Privacy Policy

Last updated: 26 October 2026

This Privacy Policy explains how personal data is processed on valencia-fiesta.es (the "Platform") in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), Spanish Law 34/2002 (LSSI-CE) and the Maltese Data Protection Act (Cap. 586). Section 2.11 covers the Valencia Fiesta app for iOS and Android.

1. Data Controller

• Identity: Signature Services Ltd.
• Address: Fawwara Building, Triq l-Imsida, Gzira GZR 1401, Malta
• Company registration: Malta Business Registry, No. C 112524
• VAT number: MT32109508
• Email: info@valencia-fiesta.es

We have not appointed a data protection officer. For all data protection matters, please contact us at the email address above.

2. What We Process, Why and on What Legal Basis

2.1. Visiting the Platform (server logs)

When you open a page, the following data is processed automatically: IP address, date and time of the request, page requested, referrer URL, browser and device type, operating system and language settings.

• Purpose: delivering the website, ensuring its stability and security, detecting and preventing attacks and misuse.
• Legal basis: legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

The Platform also loads web fonts from Google Fonts (Google) and, on the clubs map, map tiles from OpenFreeMap (tiles.openfreemap.org). For this, your IP address is transmitted to these providers. Legal basis: legitimate interest in a consistent presentation and an interactive map (Art. 6(1)(f) GDPR).

2.2. Analytics and Advertising (Google)

Only if you consent, the Platform uses the following Google services (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland):

• Google Analytics 4 (properties G-GL76V6SZY6 and G-XBGSC6NFMK), category "Analytics" – visitor statistics on how the Platform is used (pages visited, duration, approximate location, device, source of the visit). Your IP address is truncated and processed by Google only to derive an approximate location; Google Analytics 4 does not log or store full IP addresses. For Google Analytics, Google acts as our processor.
• Google Ads conversion measurement (AW-673632108), category "Marketing" – measuring whether visits from our Google ads campaigns lead to actions on the Platform.
• Google AdSense, category "Marketing" – showing advertising that helps finance the Platform and measuring it. Personalised ads are only shown with your consent. For Google Ads and Google AdSense, Google acts as an independent controller for its own advertising purposes.

• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE).
• Cookies used: see the table in Section 10.
• Transfers to the USA: data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework (see Section 4).

Cookie banner. On your first visit, a cookie banner asks for your choice. Its first layer offers the options "Reject all", "Settings" and "Accept all" with equal prominence; under "Settings" you can consent separately to the "Analytics" and "Marketing" categories. Technically necessary storage is always active and does not require consent (see Section 10). The Google scripts (gtag.js, adsbygoogle.js) are not loaded before you consent; the Google Consent Mode v2 signals are set to "denied" by default and are only updated in line with your choice. Rejecting cookies does not restrict your use of the Platform. Your choice is stored for 12 months (cookie "vf_consent"); after that, we ask you again.

Withdrawing or changing your consent. You can withdraw or change your consent at any time with effect for the future via the "Cookies" link in the footer of every page, which reopens the banner settings. The withdrawal does not affect the lawfulness of processing before it. You can also deactivate personalised advertising at adssettings.google.com. More information: policies.google.com/privacy and policies.google.com/technologies/partner-sites.

2.3. User Account

When you register, we process:

• First and last name, email address, password (stored only in encrypted/hashed form), account type (participant or organizer), preferred language
• Participants (optional): date of birth, gender, phone number
• Saved events, notification settings (order confirmations, event reminders, updates on saved events) and newsletter preference

• Purpose: creating and managing your account, showing your tickets and saved events, sending the notifications you have enabled.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Optional information (date of birth, gender, phone) is processed on the basis of your consent by providing it voluntarily (Art. 6(1)(a) GDPR); the date of birth is used to confirm that you are at least 18 years old; gender and phone number are only stored in your profile.

You can edit your data and notification settings and delete your account at any time in your account area.

2.4. Ticket Purchase

When you buy a ticket on the Platform, we process:

• First and last name, email address, phone number
• Order and ticket data (event, ticket type, quantity, ticket price, service fee, any discount code, order number, ticket code/QR code, admission/check-in status)
• Payment status, refund status and the Stripe payment reference

• Purpose: concluding the ticket purchase as the organizer's agent, processing the payment, delivering your e-ticket by email, admission control at the event, contacting you about your order (e.g. if the event is cancelled or changed), refunds and customer service.
• Legal basis: performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR).

We do not collect or store card or bank data. Payment details are entered directly on Stripe's payment page and processed by Stripe (see Section 3).

2.5. Organizers and Payouts

For organizers we additionally process: organization/venue name, contact person, phone number, website, tax ID/CIF (optional), event and venue information and any contact details (email, WhatsApp) the organizer chooses to publish on its event or venue pages. For organizers who sell tickets: the status of their connected Stripe account (e.g. connected, verification completed, payouts enabled) and payout information (ticket revenue, commission, Stripe fee, amounts, transfer dates, refunds and reversals).

• Purpose: managing the organizer account, publishing events, ticket sales, calculating and transferring payouts via Stripe Connect, invoicing our commission, notifying organizers of sales.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legal obligation for accounting and tax records (Art. 6(1)(c) GDPR).

Identity, business and bank data required for payouts are collected directly by Stripe during Stripe Connect onboarding (identity verification, "KYC"). We do not receive or store these data; Stripe only informs us of the account status.

2.6. Contacting Organizers

Event and venue pages may contain links to contact the organizer directly by email or WhatsApp. If you use them, your message is sent directly to the organizer through your email or WhatsApp provider; we do not receive or store it. The organizer is responsible for that communication, and WhatsApp (Meta) processes data under its own privacy policy.

2.7. Contact Form and Customer Service

If you write to us using the contact form or by email, we process your name, email address, the subject and your message. Messages from the contact form are sent to our own server function (hosted by Cloudflare) and delivered by email to info@valencia-fiesta.es via our email service provider Resend; they are not stored in our database. To protect against spam, the form contains a hidden field (honeypot), and your IP address is used transiently for abuse protection and is not stored.

• Purpose: answering your enquiry, providing customer service and protecting the form against spam and misuse.
• Legal basis: performance of a contract or pre-contractual steps where the enquiry relates to an order, an account or a possible purchase (Art. 6(1)(b) GDPR); otherwise our legitimate interest in responding to enquiries and in protecting the form against spam (Art. 6(1)(f) GDPR).
• Retention: as long as needed to handle your request, at most 12 months, unless the data is needed longer to establish, exercise or defend legal claims (see Section 5).

2.8. Newsletter

If you subscribe to our newsletter, we process your email address, preferred language, the sign-up source and, as proof of your consent, the time of sign-up and confirmation, IP address and browser information. We use the double opt-in procedure: you will only receive the newsletter after you have confirmed your subscription via the link in our confirmation email.

• Purpose: sending information about events and nightlife in Valencia.
• Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 21 LSSI-CE). Storing the proof of consent is based on our legal obligation to demonstrate consent (Art. 7(1) GDPR).

You can withdraw your consent at any time with effect for the future by unticking the newsletter option in your account or by writing to info@valencia-fiesta.es.

2.9. Accounting, Tax and Legal Obligations

Order, payment, refund, payout and invoice data are stored to meet our accounting, tax and other legal obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

2.10. Fraud Prevention, Security and Legal Claims

We process order, ticket and technical data (e.g. ticket verification codes, check-in status, IP address, request frequency) to prevent fraud, duplicated tickets and misuse of the Platform, and to establish, exercise or defend legal claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

2.11. Valencia Fiesta App (iOS and Android)

The app shows the same programme and venues as the Platform. You can use it without an account.

• Data stored only on your device: events you save, clubs you follow, your language and notification settings, and a copy of the programme for offline use. These data stay on your device and are deleted when you uninstall the app; we only receive the data described under "Push notifications" below.
• Location ("Tonight nearby"): only if you tap "Tonight nearby" and allow access, the app determines your location while it is open, to sort clubs by distance. This calculation takes place on your device; your location is neither sent to us nor stored. When the map shows your position, the app loads the map tiles for that area from OpenFreeMap (see Section 2.1). Legal basis: your consent (Art. 6(1)(a) GDPR), given in your device's permission dialog; you can withdraw it at any time in the system settings.
• Reminders on the day of an event and mascletà alert: if you allow notifications, the app schedules a notification on your device for the events you save and, if you switch on the mascletà alert, before each mascletà during Fallas. No data is sent to us for this. You can turn reminders off in the app ("More" or the Fallas page) or in the system settings.
• Calendar: "Add to calendar" opens your device's calendar dialog; the app does not read your calendar.
• Push notifications about clubs you follow: if you follow clubs and allow notifications, we store a push token (a pseudonymous identifier for your device, issued via Expo, Apple or Google), the operating system (iOS or Android), the app language and the IDs of the clubs you follow, together with the time of the last update and the number of notifications sent in the current week. Purpose: informing you about new events at the clubs you follow, at most twice a week. Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 21 LSSI-CE). You can withdraw it at any time by turning these notifications off in the app or in your device settings, or by unfollowing all clubs; we then delete the entry, at the latest the next time you open the app.
• Reporting a problem: "Report a problem" opens your email app with a pre-filled message to us; we handle it like a contact enquiry (Section 2.7).
• Crash and error reports: if the app crashes or an error occurs, it sends a report to Sentry (see Section 3): the error message and the technical sequence that led to it (stack trace), the app version, device model, operating system, language and time. The report contains no name, email address or location, and your IP address is not stored. Purpose: finding and fixing errors and keeping the app stable. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); you can object at any time (Section 8).
• Tickets and web links open in an in-app browser or in your browser. Processing on those websites is described in the relevant sections of this policy or by the respective provider.

3. Recipients

Your personal data is only shared where necessary for the purposes above:

• Event organizers: For tickets sold on the Platform, the organizer of the event receives the buyer's name, email address, phone number and order and ticket data (including check-in status), so that it can manage admission and contact buyers about the event. The organizer is the contracting party for attending the event and processes these data as an independent controller. Under our Terms of Service (Section 6.7), organizers may use these data only to manage admission and to communicate about the specific event (including changes or cancellation); they may not use them for direct marketing unless they have their own legal basis (e.g. your separate consent), must keep them confidential and secure, may not sell or pass them on, and must delete them when they are no longer needed, at the latest 12 months after the event unless longer retention is required by law. For the organizer's own processing, you can also exercise your rights directly against the organizer.
• Stripe: Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin 2, Ireland) processes payments, refunds and payouts to organizers (Stripe Connect). Stripe acts as our processor for payment processing and as an independent controller for its own purposes, in particular fraud prevention, identity verification of organizers (KYC) and compliance with its legal obligations. More information: stripe.com/privacy.
• Technical service providers (processors): Cloudflare, Inc. (hosting, content delivery, security, server functions), Supabase, Inc. (database and user authentication), Resend (delivery of emails such as tickets, order confirmations, notifications, the newsletter and messages sent via the contact form). They process data only on our instructions.
• Google: Google Ireland Limited and Google LLC for Google Fonts (see Section 2.1) and, only with your consent, for Google Analytics (as our processor), Google Ads and Google AdSense (as an independent controller for its own advertising purposes) (see Section 2.2).
• OpenFreeMap: map tiles for the clubs map (see Section 2.1).
• Expo: 650 Industries, Inc. ("Expo", USA) delivers the app's push notifications as our processor (see Section 2.11). For delivery to your device, the push token and the content of the notification are passed on to Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging).
• Sentry: Functional Software, Inc. ("Sentry", USA) receives the app's crash and error reports as our processor (see Section 2.11). The data is stored in the EU (Frankfurt, Germany).
• Professional advisers: tax advisers, accountants, auditors and lawyers, where necessary and subject to confidentiality.
• Public authorities and courts: where we are legally obliged to disclose data.

For events imported from external sources, tickets are bought on the third party's website (e.g. Xceed, Fourvenues); that provider is responsible for the data processed there. We do not sell your personal data.

4. International Transfers

Some of our providers (in particular Cloudflare, Supabase, Resend, Stripe, Google, Expo and Sentry) are based in the United States or may access data from outside the European Economic Area (EEA). Where data is transferred to a country without an adequacy decision, we ensure appropriate safeguards: for recipients certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 applies (Art. 45 GDPR); otherwise we use the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Google LLC is certified under the EU-US Data Privacy Framework; data collected via Google Analytics, Google Ads and Google AdSense (only with your consent) may be transferred to Google LLC in the United States on that basis. Expo (650 Industries, Inc.) is also certified under the EU-US Data Privacy Framework. You can request a copy of the safeguards by contacting us.

5. Retention Periods

• Account data: until you delete your account. Orders are then kept in anonymised form, except for the data we must retain under the next point.
• Order, payment, payout and invoice data: for the statutory accounting and tax retention periods (generally 6 to 10 years, in particular up to 10 years for accounting records under the Maltese Companies Act, Cap. 386), counted from the end of the relevant financial year.
• Contact enquiries: as long as needed to handle your request, at most 12 months, unless they relate to an order (then as for order data) or are needed longer to establish, exercise or defend legal claims.
• Reservation requests made through the former reservation function: until the event took place, plus 1 year.
• Newsletter: until you unsubscribe; proof of consent for up to 3 years thereafter to be able to demonstrate consent. Unconfirmed sign-ups are not used for sending the newsletter.
• Server logs: maximum 12 months.
• Google Analytics: according to the retention period set in Google Analytics (maximum 14 months); cookies see Section 10.
• Cookie choice: 12 months (cookie "vf_consent"); after that, we ask for your choice again.
• App push notifications: until you withdraw your consent (see Section 2.11). Entries of devices on which the app has not been opened for 12 months, and push tokens that Expo reports as no longer valid, are deleted.
• App crash and error reports: 30 days; Sentry then deletes them automatically.

In addition, data may be kept for as long as necessary to establish, exercise or defend legal claims (limitation periods), with access restricted accordingly.

6. Is Providing Data Required?

Providing personal data is neither a statutory nor a contractual requirement in general. However, the data marked as mandatory in the registration and checkout forms is necessary to create an account or to buy and deliver a ticket; without it, we cannot conclude the contract. Optional fields are marked as such. Without consent, the newsletter cannot be sent. In the app, location access and notifications are optional; without them, "Tonight nearby", reminders and push notifications are not available.

7. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Stripe carries out automated fraud checks for its own purposes as an independent controller, which may lead to a payment being declined.

8. Your Rights

Under the GDPR, you have the right to:

• Access your personal data (Art. 15 GDPR).
• Rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Erasure of your data, unless we are obliged or entitled to keep it (Art. 17 GDPR).
• Restriction of processing in certain circumstances (Art. 18 GDPR).
• Data portability of data you have provided, in a structured, machine-readable format (Art. 20 GDPR).
• Object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21(1) GDPR), and at any time without giving reasons to processing for direct marketing (Art. 21(2) GDPR).
• Withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR).

To exercise your rights, write to info@valencia-fiesta.es. We respond within one month. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. As the controller is established in Malta, the lead supervisory authority is:

• Information and Data Protection Commissioner (IDPC), Malta: idpc.org.mt

If you live in Spain, you can also contact:

• Agencia Española de Protección de Datos (AEPD): C/ Jorge Juan, 6, 28001 Madrid – www.aepd.es

10. Cookies and Similar Technologies

We use cookies and similar technologies (in particular your browser's local storage) in three categories. You make your choice in the cookie banner shown on your first visit (see Section 2.2).

• Necessary (always active): required to provide the service you request, e.g. login, cart and storing your cookie choice. They do not require consent (Art. 22(2) LSSI-CE); legal basis: performance of a contract and our legitimate interest in a functioning Platform (Art. 6(1)(b) and (f) GDPR).
• Analytics (only with your consent): Google Analytics 4 for visitor statistics.
• Marketing (only with your consent): Google Ads conversion measurement and Google AdSense, to measure our campaigns and to show ads that finance the Platform; personalised ads only with your consent.

Payment takes place on Stripe's hosted payment page (checkout.stripe.com), where Stripe sets its own cookies, e.g. for security and fraud prevention, under its own privacy policy (stripe.com/privacy).

Analytics and marketing cookies are only set after your consent. You can withdraw or change your consent at any time via the "Cookies" link in the footer of every page. You can also delete cookies and block them in your browser settings; blocking necessary cookies or local storage may affect the functioning of the Platform (e.g. login or the cart).

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption throughout the Platform
• Access controls at database level and access to personal data restricted to authorised persons
• Passwords stored only in hashed form
• Backups maintained by our database provider

12. Minors

The Platform is intended for persons aged 18 and over. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, please contact us so that we can delete it.

13. Changes to this Policy

We may update this Privacy Policy when our services or the legal requirements change. The current version is always available on this page; the date of the last update appears at the top.

14. Contact

For any questions about the processing of your personal data:

Email: info@valencia-fiesta.es