1 Introduction

At Gracie Barra Tenerife Sur, owned by José María Nieto, we are committed to protecting the privacy and security of our users' personal data. This Privacy Policy explains how we collect, use, and protect the information you provide to us through our website (graciebarratenerifesur.com) and other means of contact. By using our services, you accept the terms described in this policy.

2 Data Controller

The party responsible for the processing of your personal data is:

• Name: José María Nieto
• Brand: Gracie Barra Tenerife Sur
• Address: Calle Hermano Pedro 38, San Isidro, 38611 Santa Cruz de Tenerife, Spain
• Email: graciebarratenerifesur@gmail.com
• Phone: +34 666 587 723

3 Information We Collect

We collect personal information through the following means:

• Contact forms: To manage inquiries and information requests.
• Class and event registrations: To manage your participation in activities.
• Newsletters: To send news, promotions, and event information.
• Social media interactions: To respond to your comments and messages.
• Cookies and similar technologies: To improve your browsing experience and analyze the use of our website.

4 Purposes of Data Processing

We use your personal data for the following purposes:

• Manage your registration for classes, events, or programs.
• Respond to your inquiries and requests for information.
• Send commercial communications, such as newsletters and promotions (only with your consent).
• Improve our services and user experience on our website.
• Comply with legal and regulatory obligations.

5 Legal Basis for Processing

The processing of your data is based on:

• Consent: For sending newsletters and commercial communications.
• Execution of a contract: To manage your participation in classes or events.
• Legitimate interest: To improve our services and analyze website usage.
• Legitimate interest: Responding to inquiries and requests sent via forms, email, or WhatsApp.
• Compliance with legal obligations: When required by law.

6 Data Recipients

We do not share your data with third parties, except in the following cases:

• Service providers: Companies that help us manage the website, email, or registrations (e.g., analytics tools or payment platforms). These providers are required to comply with data protection regulations.
• Hosting and email services: Hosting and SMTP providers located in the EU or with appropriate guarantees.
• CDNs and analytics: Google Fonts, Font Awesome, and Facebook SDK integrated into some pages may process technical navigation data.
• Messaging channels: WhatsApp when you request it or accept it for communications regarding your inquiry.
• Legal obligations: When necessary to comply with applicable laws or regulations.

7 User Rights

As the owner of your personal data, you have the right to:

• Access the information we hold about you.
• Rectify inaccurate or incomplete data.
• Delete your data when it is no longer necessary.
• Object to the processing of your data in certain circumstances.
• Limit the use of your data in specific situations.
• Request the portability of your data to another controller.
• Withdraw your consent at any time.
• File a complaint with the Spanish Data Protection Agency (www.aepd.es).

To exercise these rights, you can contact us via:

• Email: graciebarratenerifesur@gmail.com
• Contact form: Available on our website

We will respond to your request within a maximum of 30 days.

8 Cookie Policy

Our website uses cookies to improve your user experience. Cookies are small text files stored on your device that allow us to:

• Keep your session active.
• Remember your preferences.
• Analyze traffic and website usage.
• Improve our services and content.

You can configure your browser to reject cookies, although this may affect some website functionalities.

You can review and modify your consent at any time from the "Cookie Settings" panel available on the website.

9 Security Measures

We implement advanced technical and organizational measures to ensure the security of your personal data, including:

• Encryption of sensitive data.
• Secure transmission via HTTPS.
• Restricted access to personal information.
• Continuous monitoring of our systems.
• Staff training on data protection.
• Regular backups to prevent data loss.

10 Data Retention Period

We will keep your personal data for as long as necessary to fulfill the purposes described in this policy, unless the law requires a longer period. For example:

• Class registration data: While your relationship with the club lasts.
• Marketing data: Until you withdraw your consent.
• Data for legal compliance: During the time required by applicable regulations.

11 External Links

Our website may contain links to external sites, such as tournament or federation pages. We are not responsible for the content, privacy practices, or security of these sites. We recommend reviewing their policies before providing any personal information.

12 Changes to the Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be published on this page, indicating the date of the last update. We recommend checking this policy periodically to stay informed about how we protect your information.

13 Contact

If you have any questions or doubts about this Privacy Policy or the processing of your personal data, do not hesitate to contact us via:

• Email: graciebarratenerifesur@gmail.com
• Contact form: Available on our website

14 Assumption of Risk and Limitation of Liability

By participating in our classes or events, you acknowledge and accept the risks inherent in the practice of Jiu-Jitsu. Gracie Barra Tenerife Sur is not responsible for injuries or damages that may occur during your participation, except in cases of gross negligence. We recommend informing us of any injury or medical condition before attending a class.

15 WhatsApp Communications

If you provide us with your phone number, we may contact you via WhatsApp exclusively to manage and respond to the inquiry you have sent through the website or our forms.

• Legal basis: Legitimate interest (Art. 6.1.f GDPR) to attend to your request. In case you check a specific box authorizing contact via WhatsApp, the basis will be your consent (Art. 6.1.a GDPR), which you can withdraw at any time.
• Purpose: Respond to your inquiry and follow up on the service. We will not use WhatsApp to send commercial communications unless expressly authorized.
• Processed data: Phone number and information contained in exchanged messages.
• Provider: WhatsApp Ireland Limited / Meta Platforms. By using this channel, information may be processed under their terms and policies: WhatsApp Privacy Policy.
• International transfers: The use of WhatsApp may imply transfers outside the EEA; we apply standard contractual clauses where applicable.
• Retention: We will keep conversations for a maximum of 12 months for the correct management of your request, unless you request their deletion earlier.
• Rights and objection: You can object to receiving communications via WhatsApp at any time by requesting it by email or in the chat itself; we will attend to your request without affecting the response by other means.

16 Data Processing of Minors

We offer classes for children from 3 years old. Consequently, we process data of minors exclusively for managing registrations, organizing classes, and security, always with proper guarantees.

• Minors under 14: We require verifiable consent from the parent or guardian for any processing and for registration/participation.
• 14 to 17 years old: They can give their consent for data processing; however, contracting and participation authorizations will be carried out through the legal guardian when applicable.
• Data sent without authorization: If we receive information directly from a minor under 14 without consent, we will delete it and contact their legal guardian.
• Minimum data: Name and age of the minor, contact details of the guardian, and, where appropriate, information strictly necessary to adapt the activity and ensure their safety.
• Legal guardians can exercise the rights of access, rectification, deletion, objection, limitation, and portability on behalf of the minor.

17 Health Data (Medical Observations)

Voluntarily, you can provide medical observations to adapt the activity and ensure your safety. We will exclusively process the minimum necessary information and will not keep medical records or clinical documentation.

• Legal basis: Explicit consent (Art. 6.1.a and 9.2.a GDPR). In occasional emergency situations, vital interest (Art. 6.1.d and 9.2.c GDPR).
• Processed data: Information provided by you about injuries, allergies, or limitations relevant to the practice.
• Access: Only staff in charge of your class and registration management, strictly necessary.
• Retention: While you maintain your relationship with the club or until you withdraw your consent; subsequently, they will be deleted or anonymized.
• Rights: You can withdraw your consent, request deletion, or limit processing whenever you wish.