Privacy policy
Data controller
The controller of your data is Flipa Land S.L, tax ID B26848234, registered at Rotonda de el Mirador S/N, 30730 San javier. For any matter relating to this policy or to exercising your rights you can write to us at hola@jumpingjump.es.
What data we process and how we collect it
We process the data you provide and the data generated when you use the website. When you register and create an account we collect your name, email address, phone number, your password (which we always store encrypted, never in plain text) and your preferred language. When you buy tickets or book a pack we process your order data: products, time slot, quantities, amounts and payment status. For birthday and event bookings we also process the information you enter in the booking form (for example notes or remarks) and, where applicable, the data the form requests for each guest. While you browse we generate technical and security data: your IP address, browser type and activity logs, used to keep your session, prevent abuse and protect your account. We also use cookies; the details are in our Cookie policy, which you can access from the footer.
Minors' data and health data (birthday bookings)
When you book a birthday party we ask you to complete a form for each invited child, which may include their name, allergies or intolerances, remarks and special menu. This information includes minors' data and health data (allergies and intolerances are a special category of data). We only process it to organise the event you have booked and to ensure food safety. The processing of health data (allergies and intolerances), being a special category, is based on the explicit consent of the responsible parent adult (Art. 9.2.a GDPR) and, where applicable, on the protection of the child's vital interest for food safety (Art. 9.2.c GDPR). The data must always be provided by the adult booking the party, acting as the parent, guardian or person holding parental authority over the children, with their consent; by entering it in the form you confirm that you have such authorisation. The exact set of fields requested in the booking form or per guest may vary, as it is configurable; in any case we only ask for what is necessary to provide the service you have booked.
Why we use your data and on what legal basis
We process your data to create and manage your account, handle your purchases and bookings, issue tickets, control park access and respond to your enquiries; the legal basis is the performance of the purchase contract or the pre-contractual steps you request (Art. 6.1.b GDPR). We process your data to send you marketing, news or offers only if you give us your consent, which is freely given and revocable (Art. 6.1.a GDPR); consent is also the basis for loading non-essential cookies. We process your data to issue and keep invoices and accounting records under a legal obligation (Art. 6.1.c GDPR). And to keep the website and your account secure, prevent fraud and be able to evidence the consents given, we rely on our legitimate interest and the duty of accountability (Arts. 6.1.f, 5.2 and 32 GDPR).
Recipients and data processors
We do not sell your data. To provide the service we use suppliers that process data on our behalf, as data processors: the payment provider Redsys and the bank, which process the card payment; Cloudflare, whose anti-bot system (Turnstile) protects our forms when enabled; our email delivery provider (verifications, order notices and similar); and our hosting provider, which hosts the application and the database. We also use Bunny Fonts (BunnyWay d.o.o., based in Slovenia, EU) to serve the website fonts; this provider receives your browser's IP address on each load, uses no cookies and is offered as GDPR-compliant, so it does not involve an international transfer outside the EU. Payment always takes place within the secure Redsys environment: we do not store your card details. From the payment response we keep only the information needed for support and reconciliation (card brand and country, authorisation codes, amounts and dates), never your card number. The identity of the email provider and the hosting provider is [PENDING: designate email and hosting provider].
Third-party content (map and social media)
If you have consented through the cookie banner, we display embedded third-party content: the Google Maps map (Google) and, in the gallery, the Instagram or TikTok feed through services such as SnapWidget or LightWidget. Until you accept them, this content is not loaded. These providers may receive your IP address and browser data. You will find the details in the Cookie policy.
International data transfers
Some of the above providers are companies based in the United States: Cloudflare (anti-bot), Google (map) and the social feed services (SnapWidget/LightWidget). When active, using these services involves an international data transfer to the United States, usually covered by the EU-US Data Privacy Framework or by standard contractual clauses. The specific transfer mechanism of each provider is [PENDING: confirm Data Privacy Framework or standard clauses for each provider]. The location of our hosting provider's servers, and therefore whether there is an international transfer through hosting, is [PENDING: confirm hosting server location].
How long we keep your data
We keep your account data while your account remains active and, afterwards, for the legal periods we are required to; in particular, data linked to your orders and invoices is kept for the periods required by tax and commercial law. The specific tax retention period for accounting records is [PENDING: confirm tax retention period with the accountant (typically 4 to 6 years)]. Orders you leave unpaid expire automatically when the seat hold lapses, releasing the capacity. The records evidencing your cookie consent are kept for a maximum of 24 months. Your session expires after a period of inactivity.
Your rights
You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of prior processing. For your convenience, several of these rights you can exercise yourself from "My account": download a copy of all your data in a machine-readable file (access and portability) from the export option, and rectify your name, phone, language or email directly in your profile. You can also delete your account from "My account": instead of deleting your orders, we anonymise your account (we overwrite your name, email, phone and password, and remove your consents), keeping only what is strictly necessary to comply with our tax obligations regarding invoices. To exercise the remaining rights, such as objection or restriction, or if you prefer to request access or erasure in writing, write to us at hola@jumpingjump.es; we may ask you to prove your identity.
Marketing communications and how to unsubscribe
We will only send you marketing communications if you have expressly consented when registering, never pre-ticked. You can withdraw this consent at any time by writing to us at hola@jumpingjump.es. The mechanism to unsubscribe directly from the communication itself or from your account is [PENDING: confirm marketing unsubscribe mechanism].
Automated decisions and profiling
We do not make automated decisions producing legal effects on you or significantly affecting you, nor do we carry out profiling with your data.
Security measures
We apply technical and organisational measures to protect your data. Your password is always stored encrypted, and we check that it does not appear in known data breaches before accepting it. We verify your email through an expiring link and, if you change your email, we do not replace the current one until you confirm the new one, notifying the old one. We limit login and registration attempts to deter brute-force attacks, and we protect public forms against bots. Sessions are managed with secure cookies and you can close them on other devices. We apply security headers and a content security policy (CSP) on the website. In our internal logs we minimise data: we do not store passwords or sensitive identifiers in plain text, but encrypted or anonymised.
Complaint to the supervisory authority
If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001 Madrid, and through its electronic office at www.aepd.es. However, we would appreciate it if you first contacted us at hola@jumpingjump.es to try to resolve your request.
