Privacy policy

CONSENT CLAUSE FOR THE COLLECTION OF DATA FROM CAMP ATTENDEES

Article 11. Transparency and information to the data subject.

1. Where personal data are obtained from the data subject, the controller may comply with the duty of information laid down in Article 13 of Regulation (EU) 2016/679 by providing the data subject with the basic information referred to in the following paragraph and indicating an email address or other means that gives simple and immediate access to the remaining information.

2. The basic information referred to in the previous paragraph shall contain, at least:

     a) The identity of the controller and of its representative, where applicable.

     b) The purpose of the processing.

     c) The possibility of exercising the rights laid down in Articles 15 to 22 of Regulation (EU) 2016/679.

If the data obtained from the data subject are to be processed for profiling, the basic information shall also include this circumstance. In this case, the data subject must be informed of their right to object to the adoption of automated individual decisions that produce legal effects concerning them or similarly significantly affect them, where this right applies in accordance with Article 22 of Regulation (EU) 2016/679

The controller of your personal data is CASTILLO DE LAYOS S.L.

Main purposes (i) Managing user registration on our App and website (ii) Answering the enquiries submitted, (iii) Developing, performing and executing the pre-contract and, where applicable, the contract for the provision by CASTILLO DE LAYOS of the camp services requested. (iv) If you provide us with your CV, including you in a selection process and, if you so agree, including you in our candidate file, (v) If you give your consent, using the data to inform users, by electronic means, of advantages, discounts and third-party promotions associated with that status.

You have the right to access, rectify, restrict the processing of and erase your data, and to request its portability.

This Privacy and Data Protection Policy is intended to give users all the information they need to understand the scope and purpose of the data processing, so that their acceptance, which is absolutely necessary in order to access and use the website and App, rests on fully informed consent as provided for in the data protection legislation applicable at any given time.

1.- Who is the controller of your data?

Name: Castillo de Layos, S.L. (hereinafter “CASTILLO DE LAYOS”)
Registered office: C/ Garza 11, C.P. 28023 - Madrid.
Telephone: 91 357 2564
Email: info@layoscamp.com

CASTILLO DE LAYOS wishes to provide, in a transparent manner, information on the data processing it carries out, its legal basis and the rights that data subjects have with regard to the processing of their personal data. Accordingly:

• All the information is permanently available to data subjects in this Privacy and Cookies Policy, so that they can consult it whenever they see fit, and, in addition,
• Data subjects will be informed about each processing of their personal data as they interact with CASTILLO DE LAYOS.

2.- What personal data do we process and for what purposes?

Depending on whether the data subject books a course or camp stay, purchases it, authorises the sending of commercial communications, wishes to work for CASTILLO DE LAYOS or simply gets in touch or requests some kind of information, CASTILLO DE LAYOS will need to process different data, which will generally be the following, as the case may be:

 

• Identification data of the user and of the prospective camp attendee, such as name, surname, contact details, DNI or passport details if necessary, etc.

In any event, we remind you that the personal data processed by CASTILLO DE LAYOS are the personal data collected from data subjects when the course or camp is booked. During the contractual relationship, CASTILLO DE LAYOS will normally need to process data of third parties who are minors that the client (hereinafter, “campers”), the parent exercising parental authority or the guardian, may provide. In this regard, CASTILLO DE LAYOS will under no circumstances use the data that the client has provided about the camper outside the services specifically contracted, and only insofar as such data are necessary for booking and/or managing them.

The camper’s own safety and protection require the parents exercising parental authority or the guardians to provide any information concerning the camper’s health or special needs so that CASTILLO DE LAYOS can diligently manage the course or camp accordingly. Any omission of such information releases CASTILLO DE LAYOS from all liability that it would have had to assume had it known those data.  

• Financial and transaction information (for example, payment or card details). In this respect, CASTILLO DE LAYOS informs you that credit card personal data will be stored in the point-of-sale terminals that handle the online payment, not on its platform.
• Connection and browsing data, since, like many websites and online services, CASTILLO DE LAYOS uses cookies and other technologies to keep a record of your interaction with our services. Cookies help to manage a range of features and content, as well as to store searches and present your information again when you book a new trip, for example. For more information about the types of cookies and similar technologies we use, and why and how you can control those technologies when you interact with us, see the Cookie Policy.
• Where you have expressly authorised the processing of your image or that of the minor camper for whom you are the parent exercising parental authority or the guardian, the image may be disseminated publicly and privately on pages managed by CASTILLO DE LAYOS, on its intranet or on its profiles on the various social networks, for educational and/or commercial purposes, in which the data subject is taking part in course or camp activities.

When CASTILLO DE LAYOS requests certain personal data from the data subject in order to give access to a feature or service of the website, it will mark some fields as mandatory, because those data are necessary for CASTILLO DE LAYOS to provide that service. Failure to provide the required data may mean that the requested registration, the booking of the selected trip or the completion of its purchase cannot be carried out.

Depending on how the data subject interacts with the website, CASTILLO DE LAYOS will process personal data for the following purposes:

• To manage user registration on the website and/or App: In this case, CASTILLO DE LAYOS will need to process the data subject’s personal data in order to identify them as a user and give them access to the various features and services available to them as a registered user. The data subject may cancel their registered user account by contacting CASTILLO DE LAYOS through any of the channels indicated above.
• For the development, performance and execution of the contract for the course or camp booked with CASTILLO DE LAYOS on the website: This purpose includes the processing of your data mainly in order to:

1. Contact the user regarding updates or informative communications related to the service contracted.
2. Manage the camp booking and, if the booking goes ahead, the payment for the camp subsequently purchased.

• Where the data subject has only contacted CASTILLO DE LAYOS, it will process their data to deal with the requests or enquiries for information they make regarding the camp contracted. CASTILLO DE LAYOS will only process the personal data that are strictly necessary to manage or resolve the request or enquiry.
• For commercial purposes: This purpose includes the processing of your data mainly in order to:

1. Once the user is a client of CASTILLO DE LAYOS, they will receive news about camps and similar services that are suited and similar to those already contracted. However, the client is informed that they may object at any time by contacting CASTILLO DE LAYOS through the channels already indicated.
2. Where the user has given unambiguous consent, CASTILLO DE LAYOS may send them commercial communications and news that may be of interest to them as a registered user or client. Likewise, the user may object at any time.

• Where the data subject has sent their data in order to join the CASTILLO DE LAYOS team, the purpose of the processing is the selection of candidates for the jobs offered by CASTILLO DE LAYOS. If you provide us with references from third parties to verify the information supplied, you must first have informed those persons and obtained their consent to be contacted by CASTILLO DE LAYOS.

3.- What is the legal basis for processing your data?

The legal bases for processing your data are the following:

• The unambiguous consent of the data subject, based on Article 6.1.a) of the GDPR:

1. Obtained through the “contact” web form or through web user registration, and requested in order to reply to and advise on requests for information;
2. Obtained through web user registration and requested in order to book the services offered on the website;
3. Obtained through the checkbox provided on the website, for the sending of commercial communications;
4. Obtained when the data subject provides their CV, so that CASTILLO DE LAYOS may keep it in its database.
5. Obtained where the processing of the image of the pupil attending the course or camp has been expressly authorised.

• Management of pre-contractual and, where applicable, contractual measures, based on Article 6.1.b) of the GDPR.

1. The processing of the data subject’s personal data is necessary in order to manage their registration, as well as to apply the terms governing the use of the website.
2. Processing necessary to manage the camp booked and, where applicable, contracted. This section also covers the health and special needs data that have had to be provided so that CASTILLO DE LAYOS can manage the course or camp in a way that suits the camper.
3. With regard to CVs received, the processing is carried out in the context of an offer made by CASTILLO DE LAYOS and its acceptance by the job-seeking data subject.

• Legitimate interest, based on Article 6.1.f) of the GDPR:

1. To send commercial communications to users who are clients, provided that they relate to products similar to those they have contracted and without prejudice to the right to object to such communications at any time;
2. To deal with the requests or enquiries submitted through the various contact channels available. CASTILLO DE LAYOS considers that the processing of these data is also beneficial for the data subject, since it makes it possible to provide appropriate assistance and resolve the enquiries submitted.
3. To carry out the checks necessary to detect and prevent possible fraud when the client makes a payment. This processing benefits all the parties involved when a purchase is paid for; above all, it protects the client, since it allows CASTILLO DE LAYOS to put in place measures to protect them against fraud attempts by third parties.

• Compliance with legal obligations, based on Article 6.1.c) of the GDPR.

Where the data subject exercises the rights indicated below, or in the case of complaints relating to the services offered by CASTILLO DE LAYOS, the legal basis for CASTILLO DE LAYOS to process the data subject’s personal data is compliance with its legal obligations.

4.- How have your data been obtained?

They have been provided by the data subjects themselves when registering as users on the website, requesting information or requesting a booking. These data are normally provided through the website, but the user may have made contact by email or by telephone.

CASTILLO DE LAYOS wishes to remind you once again that the personal data processed by CASTILLO DE LAYOS are the personal data collected from data subjects when the course or camp services are booked. During the contractual relationship, CASTILLO DE LAYOS will normally process data of third parties who are minors that the client, as the parent exercising parental authority or the guardian, may provide, as is normally the case with the minors who attend the courses or camps booked. In this regard, the client undertakes to inform all these persons of the data protection provisions set out herein. For its part, CASTILLO DE LAYOS will under no circumstances use the data that the client has provided about these third parties outside the services specifically contracted, and only insofar as such data are necessary for booking and/or managing them.

5.- How long do we keep your data?

CASTILLO DE LAYOS processes the data for the time strictly necessary to fulfil the corresponding purpose. Afterwards, we will keep them duly blocked and protected for as long as liabilities arising from the processing may arise, in compliance with the legislation in force at any given time. Once any possible actions have become time-barred in each case, the personal data will be erased.

• With regard to data obtained through user registration on the website, CASTILLO DE LAYOS will process the data for as long as the user remains registered, that is, until they close their account.
• With regard to data obtained through the “contact” tab of the website, they will be kept for a maximum period of 12 months from the date on which they were obtained, provided that the data subject does not object to their processing.
• The personal data provided by data subjects when booking the services offered by CASTILLO DE LAYOS will be kept until the course and/or camp is confirmed and for the term of the contract, without prejudice to the fact that, if the data subject is registered as a user, they will be kept for as long as that status is maintained.

If, after the booking, the trip has not been confirmed and the money is refunded to the data subject, the data subject may close their account by contacting us through any of the channels indicated above.

• Where the data subject has sent their data in order to join CASTILLO DE LAYOS, the data will be used during the selection process. They will then be kept for a period of 3 years, if the data subject has authorised this. After that, they will be erased.

6.- To which recipients are your data disclosed?

The data obtained through the CASTILLO DE LAYOS website will only be disclosed to the service providers and suppliers of CASTILLO DE LAYOS for the organisation of the courses and/or camps. These third parties may be:

• Financial institutions with which CASTILLO DE LAYOS has entered into contracts for online point-of-sale terminals or other payment gateways.
• Insurance companies
• Technology service providers.
• Where applicable, schools and institutions where the courses take place, in which case the data will necessarily be disclosed for the stay that has been contracted. In such cases, these schools or institutions will be joint controllers. The data subject will be informed of this in each case.
• Service providers and partners such as wholesalers, transport providers or incoming agencies in the country of origin.

For reasons of service efficiency, some of the providers mentioned are located in territories outside the European Economic Area that do not provide a level of data protection comparable to that of the European Union, such as the United States. In such cases, we inform you that we transfer your data with appropriate safeguards and always keeping your data secure:

• With other providers, CASTILLO DE LAYOS has signed Standard Contractual Clauses approved by the Commission, the content of which you can consult at the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contractstransfer-personal-data-third-countries_en
• International data transfers to providers established in the US (Meta Platforms Ireland Ltd., Google Ireland Ltd.) are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission and, in the case of certified providers, by the EU-US Data Privacy Framework (DPF), in force since July 2023.

Server-side measurement with Google Analytics

When you accept analytics cookies, in addition to the standard Google Analytics cookies installed in your browser, LayosCamp sends Google Analytics, from its server, information about the camps you view (camp identifier, location, price and currency), linked to the anonymous identifier of the _ga cookie. The legal basis is your consent (Art. 6.1.a GDPR). You can withdraw it at any time from the cookie panel, which will immediately stop this transmission. The recipient is Google Ireland Ltd. (an international transfer covered by the European Commission’s Standard Contractual Clauses).

7.- What are your rights when you provide us with your data?

   1. Right of access:
Everyone has the right to obtain confirmation as to whether or not CASTILLO DE LAYOS is processing personal data concerning them.

   2. Right to rectification and erasure:
All data subjects have the right to request the rectification of inaccurate data or, where applicable, to request their erasure where, among other reasons, the data are no longer necessary for the purposes for which they were collected.

   3. Right to restriction of processing:
In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep them for the exercise or defence of claims.

   4. Right to object:
In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data. CASTILLO DE LAYOS will stop processing the data, except on compelling legitimate grounds or for the exercise or defence of possible claims.
With regard to processing based on your consent, you may withdraw it at any time by writing to the following email address: info@layoscamp.com.

   5. Right to data portability:
Where applicable, you may request the portability of your data.

   6. Right not to be subject to automated decision-making:

 

In any event, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), especially where you have not obtained satisfaction in the exercise of your rights. The Agency’s address is C/ Jorge Juan 6, 28001 Madrid, and its website is www.aepd.es.

 

Advertising processing with Meta via the Conversion API (server-side)

LayosCamp uses the Conversion API of Meta Platforms Ireland Ltd (based in Dublin, Ireland — EU) to measure the effectiveness of our advertising campaigns on Facebook and Instagram. We distinguish two flows with different legal bases:

Flow A — Conversion API linked to the browser pixel (cookie consent). When you accept the facebook_pixel service in our cookie banner, we supplement the events that the pixel in your browser sends to Meta (PageView, ViewContent, InitiateCheckout and, if the conversion happens while you are browsing, Purchase) with an equivalent transmission from our server, to improve the quality and deduplication of the measurement.

• Data sent in this flow: the visitor’s IP address, the browser’s User-Agent, Meta identification cookies (_fbp, _fbc) where they exist, email address hashed with SHA-256 (not in plain text), telephone number hashed with SHA-256 (not in plain text), name hashed with SHA-256 (not in plain text) and an internal event identifier (event_id) for deduplication.
• Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 of Law 34/2002, LSSI), given in the cookie banner.
• How to withdraw consent: from the cookie banner (the "Cookie settings" link in the footer). Once you withdraw it, this transmission linked to your browsing stops immediately.

Flow B — Conversion API for completed registrations (legitimate interest). When you complete a registration on LayosCamp.com, our server sends Meta, independently of the cookie banner, a Purchase event associated with that registration. This transmission is made for each completed registration (in processing or completed status) in order to measure how many families register after seeing our advertising and to optimise the advertising budget.

• Data sent in this flow: your email address hashed with SHA-256 (never in plain text), registration amount and currency, event timestamp, internal order identifier and internal event identifier (event_id) for deduplication. In this flow we never send the name of the camp, the location, the age or any data about the minor, nor any data on health, allergies, medication or diet. The data subject of this flow is the contracting adult, not the minor.
• Legal basis: legitimate interest of the controller (Art. 6.1.f GDPR). We have carried out the balancing test required by the GDPR: the purpose is to measure the return on advertising to which the contracting adult had already been exposed, the data only leave after a completed booking, they are pseudonymised with SHA-256 before leaving the server, and we preserve an effective right to object (see the rights section).
• How to object to this flow: write to info@layoscamp.com stating "no advertising measurement", or use the advertising unsubscribe link included in our commercial emails. Your objection does not affect your registration or the camp service; all that stops is the sending to Meta of the technical conversion event associated with your email address.

Joint controllership (Art. 26 GDPR): with regard to the processing of the data sent to Meta through both flows, Castillo de Layos, S.L. and Meta Platforms Ireland Ltd. act as joint controllers, under the terms of Meta’s Controller Addendum (available at facebook.com/legal/controller_addendum).

International transfer: Meta Platforms Ireland Ltd is located in Ireland (European Economic Area). For internal processing within the Meta group that may take place in the United States (Meta Platforms, Inc.), the transfer is based on (i) the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023; Meta Platforms, Inc. is listed as a certified entity at dataprivacyframework.gov) and, in the alternative, (ii) the Standard Contractual Clauses approved by European Commission Decision (EU) 2021/914. Privacy Shield is not relied upon (it was invalidated by CJEU judgment C-311/18 Schrems II).

Advertising exclusion audiences on Meta (Custom Audiences)

As a family business dedicated to camps since 1985, we do not want to bother you with adverts for something you have already booked. That is why, when you register for one of our camps, we may upload your email address, encrypted (SHA-256), to Meta Platforms Ireland Ltd. to create a “Custom Audience” that we use solely as an EXCLUSION: in other words, to stop showing you adverts for the spot you have already bought. We do not use this audience to show you more advertising.

Controller: Castillo de Layos, S.L., Calle Garza 11, 28023 Madrid (Spain). Contact: info@layoscamp.com.

Data processed: only your email address, encrypted with SHA-256 before it is sent. We do not upload any data about the registered minor to Meta (name, age, health): the only data processed are those of the adult listed as the contracting party.

Purpose: to suppress or reduce advertising for camps you have already bought, so that we do not show you irrelevant adverts.

Legal basis: legitimate interest (Art. 6.1.f GDPR). We have carried out the balancing test required by the GDPR and concluded that excluding you from advertising for a product you already have is beneficial to you and does not adversely affect your rights. You can object at any time (see below).

Joint controllership (Art. 26 GDPR): with regard to the creation and management of the audience, Castillo de Layos, S.L. and Meta Platforms Ireland Ltd. act as joint controllers, under the terms of Meta’s joint controller agreement (Controller Addendum, available at facebook.com/legal/controller_addendum).

International transfer (EU → US): part of Meta’s processing takes place in the United States. The transfer is based on (i) the EU-US Data Privacy Framework — Meta Platforms, Inc. is listed as a certified entity at dataprivacyframework.gov — and (ii) the Standard Contractual Clauses approved by European Commission Decision (EU) 2021/914.

Retention period: your encrypted email address remains in the audience only while the corresponding advertising campaign is active. We delete the audience from Meta as soon as that campaign closes, and at the latest 30 days after it closes. Once that period has elapsed, the data are no longer processed for this purpose.

Your rights: you can exercise your rights of access, rectification, erasure, restriction, portability and objection (ARSULIPO rights) by writing to info@layoscamp.com. In particular, you can object to this processing at any time at that same address, and we will stop including your email address in the audience. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Google Ads conversion tracking (offline conversions)

LayosCamp sends conversions to Google Ads from its own internal system in order to measure the effectiveness of our advertising campaigns and optimise spending. We distinguish two flows with different legal bases:

Flow A — events linked to the Google tag during your browsing (cookie consent). When you accept the gtag service in our cookie banner, the Google tag in your browser may record conversion events during your visit (for example Lead or InitiateCheckout) and send them to Google Ads.

• Data sent in this flow: anonymous identifiers associated with the tag, browsing on the site and the corresponding event.
• Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 of Law 34/2002, LSSI), given in the cookie banner.
• How to withdraw consent: from the cookie banner. Once you withdraw it, this transmission linked to your browsing stops immediately.

Flow B — offline conversions for completed registrations (legitimate interest). When you complete a registration on LayosCamp.com and you reached our website by clicking on a Google advert, our server sends Google Ads, independently of the cookie banner, an offline conversion associated with that registration. This transmission is made for each completed registration (in processing or completed status) and allows Google to attribute the conversion to the click on the advert.

• Data sent in this flow: advertising click identifier (gclid), event type (Purchase), conversion amount in euros, currency and event timestamp. NO email address, telephone number or user name is sent in this flow, either in plain text or hashed. Nor are the location, the age, the name of the camp or any data about the minor or about health sent.
• Legal basis: legitimate interest of the controller (Art. 6.1.f GDPR). We have carried out the balancing test required by the GDPR: the purpose is to measure the return on advertising to which the contracting adult had already been exposed, the data sent do not identify the minor, and we preserve an effective right to object (see the rights section).
• How to object to this flow: write to info@layoscamp.com stating "no advertising measurement", or use the advertising unsubscribe link included in our commercial emails. Your objection does not affect your registration or the camp service; all that stops is the sending to Google of the offline conversion associated with your registration.

International transfer: Google Ireland Ltd acts as processor under the Google Ads Data Processing Terms; for technical processing carried out in the US (Google LLC), the transfer is based on (i) the EU-U.S. Data Privacy Framework (Google LLC certified since July 2023) and, in the alternative, (ii) the Standard Contractual Clauses approved by the European Commission. Privacy Shield is not relied upon.

Event identifier (event_id) and deduplication

To avoid counting twice the same conversion event that may reach Meta through two channels (browser pixel + server-side Conversion API), LayosCamp assigns each event a unique internal identifier (UUID v4) called event_id. This identifier:

• Is generated when the form is submitted or the conversion takes place.
• Allows Meta and Google to deduplicate the event.
• Is not linked to personal data outside the scope of the form submission or order itself.
• Is deleted together with the form submission or order when its retention period expires.

Specific retention periods for advertising tracking data

Without prejudice to the general periods set out in the retention section:

• Leads not converted into registrations: the data associated with the conversion event (including event_id, gclid, _fbp, _fbc and hashes) are kept for 24 months from the date of the event. After this period they are anonymised or deleted.
• Clients converted into registrations: the associated data are kept for the term of the contract and thereafter for 6 years after the last registration, in compliance with the obligations under Article 66 of the General Tax Act (Ley General Tributaria) (retention of accounting/tax records). After that period they are deleted or blocked in accordance with the data protection legislation in force.

Health data of the minor (GDPR Art. 9)

Categories of data processed. Allergies and intolerances (food, environmental, drug), regular or occasional medication, dietary needs, special motor, sensory or learning needs, medical observations relevant to camp activities and, where appropriate, mental health diagnoses, psychiatric medication or information revealing a disability.

Source of the data. (a) The family’s declaration in the registration form and subsequent communications with the office; (b) detection by LayosCamp staff during the camp (for example, an allergy identified when checking meals, or a medication left out of the initial declaration).

Who has access. All authorised LayosCamp staff (counsellors, trainee counsellors, session coordinators, nursing staff and office staff) may consult the health data that are necessary for the care of the minor during their session. New data detected in the field may be added by any member of the authorised staff; the recording of particularly sensitive data (mental health, psychiatric medication, disability) is reserved for coordinators, nursing staff and office staff. All authorised staff sign a confidentiality undertaking before being given access to these data.

Validation process. Any health data added by staff in the field is recorded as “pending validation” and automatically triggers an alert to the office. The office checks the data with the family (usually by telephone or email) before adding it to the minor’s official record in our systems. The family may confirm, qualify or dismiss the data in that conversation.

Legal bases. Art. 9.2.h GDPR (healthcare and preventive medicine provided by staff subject to a duty of confidentiality), Art. 9.2.c GDPR (vital interest of the minor where the data can prevent immediate physical harm) and Art. 6.1.b GDPR (performance of the camp contract). In Spain, the LOPDGDD (Organic Law 3/2018) also expressly authorises this processing.

Purpose. To protect the health and physical integrity of the minor during their stay, prevent incidents (allergic reactions, medication errors, crises), adapt activities and meals to their needs and enable an appropriate medical response in an emergency.

Retention. The audit log of medical additions is kept for five years from the end of the session, a period necessary to deal with any liability claims and required by the applicable health regulations. After that period, it is deleted or anonymised.

Rights. You may exercise the rights of access, rectification, erasure, objection, restriction and portability at any time by writing to info@layoscamp.com. If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Controller. Castillo de Layos SL — Calle Garza 11, 28023 Madrid — info@layoscamp.com.