PRIVACY POLICY

This policy explains what personal data is collected through the website impalaya.com, what it is used for, how long it is kept and what rights users can exercise, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Impalaya processes the personal data that users provide voluntarily when using the website, especially when they request information or a quote for team building activities, events or other services. Depending on how the website is used, this may include:

• Identification data: first and last name and, where applicable, company and job title.
• Contact details: email address and telephone number.
• Information about the request: the content of messages and the event details given in the contact form, by email or by WhatsApp (date, city, number of participants, activity of interest, etc.).
• Technical and browsing data: IP address, device and browser type, pages visited and interactions, collected through cookies or analytics tools when the user has accepted them.

Impalaya does not request special categories of data (health, beliefs, ethnic origin, etc.). Users are asked not to include sensitive information in forms or messages. If such information is needed for a specific activity (for example, participants’ allergies or accessibility needs), users will be informed beforehand of how it is processed.

If the user provides data about other people (for example, other participants in an event), they confirm that they have informed those people and have their permission to share it.

Personal data is processed for the following purposes, each with its legal basis under Article 6 GDPR:

• Answering enquiries and quote requests and preparing activity proposals. Legal basis: steps taken at the request of the data subject prior to entering into a contract and, for general enquiries, the legitimate interest in replying to whoever gets in touch.
• Managing the contractual relationship: organising and delivering the services booked, invoicing and keeping in touch with the client. Legal basis: performance of a contract.
• Complying with legal obligations such as tax and accounting obligations. Legal basis: compliance with a legal obligation.
• Managing the website: keeping it running, secure and administered. Legal basis: Impalaya’s legitimate interest in the proper operation and security of the website.
• Analysing website use through browsing statistics to improve its content. Legal basis: the user’s consent given through the cookie banner.
• Sending commercial communications about new activities or services, only where the user has agreed or is a client who has not objected. Legal basis: consent or, for clients, legitimate interest under Article 21.2 of the LSSI-CE. Every communication will include a simple way to unsubscribe.

Data will not be used for purposes incompatible with those for which it was collected, nor for automated decision-making or profiling with legal effects. Where processing is based on consent, the user may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

Fields marked as mandatory in the contact form are needed to handle the request; if they are not provided, it will not be possible to reply.

• Enquiries and quotes that do not lead to a booking: up to 12 months from the last contact, to allow reasonable follow-up of the request.
• Clients: for the duration of the contractual relationship and afterwards for the applicable legal periods: 6 years for accounting records and invoices (Spanish Commercial Code), 4 years for tax purposes (General Tax Law) and 5 years to deal with any civil liability.
• Commercial communications: until the user withdraws consent or objects.
• Analytics data: up to 14 months, according to the analytics tool’s settings. Cookies are kept for the periods stated in the Cookie Policy.

Once these periods have ended, the data will be deleted or anonymised.

Personal data is not sold or disclosed to third parties, except where required by law (for example, to the Spanish Tax Agency or to courts).

Service providers working for Impalaya may access it as processors, only to the extent necessary and under the contractual safeguards required by Article 28 GDPR:

• Web hosting, technical maintenance and email providers.
• Google Ireland Ltd. (Google Analytics), for web analytics, only if the user accepts it.
• Tax and accounting advisers, to meet legal obligations relating to clients.
• Partner professionals (hosts or activity providers), only with the data strictly needed to organise the booked event.

If the user gets in touch via WhatsApp, the conversation takes place through WhatsApp Ireland Ltd. (Meta group), subject to its own terms and privacy policy.

International transfers: some of these providers (such as Google or Meta) may process data in the United States. These transfers are covered by the EU-US Data Privacy Framework or, failing that, by the standard contractual clauses approved by the European Commission.

Where applicable, users may exercise the following rights:

• Access: find out whether their data is being processed and obtain information about that processing.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask for their data to be deleted when the legal requirements are met.
• Objection: object to certain processing, in particular commercial communications.
• Restriction of processing: ask for the use of their data to be temporarily restricted in the cases provided by law.
• Portability: receive the data they provided in a structured format and transmit it to another controller.
• Withdrawal of consent: at any time, where consent is the legal basis.

To exercise these rights, simply write to info@impalaya.com stating which right you wish to exercise. If there is reasonable doubt about the requester’s identity, the information needed to verify it may be requested. Requests will be answered within one month at most and are free of charge, except in the exceptional cases provided for by law.

If users consider that their data is not being processed in accordance with the law, they may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

Impalaya applies appropriate technical and organisational measures to protect personal data against loss, alteration, disclosure or unauthorised access, taking into account the nature of the data and the risks of the processing. Access to data is limited to the people and providers who need it for the purposes described, who are bound by confidentiality.

No transmission or storage system can guarantee absolute security. Measures are reviewed regularly and, in the event of a security incident, action will be taken as required by law, including notifying the AEPD and the people affected where appropriate.

Impalaya’s services are aimed at companies, organisations and adults. The website is not intended for children under 14, who should not provide personal data through it. If data about minors is processed in connection with a booked activity, the consent or representation requirements set by applicable law will apply.

The website includes links to social networks (such as LinkedIn), Google Maps, WhatsApp and other third-party pages. When visiting them, users are subject to those providers’ privacy policies and terms, whose practices Impalaya does not control. We recommend reading them before sharing any personal information.

The website uses cookies that are necessary for it to work and, only if the user accepts them in the cookie banner, cookies in the “Statistics” category (Google Analytics) and the “Marketing” category (Google Ads). Non-necessary cookies are not activated until the user gives consent, which they can change or withdraw at any time with the “Manage cookies” button in the bottom-left corner of the screen.

Detailed information about the cookies used, their purpose, duration and providers is available in the Cookie Policy.

Impalaya may update this policy to reflect legal, technical or organisational changes. The current version will always be available on this page with its update date. Where a change is significant or requires action from users, they will be informed by appropriate means.

For any questions about this policy or the processing of their data, users can write to info@impalaya.com or to the postal address given in section 1.

Last updated: October 2026.