1. Controller
The controller is Oasis Zen SL, tax ID B22585046, Calle Emilio Ortuño 5, 2º, 2, 03501 Benidorm, Alicante, Spain. For privacy questions and rights requests: onedownenough@hotmail.com or +34 666 916 044.
2. Information processed
The form asks for name, email, client type, service and message. You may add telephone, company, approximate participant count, preferred date and time window. Required fields are marked. The enquiry language and technical form name are also received.
We do not ask for identity numbers, home addresses, birth dates, card details, identity documents or health information. Do not include them in the message. Suitability is discussed privately before confirmation using only necessary information.
Selections, filters and estimates are calculated in your browser. Using them does not transmit data; a selection is added to an enquiry only when you choose to continue. Hosting may process IP address, access time, browser technical data and security logs.
3. Purposes and legal basis
- Responding, quoting and reviewing availability: pre-contract steps at your request, GDPR Article 6(1)(b).
- Managing a confirmed appointment or assignment: contract performance, Article 6(1)(b). For business representatives, the legitimate interest in managing the professional relationship may apply, Article 6(1)(f).
- Invoicing and compliance with legal obligations: Article 6(1)(c).
- Security, abuse prevention and the defence of claims: legitimate interests, Article 6(1)(f), balanced against individuals’ rights.
The privacy checkbox acknowledges that you have read this information. It is not an advertising subscription or a waiver of rights. We do not use automated decisions or commercial profiling.
4. Recipients and service providers
The website is prepared for hosting and form reception through Netlify, Inc. Correspondence at the published address uses Microsoft Outlook/Hotmail. Accounting, technical support or advisory providers may access only the information needed for their role, subject to appropriate safeguards.
We do not sell data. Information may be disclosed to authorities where legally required. If a provider processes information outside the European Economic Area, transfers must use a valid mechanism, such as an applicable adequacy decision or standard contractual clauses, with any necessary additional safeguards.
5. Retention and security
Enquiries that do not lead to a contract are normally retained for up to 12 months after the last useful contact. Contract and invoicing information is retained for applicable statutory and limitation periods, then deleted or restricted as required.
Access is limited by role, hosted delivery uses HTTPS and appropriate provider access and security settings must be maintained. No system is entirely infallible. Data incidents are handled and reported where required by law.
6. Your rights
You may request access, correction, erasure, restriction, objection and, where applicable, portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Some legal duties may prevent immediate deletion.
Write to the contact above. We respond within the GDPR timeframe, normally one month, with permitted extensions where necessary and communicated. Identity verification is proportionate: do not attach identity documents pre-emptively.
You may complain to the Spanish Data Protection Agency or the competent authority where you live.