Privacy Policy

1. Who processes your data

We have not appointed a data protection officer. For anything relating to this policy, write to info@aquafunmogan.es.

2. What we process, what for, and on what legal basis

2.1 Booking an activity

Data: your name, email address, phone number and the language you browse in; and, for the booking itself, the departure you chose with its date and time, how many people are boarding, the amount, the payment method and whatever you write in the notes field, which is free-form and optional.

The phone number is required, and not for convenience: this activity gets cancelled because of swell, wind or calima, sometimes the same morning. An email is not read at seven in the morning; a phone is.

What for: to make and confirm your booking, to provide the activity, to warn you of a change or a cancellation, to issue the invoice and to handle incidents and refunds.

Legal basis: performance of the contract (art. 6.1.b GDPR) and, for invoicing and accounting, compliance with legal obligations (art. 6.1.c GDPR).

Providing them is required: without them we cannot make the booking.

2.2 Payment: your card never passes through this website

If you pay by card, the payment form belongs to Stripe and is hosted on Stripe's own domain. Neither your card number nor your CVV ever reach this site, and they are not stored here. Of that payment we keep only the identifiers Stripe returns to us, so we can reconcile the charge and, where applicable, process a refund.

If you choose to pay in cash on the day of the activity, no payment data is processed at all: you pay the operator at the quayside.

2.3 Health data: this website does not ask for it

The booking form does not ask whether you can swim, your weight, whether you are pregnant or whether you have any medical condition. There is no field for it and no health data is stored in any structured way.

What there is is a free-form notes field. If you choose to write a health circumstance there, that sentence is stored alongside your booking and used only to provide the activity safely. You can ask us to delete it at any time by writing to info@aquafunmogan.es.

2.4 Requesting a quote

Some activities do not publish a price and are requested through a form. In that case we process your name, email, phone, the approximate date, how many people there would be and the message you write to us.

What for: to reply with a quote. That request is not a booking: it does not charge you, does not take a seat and does not commit you.

Legal basis: pre-contractual measures taken at your request (art. 6.1.b GDPR).

2.5 Access to your bookings

To see your bookings you do not have to create an account or remember a password: you request a link to your email and that link opens a session. We process your email address to send it to you, and a technical cookie in your browser to keep the session open.

Legal basis: performance of the contract (art. 6.1.b GDPR).

2.6 Cookies and audience measurement

The cookies that keep your session open are strictly necessary and do not require your consent (art. 22.2 LSSI, the Spanish e-commerce act).

We also measure how many visits each page receives using Google Analytics, and that does require your consent: nothing from Google is loaded until you accept it in the banner, and if you choose «only what is necessary» no measurement cookie is written. We do not advertise and we do not build profiles: advertising and personalisation are switched off explicitly.

And there are two things that are never sent, not even if you accept. First: the address is sent without its query string, because this site has links that are a key — the one that opens your booking, or the one that gives you access to your bookings from your email. Second: we do not measure on the booking, sign-in or customer-area pages, which are the ones carrying your data.

You can change your mind whenever you like from the link in the footer. Withdrawing consent costs exactly what giving it costs. There is more detail in the Cookies Policy.

2.7 WhatsApp

The WhatsApp button is an ordinary link: it loads no third-party software and writes no cookie until you press it. If you write to us there, that channel is provided by WhatsApp Ireland Limited under its own terms, which are not ours to set.

3. How long we keep it

4. Who we share it with

We do not sell your data and we do not pass it to anyone for their advertising.

Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on the standard contractual clauses approved by the European Commission or on an adequacy decision (arts. 45 and 46 GDPR). You can ask us for a copy of the safeguards applied by writing to info@aquafunmogan.es.

5. Your rights

You may exercise, free of charge, the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

How: write to info@aquafunmogan.es stating which right you are exercising. We may ask you to prove your identity. We will reply within one month.

If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), without prejudice to any other remedy.

6. Security and automated decisions

The site is always served over an encrypted connection and booking data lives in a database that is not reachable from the internet.

We do not take automated decisions and we do not build profiles that produce legal effects concerning you.

7. Changes to this policy

We may update it when the law or the way we process data changes. The version in force is always the one published on this page, with its update date.