LEGAL

PRIVACY POLICY

Data controller

Efesto Ocho, S.L. (Arternativ)
Tax ID (NIF): ESB85997260
Address: Calle de Juan Bravo 10, 28006 Madrid, Spain
Email for any privacy matter: admin@arternativ.net

What data we process

The data you give us when you write to us, request information about an experience or subscribe to our newsletter: name, surname, email, phone, language and your interests.
If you book an experience: the participants' details it requires (ID card or passport for hotel check-in and access to venues, date of birth, nationality, emergency contact), your preferences and, only if you provide them, health data such as allergies or mobility or dietary needs.
Billing and payment data. Card payments are made on the secure CaixaBank payment gateway (Redsys): we never see or store your card number.
How you interact with our emails (whether you open them and which links you click), so we can send you more useful information.
Only if you accept cookies on our website: the pages and experiences you visit there, linked to your contact record when we know who you are (see the Cookie policy).
Professional information you have made public yourself (for example, your activity as a collector, gallerist or art professional on websites or professional networks), to better understand your artistic interests.

Why we use it and on what legal basis

To answer your enquiries and send you the information you request about our experiences: your consent and the pre-contractual steps you ask for.
To manage your booking, the experience, payments and invoices: performance of the contract and compliance with legal obligations (tax regulations and the guest registration required of hotels).
Health data: your explicit consent, only to look after you during the experience.
To send you our newsletter: your consent, which you may withdraw at any time using the unsubscribe link in every email.
To send our clients information about experiences and services similar to those they have booked, and to better understand their interests: our legitimate interest. You may object at any time.

Who we share it with

We do not sell your data. To run your experience we share it with the providers that make it possible (hotels, restaurants, local transport during the programme, guides, artists, galleries, museums, fairs and insurers), some of them outside the European Economic Area when the experience takes place there: this is necessary to perform the contract. We also share it with public authorities when required by law.
The following providers process data on our behalf under a data processing agreement:

Web hosting and servers: SiteGround (European Union).
Email: Google (Gmail / Google Workspace).
Newsletter and emails: Mailchimp (Intuit Inc., United States).
Card payments: CaixaBank, S.A. and Redsys.
Artificial intelligence tools for drafting and translating texts: OpenAI (United States).
Lead forms on Facebook and Instagram: Meta Platforms (if you contact us through them).

Transfers to the United States are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

How long we keep it

Enquiries and newsletter: until you unsubscribe or ask us to delete it.
Clients: for as long as the relationship lasts and, afterwards, for the periods required by law (for example, six years for accounting records and four for tax records) and the limitation periods for possible claims.
Health data: deleted when the experience ends.

Your rights

You may request access to your data, its rectification or erasure, object to or restrict its processing, request its portability, and withdraw your consent at any time by writing to admin@arternativ.net. If you believe we have not handled your data properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security

We apply technical and organisational measures to protect your data: encrypted connections, access restricted to the team members who need it, and encrypted backups.

Last updated: 27 October 2026