Privacy Policy

1. Data controller

Trading name

Sportlidays

Data controller (legal name)

[TO BE CONFIRMED]

NIF / Tax ID

[TO BE CONFIRMED]

Address

[TO BE CONFIRMED]

Contact email

info@sportlidays.com

Sportlidays is finalising its legal registration in Spain; the controller identification details will be completed on this page once confirmed. In the meantime, all privacy requests can be sent to info@sportlidays.com and will be handled in accordance with this policy.

2. Which forms collect personal data

The only form on this website that collects personal data is the Request a Quote form (available in English and Spanish, and also reachable from the sports pages with the sport and hotel pre-filled). There is no user registration, no login area, no online booking and no payment processing on this website.

You may also contact us directly by email, telephone or social media; in that case we process the data you choose to send us for the same purposes described below.

3. What personal data we collect

We do not request special-category data (health, religion, political opinions, etc.). Please do not include such information in the free-text message field. If you submit data about other members of your group, you confirm that you are entitled to do so and that you have informed them about this policy.

• Identification and contact data: name, email address, telephone number (optional).
• Enquiry data: destination, accommodation type, sport or experience, preferred dates, number of people, and the free-text message you write, including any hotel reference automatically added when you arrive from a sports page.
• Language of the request (English or Spanish) and the record that you accepted this Privacy Policy.
• Technical data processed by our hosting provider to deliver and secure the website, such as IP address and standard server log data.

4. Why we collect it and legal basis

We do not use the data submitted through this website to send newsletters or marketing communications. If we introduce such communications in the future, we will request separate, specific consent.

• To answer your enquiry and prepare a tailor-made quotation — legal basis: your request and the steps taken prior to a possible contract (GDPR Art. 6.1.b), and your consent given when submitting the form (Art. 6.1.a).
• To communicate with you about that enquiry (email, telephone) — same legal basis.
• To keep a record of enquiries and of consents given, and to secure our systems — legitimate interest in the proper management, evidence and security of our commercial activity (Art. 6.1.f).
• To comply with legal obligations where applicable (Art. 6.1.c).

5. How long we keep the data

Enquiry and quotation data is kept for as long as necessary to handle your request and for the duration of the commercial relationship, and thereafter for a maximum of three years from the last contact, so that we can respond to follow-up requests and evidence the consent given.

Where a commercial or contractual relationship results, data may be kept for the legally required periods (in particular tax and accounting obligations). After those periods the data is deleted or anonymised.

6. Who receives or processes the data

Data submitted through the form is stored in our website database and sent as an internal notification email to info@sportlidays.com. It is accessed only by Sportlidays staff who need it to prepare your proposal.

The following service providers process data on our behalf as processors under a data processing agreement:

• Lovable (Lovable Labs Inc.) — website platform, hosting and content delivery, and the transactional email service that delivers the internal notification of your enquiry.
• Supabase — managed database service where quotation requests and the email delivery log are stored.
• The website's typography is self-hosted on our own domain; no fonts, scripts or other content are requested from third parties such as Google when you browse the site.

7. Disclosure to third parties

We do not sell or rent personal data. Where preparing your proposal requires it, we may share the strictly necessary details (for example names for a rooming list, group size or dates) with hotels, sports facilities, transfer companies or other local partners involved in your request. We do this only to the extent needed to quote or deliver the service you asked for.

Data may also be disclosed to public authorities where required by law.

8. International data transfers

Our providers may process or store data outside the European Economic Area (in particular in the United States, in the case of our platform, hosting and email providers). Where this happens, transfers are covered by the safeguards provided under Chapter V of the GDPR, primarily the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

If your request involves partners outside the EEA, we will inform you beforehand.

9. Your rights

To exercise these rights, write to info@sportlidays.com indicating the right you wish to exercise. We may ask for proof of identity. We will reply within one month.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you consider that your rights have not been respected.

• Access — to know whether we process your data and obtain a copy.
• Rectification — to correct inaccurate or incomplete data.
• Erasure — to have your data deleted where no longer necessary.
• Restriction and objection — to limit or object to certain processing.
• Portability — to receive your data in a structured, commonly used format.
• Withdrawal of consent — at any time, without affecting processing carried out before withdrawal.

10. Security measures

Data is transmitted over encrypted HTTPS connections and stored in a managed database with access control and row-level security rules; write access to submitted enquiries is restricted to the website's server-side process, and read access to authorised Sportlidays administration only. Access credentials are stored as protected secrets and never exposed in the website's public code.

No system can guarantee absolute security, but we apply technical and organisational measures appropriate to the risk and review them periodically.

11. Cookies

This website uses only technically necessary storage. Full details are available in our Cookie Policy.

12. Changes to this Privacy Policy

We may update this policy to reflect changes in our activity or in applicable legislation. The version published on this page, with its update date, is the one in force.

13. Contact

For any question about this Privacy Policy or about how we handle your data: info@sportlidays.com.