Privacy Policy
This policy explains what personal data we process when you visit the website, write to us or take part in an activity, what we use it for and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Owner
- Mikel Berga Roca (trade name: Pirineu a Peu)
- Area of activity
- Pallars Sobirà (Lleida)
- info@pirineuapeu.cat
- Phone and WhatsApp
- +34 634 19 80 17
2. What data we process
- Website forms (contact and “Join”): email, full name, phone, number of participants and the message you write.
- WhatsApp, email or phone: the data you give us during the conversation.
- If you book an activity: the data needed to organise it and for the included insurance (usually the participants' name, surname and ID number). If you voluntarily tell us about health information relevant to your safety (injuries, allergies, etc.), we will only use it for that purpose.
- Photographs taken during the activity.
- Newsletter: your email (and name, if you give it) if you subscribe.
- Browsing: only anonymous, aggregated statistics, without cookies (see the Cookie Policy).
If you are under 14, please do not give us personal data: your parent or legal guardian must do it. Anyone registering minors for an activity confirms they are their legal representative.
3. Purposes and legal basis
| What we use it for | Legal basis |
|---|---|
| Replying to your enquiries and requests for information or a place | Pre-contractual steps taken at your request (art. 6.1.b GDPR) |
| Managing the booking, the activity and the insurance, and meeting tax and accounting obligations | Performance of the contract (art. 6.1.b) and legal obligations (art. 6.1.c) |
| Taking into account health information you give us, for your safety | Your explicit consent (art. 9.2.a) |
| Taking and sending the private photo report to participants | Performance of the contracted service (art. 6.1.b) |
| Publishing photos in which you appear on social media or the website | Your prior consent (art. 6.1.a) |
| Sending you the newsletter | Your consent when subscribing (art. 6.1.a) |
| Keeping the website secure and obtaining anonymous visit statistics | Legitimate interest (art. 6.1.f) |
We do not make automated decisions or create profiles. Fields marked as required in the forms are necessary for us to reply; if you do not provide them, we cannot handle your request.
4. Activity photographs
The photo report is for participants and is private: we only share it with the people who took part in the activity. Group photos may show the companions you shared the experience with.
We only publish photos on social media or the website if you have given us permission beforehand. You can withdraw that permission at any time by writing to info@pirineuapeu.cat and we will remove the photos in which you appear.
5. Newsletter
Subscribing to the newsletter is voluntary and independent of any enquiry or booking: we only add you if you subscribe expressly. You can unsubscribe at any time using the link in every email or by writing to us.
6. How long we keep data
- Enquiries, requests and bookings: 12 months from the last contact. After that, personal data is automatically anonymised and we only keep statistics (activity, number of participants and month).
- Accounting and tax records (invoices and proof of payment): for the applicable legal periods (up to 6 years).
- Health information: deleted when the activity ends.
- Private photo report: as long as needed to send it to you, 1 year at most.
- Published photos and newsletter: until you withdraw consent or unsubscribe.
7. Recipients
We do not sell or share your data with third parties. It can be accessed by the Pirineu a Peu guides and by the people who help maintain the website, under a duty of confidentiality. The following providers may also process it, only to provide their service to us and under the corresponding contract:
| Provider | Service | Location |
|---|---|---|
| Vercel Inc. | Website hosting and anonymous statistics | USA |
| Supabase Inc. | Database where requests are stored | EU / USA |
| Brevo (Sendinblue SAS) | Sending confirmation emails and the newsletter | EU (France) |
| Cloudinary Ltd. | Hosting of website images | USA |
| WhatsApp (Meta Platforms Ireland Ltd.) | Messaging, if you contact us on WhatsApp | EU / USA |
We also share the essential data with the insurance company to register participants in the activity insurance, and with public authorities where there is a legal obligation.
8. International transfers
Some providers may process data outside the European Economic Area, mainly in the USA. In those cases the transfer relies on the safeguards required by the GDPR, such as the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.
9. Your rights
- Access: find out what data about you we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete it.
- Objection and restriction of processing.
- Portability: receive your data in a structured format.
- Withdraw consent at any time, without affecting earlier processing.
To exercise them, write to info@pirineuapeu.cat stating which right you want to exercise. If we are unsure of your identity, we may ask you to verify it. We will reply within one month at most.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
10. Security
We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), access to the management panel restricted to guides and protected with two-step verification, and providers that offer security guarantees.
11. Changes to this policy
If we change it, we will publish the new version on this page with the update date.
Last updated: 13 September 2026