Privacy Policy

1. Controller

Data controller: {{TITULAR_LEGAL}}, operating under the commercial name EUPHORIA. NIF/CIF/NIE: {{NIF_CIF_NIE}}. Legal address: {{DOMICILIO_LEGAL}}. Privacy and rights contact: euphoriatnf@gmail.com. Premises address and contact telephone:

EUPHORIA · https://euphoriatnf.com/ · Avenida de España, 10, local 4, 38660 Costa Adeje, Adeje, Santa Cruz de Tenerife, España · +34 622 135 416 · euphoriatnf@gmail.com

2. Data and sources

Data comes from you when you write, call or submit the form: name, email, telephone, message and, for a collaboration application, requested position, experience, availability and any file you choose to attach. The attachment is optional. The form does not request identity documents, bank details, health information or information about sex life. Do not include special-category data or unnecessary information about others. During browsing, the infrastructure may process IP address, date, request and technical browser information to deliver and protect the website.

3. Purposes and legal bases

Enquiries and reservation requests: steps you request before entering a contract, GDPR Article 6(1)(b); for general communications unrelated to a contract, legitimate interest in answering someone who contacts the establishment, Article 6(1)(f). Handling the application you submit through the form: specific consent, Article 6(1)(a), given through an unchecked box. Applications are not used for advertising or added to a permanent pool for future opportunities without separate consent. Website security and abuse prevention: legitimate interest, Article 6(1)(f), using only necessary data. Legal obligations and valid official requests: Article 6(1)(c). Loading Google Maps: consent for the optional service and its technologies, GDPR Article 6(1)(a) and LSSI Article 22(2). Refusing Maps does not prevent use of the rest of the website.

4. Required fields and submission

Required fields enable us to respond and handle the request; without them the form cannot be submitted. An attachment is not required. Boxes are initially unchecked. Reading a privacy policy does not itself authorise every processing activity: the application consent has a specific purpose. The form sends data through WordPress to the establishment’s mailbox. It does not create a public profile or an application record in WordPress. An attachment is used temporarily for sending and the temporary server copy is deleted after the sending attempt; the received email may contain the attachment.

5. Retention

Enquiries are kept while being handled and removed when no longer needed, except for communications required for legal obligations or potential liability. Form applications are kept during evaluation and deleted when evaluation closes; they are not retained for future opportunities without independent permission. Data necessary for legal obligations or defending claims is limited and blocked for the period applicable to each obligation, under Article 32 of the Spanish data-protection law. Cookie choices are remembered for 180 days. The dedicated repeated-submission protection uses an identifier derived from IP for 60 seconds; the application email does not include the IP address. Deleting the email and attachments is the controller’s responsibility and is distinct from automatic deletion of a temporary file.

6. Recipients and external services

Authorised personnel handling your communication can access the data. Hosting, maintenance and email providers may access it as necessary to provide services, under the relevant data-protection conditions. Disclosure to authorities occurs where legally required. Data is not sold. The contact address uses Gmail; Google is involved as an email provider when you send or receive an email. Activating the map discloses connection information, including IP and browser data, to Google. WhatsApp and Telegram links connect to those providers only when opened; their policies then apply. You can telephone or email without activating the map.

7. International transfers

Google services and external communication channels may process data outside the European Economic Area. Their scope, recipients and safeguards are explained at Google, https://policies.google.com/privacy; WhatsApp, https://www.whatsapp.com/legal/privacy-policy-eea; and Telegram, https://telegram.org/privacy. Where the controller uses processors transferring data, a valid GDPR Chapter V basis must be ensured, such as an adequacy decision applicable to the recipient or standard contractual clauses with supplementary measures where required. Publishing this policy does not establish that every provider is certified or replace verification of safeguards. You may request details of safeguards relevant to your communication from the privacy contact.

8. Rights and complaints

You may request access, rectification, erasure, restriction and, where applicable, portability and objection. You may withdraw consent at any time without affecting earlier lawful processing. Email euphoriatnf@gmail.com with your request or use the controller’s legal address. Additional identity information will only be requested where there is reasonable doubt; an identity-document copy is not systematically required. Requests are normally answered within one month; if a lawful extension of up to two further months is needed, you will be told within the first month. You may also complain to Spain’s data-protection authority, https://www.aepd.es/.

9. Security, minors and automated decisions

The website uses HTTPS, access controls and form validation. No measure guarantees absolute security. There are no solely automated decisions with legal effects or the website’s own advertising profiles. Commercial channels and the form are intended for people aged 18 or over; do not send children’s data. Unnecessary or especially sensitive information received should only be handled as needed for safe deletion. This policy addresses the GDPR and Spanish Organic Law 3/2018 and is updated when purposes or functionality change.