Privacy Policy

1. Data controller

Grup Bages Formadors SL, tax ID B61690723, registered office at C/ Dupont 34, 08262 Callús (Barcelona, Spain). Contact for any privacy matter: hola@forholidays.app.

Data Protection Officer: [COMPLETAR: confirmar si se ha designado Delegado de Protección de Datos; si no, indicar que el contacto es hola@forholidays.app]

Where we manage travellers' data on behalf of an Operator (see section 3), the Operator is the controller and For Holidays acts as processor.

2. What data we process, why and on what legal basis

• Operators (businesses publishing activities): name or company name, tax ID, contact details, activity details, bank details for payouts, and communications. Purpose: create and manage the account, provide the service, pay out and invoice. Basis: performance of a contract and legal obligations.
• Travellers (people booking): name, email, phone (if requested), booking details (activity, date, people, amount), payment status, and IP address and technical data needed for security. Purpose: manage the booking, process payment, send confirmations, handle incidents, prevent fraud and meet accounting obligations. Basis: performance of a contract, legal obligation and legitimate interest (security and fraud prevention).
• Enquiries and sales contact (request, demo or email forms): contact and business details. Purpose: reply to your request. Basis: your consent or pre-contractual steps taken at your request.
• Website visitors: technical browsing data and, only if you accept in the cookie notice, usage statistics through Google Analytics 4. Basis: consent (art. 6(1)(a) GDPR). More in the cookie policy.
• Commercial communications to professionals: if you receive a commercial electronic communication from us, you may object to receiving more at any time (art. 21 LSSI and art. 21 GDPR) by replying to the message or writing to hola@forholidays.app. Basis: legitimate interest in promoting our services to businesses, or your consent [COMPLETAR: confirm the legal basis for business prospecting with the gestor].

We do not take automated decisions with legal effects on you. The service is not aimed at children under 14 and we do not knowingly collect their data without their guardians' authorisation.

3. Our role regarding travellers' data

For its own operations (payment, fraud prevention, invoicing, security, platform support) For Holidays is the controller. To manage the Operator's bookings and send confirmations on its behalf, For Holidays is the processor and processes data on its instructions under the Data Processing Addendum. The Operator is responsible for how it uses the data it receives to deliver the activity.

4. Who we share your data with (processors and recipients)

We do not sell your data. We disclose it only to the providers that make the service possible, who act under contract in line with art. 28 GDPR:

• Supabase — database and authentication (hosting of account and booking information).
• Vercel — hosting and running the website and application.
• Stripe — payment and refund processing. Stripe processes payment data as an independent controller for its fraud-prevention and regulatory obligations; see its privacy policy.
• Google — sending transactional emails (booking confirmations) through the Gmail API, optional Google Calendar sync for Operators who enable it and, only with your consent, Google Analytics 4.
• Upstash — request rate-limiting service that protects forms and the API from abuse; it processes IP addresses transiently, when enabled.
• The Operator of the activity you book, which receives the data needed to deliver it.
• Authorities and advisers, where required by law or needed for the company's tax, accounting and legal management.

5. International transfers

Some providers (for example Stripe, Google, Vercel or Upstash) may process data outside the European Economic Area, in particular in the United States. In such cases the transfer relies on a European Commission adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the Commission's standard contractual clauses, with supplementary measures where appropriate. The database hosting region is [COMPLETAR: Supabase region (e.g. EU – Frankfurt/Ireland) and Vercel region; confirm].

6. Retention periods

• Booking, payment and invoicing data: for as long as necessary and then blocked for the statutory limitation periods of commercial and tax obligations (generally up to 6 years).
• Operator account data: while the account is active and then for the applicable statutory periods.
• Enquiries and sales contacts: while the relationship or request continues and at most [COMPLETAR: period, e.g. 24 months] from the last contact.
• Statistics (Google Analytics): per the tool's configuration, [COMPLETAR: retention period configured in GA4].

When the periods end we delete or anonymise the data.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, by writing to hola@forholidays.app stating your request (we may ask you to verify your identity). We reply within one month.

If you believe your rights have not been met, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority of your country of residence.

8. Security

We apply reasonable technical and organisational measures to protect data: encrypted connections (HTTPS), access control and separation of data between operators, not storing card data (handled by Stripe) and limiting staff access to what is necessary. If a security breach affecting you occurs, we will notify the authority and, where required, you, in accordance with the law.

9. Changes to this policy

We may update this policy to reflect changes in the service or the law. The date at the top shows the latest revision. If the change is substantial we will tell you by a suitable means.