Sevitonina
RESERVAR EXPERIENCIA
Sevitonina
LEGAL

Privacy Policy

Last updated: 12 April 2026

This is a translation provided for convenience. In the event of any discrepancy, the Spanish version of this Privacy Policy shall prevail.

1. Data controller

In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Act 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we inform you that the controller of your personal data is:

  • Company name: Kindergarden Jardilin S.L.
  • Tax ID (CIF): B90012642
  • Address: Avenida Esperanza de Triana, 37, 41010, Seville, Spain
  • Website: sevitonina.es
  • Contact: Through our contact form

2. Purposes of processing and legal basis

We process your personal data for the following purposes, each with its corresponding legal basis under article 6.1 GDPR:

2.1. Contact form and bookings

  • Data processed: Name, surname, telephone, booking details (date, time, number of attendees, type of experience).
  • Purpose: To handle your contact request, process and confirm bookings for experiences, and maintain the communication needed to provide the service.
  • Legal basis: Performance of a contract or pre-contractual measures at the request of the data subject (art. 6.1.b GDPR). For general enquiries, the data subject’s consent (art. 6.1.a GDPR).

2.2. Partners form

  • Data processed: Name, surname, company or organisation, message and contact details provided.
  • Purpose: To handle requests for collaboration and strategic partnerships with hotels, companies and organisations interested in offering Sevitonina experiences.
  • Legal basis: The controller’s legitimate interest in managing business relationships (art. 6.1.f GDPR) and, where applicable, the performance of pre-contractual measures (art. 6.1.b GDPR).

2.3. Private Collection access form

  • Data processed: Name, surname and contact details provided.
  • Purpose: To assess and handle requests for access to Sevitonina’s exclusive Private Collection programme.
  • Legal basis: The data subject’s consent (art. 6.1.a GDPR) and pre-contractual measures (art. 6.1.b GDPR).

2.4. Cookies and similar technologies

  • Data processed: Browsing data, device identifiers, language preferences and consent.
  • Purpose: To ensure the technical operation of the website, remember user preferences and, where applicable, carry out statistical analysis of site usage.
  • Legal basis: For strictly necessary technical cookies, legitimate interest (art. 6.1.f GDPR). For analytics and preference cookies, the data subject’s consent (art. 6.1.a GDPR).
  • For more information, see our Cookie Policy.

2.5. Web analytics

  • Data processed: Anonymised or pseudonymised browsing data (pages visited, duration, device, approximate location).
  • Purpose: To analyse use of the website in order to improve its content, structure and functionality.
  • Legal basis: The data subject’s consent (art. 6.1.a GDPR), managed through the cookie banner.

2.6. WhatsApp communications

  • Data processed: Phone number, name, language inferred from the dialling code, date and time of the booked session and the messages you exchange with us.
  • Purpose: (a) To send you the confirmation and practical reminders for your booking via WhatsApp and to answer your messages; (b) only if you tick it separately, to send you news and offers from Sevitonina.
  • Legal basis: The data subject’s consent (art. 6.1.a GDPR), given through two separate, unticked boxes in the booking form. You may withdraw it at any time by writing STOP (or BAJA) in the chat, without affecting your booking.
  • Platform: WhatsApp Business, by WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd. Automated messages are managed from our own server located in the European Union.

3. Recipients of the data

Your personal data may be disclosed to the following recipients, exclusively for the purposes indicated:

  • Web hosting provider: The website is hosted on servers located in the European Union, ensuring GDPR compliance.
  • Amelia (TMS – Starter): Booking management system used to process and manage appointments and experiences. Data is processed in accordance with its privacy policy and under GDPR safeguards.
  • WhatsApp Business (Meta Platforms Ireland Ltd.): Sending and receiving WhatsApp messages where you have authorised it (see section 2.6). It may involve transfers to the United States (see section 4).
  • Stripe Payments Europe Ltd. and PayPal (Europe) S.à r.l. et Cie, S.C.A.: Processing of online payment for bookings. They receive the data needed for payment (name, email address, amount and payment details); Sevitonina does not store card details. They may involve transfers to the United States (see section 4).
  • Contact Form 7: Contact form management plugin. Data is stored on our own servers.
  • Google reCAPTCHA: Anti-spam verification service provided by Google LLC. It may involve the transfer of data to Google servers (see section 4 on international transfers).
  • Complianz: Cookie consent management plugin. Consent records are stored locally on our servers.
  • WPML: Multilingual management plugin. Language preferences are stored locally by means of cookies.

Data will not be disclosed to third parties except where legally required or in the cases described above. All the providers mentioned act as data processors and have signed the corresponding data protection agreements.

4. International data transfers

The use of Google reCAPTCHA may involve the transfer of certain data (IP address, browsing data) to Google LLC servers in the United States. These transfers are carried out under:

  • The Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914).
  • The EU-U.S. Data Privacy Framework, under the European Commission’s Adequacy Decision of 10 July 2023.

The payment providers Stripe and PayPal may transfer transaction data to their entities in the United States, also under the safeguards above.

Likewise, the use of WhatsApp Business may involve the transfer of your phone number and messages to Meta Platforms, Inc. in the United States, under the same safeguards.

All other data is processed exclusively within the European Economic Area (EEA).

5. Retention periods

Personal data will be retained for the following periods:

  • Contact form data: For the duration of the business relationship or the handling of the enquiry, and thereafter for the statutory limitation period for actions (5 years under art. 1964 of the Spanish Civil Code).
  • Booking data: For the duration of the contractual relationship and thereafter for the applicable statutory periods for tax (4 years) and commercial (6 years) purposes.
  • WhatsApp data: Data linked to booking reminders, up to 30 days after the session; data for news and offers, until you unsubscribe. The unsubscribe record is kept so that we do not write to you again.
  • Partner data: For as long as the collaboration continues and for the subsequent statutory limitation period.
  • Private Collection data: For as long as the connection with the programme continues and for the subsequent statutory limitation period.
  • Cookies: Depending on the type of cookie. See our Cookie Policy for specific periods.
  • Consent records: 5 years from the last interaction, in line with the Spanish Data Protection Agency’s recommendation.

Once these periods have elapsed, the data will be deleted or irreversibly anonymised.

6. Rights of the data subject

Under the GDPR and the LOPDGDD, you have the right to exercise the following rights:

  • Access: To know whether your data is being processed and obtain a copy of it.
  • Rectification: To request the correction of inaccurate or incomplete data.
  • Erasure (right to be forgotten): To request the deletion of your data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
  • Objection: To object to the processing of your data on grounds relating to your particular situation.
  • Portability: To receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
  • Restriction of processing: To request the restriction of processing in certain circumstances provided for by law.

6.1. How to exercise your rights

You may exercise any of these rights by contacting Kindergarden Jardilin S.L. through our contact form, clearly stating the right you wish to exercise and enclosing a copy of your identity document (national ID, NIE or passport) so that we can verify your identity.

We will reply within a maximum of one month from receipt of your request, extendable by a further two months where the request is complex or where we receive a high number of requests.

6.2. Right to lodge a complaint with the supervisory authority

If you consider that the processing of your personal data does not comply with current legislation, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

  • Website: www.aepd.es
  • Address: C/ Jorge Juan, 6, 28001, Madrid, Spain

That said, we would be grateful if, before approaching the supervisory authority, you contacted us through our contact form so that we can try to resolve any issue amicably.

7. Minors

Our services are not aimed at children under 16. We do not knowingly collect personal data from children of that age. Should a minor take part in an experience, the prior consent of their parent or legal guardian will be required. If we become aware that we have collected data from a minor without appropriate parental consent, we will delete it immediately.

8. Security measures

Kindergarden Jardilin S.L. has adopted the appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, in accordance with article 32 GDPR. These measures include, among others:

  • Encryption of communications by means of the HTTPS protocol (SSL/TLS certificate).
  • Restricted access control to personal data, limited to authorised staff.
  • Regular backups of information.
  • Regular updating of software and security systems.
  • Confidentiality agreements with staff and providers who have access to data.

9. Amendments to this Privacy Policy

Kindergarden Jardilin S.L. reserves the right to amend this Privacy Policy in order to adapt it to legislative or case-law developments or to changes in our data processing practices. Any amendment will be published on this page, indicating the date of the last update. In the event of substantial changes, we will notify you through the usual means of communication.

10. Contact

For any question regarding the processing of your personal data or the exercise of your rights, you may contact us through our contact form.