minimal technical data (IP address, browser, date and time) logged by the servers for security and operation.

We do not ask for special categories of data. If you send them to us without being asked, we will delete them.

3. Why we use it and on what legal basis

• To answer your enquiry and prepare your quote. Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR) and your consent when you submit the form (art. 6.1.a).
• To organise and deliver the service you hire (DJ, technical production or rental) and handle invoicing and payment. Legal basis: performance of the contract (art. 6.1.b) and compliance with tax and accounting obligations (art. 6.1.c).
• To keep in touch with clients about future dates. Legal basis: legitimate interest (art. 6.1.f). You can object at any time.
• To keep the website secure and prevent form spam (a honeypot field, a minimum filling time and a daily submission limit, for which we keep an encrypted code of the IP address that is deleted the next day; no third-party services). Legal basis: legitimate interest (art. 6.1.f).

We do not make automated decisions or build profiles with your data. We do not send marketing emails without your prior consent.

4. How long we keep it

• Enquiries and quotes not accepted: up to 1 year from the last contact.
• Clients: for the duration of the relationship and then for the legal periods (up to 6 years for commercial and accounting obligations, and 4 years for tax obligations).
• Server browsing data: the minimum time needed for security, generally no more than 30 days.
• Record of your acceptance of this policy on the form (date and time, language, page, checkbox text and policy version): as long as the request and then up to 3 more years so we can prove it if there is a complaint.

5. Who we share it with

We do not sell or pass your data to third parties. We only share it with public authorities when required by law (for example, the Tax Agency) or with banks to process payments.

To run the website and our business we use providers that process data on our behalf (processors), under contract and with appropriate safeguards:

• Netlify, Inc. (USA): website hosting and contact form submissions.
• Google LLC (USA): business email, where applicable.
• IONOS SE (Germany): domain and email.
• Supabase, Inc.: database of our management app, where we store contact form requests and which provides the calendar dates.
• Tax and accounting advisers, when needed.

If you choose to message us on WhatsApp or follow us on Instagram or TikTok, those platforms process your data as independent controllers under their own policies.

6. International transfers

Some providers (Netlify, Google, Supabase) may process data in the United States. These transfers are made to companies certified under the EU-US Data Privacy Framework, covered by a European Commission adequacy decision, or under standard contractual clauses approved by the Commission.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting the lawfulness of prior processing. Write to info@ccaevents.es stating which right you want to exercise; if we cannot verify your identity, we may ask for an identity document.

If you believe we have not handled your data properly, you can file a complaint with the Catalan Data Protection Authority (apdcat.gencat.cat) or the Spanish Data Protection Agency (www.aepd.es).

8. Minors

Children under 14 may not send us data without the consent of their parents or guardians. If we find they have done so, we will delete it.

9. Security

We apply appropriate technical and organisational measures to protect data: the site always runs over an encrypted connection (HTTPS), access to data is restricted and our providers offer security guarantees.

10. Changes to this policy

We may update this policy to reflect legal or service changes. The date of the last update is shown at the top of the page.