Privacy policy

Purposes: manage your bookings and tickets (including the attendees you indicate), process gift card purchases, handle the contact form, manage applications to job openings, send the operational communications related to your booking (confirmation, reminder, invoice), and comply with applicable accounting and tax obligations.

Legal basis: the performance of the contract when you book or purchase a gift card, the consent you give when you submit the contact or application form, the compliance with legal obligations (accounting, tax and fraud prevention) and our legitimate interest in the security of the site and the defence of legal claims.

Recipients: we share the minimum data necessary with the payment provider Redsys Servicios de Procesamiento, S.L. to process the payment; with our transactional email provider to deliver booking confirmations; with Cloudflare, Inc. as our CDN and DDoS protection provider; with our image storage provider; and with Google LLC only if you have accepted third-party cookies, to load the embedded map. Some of these providers may be located outside the EEA — see the dedicated section below.

Rights: you have the right to access, rectify and delete your data, to object, to restrict its processing and to request its portability. You can also lodge a complaint with the Spanish Data Protection Agency. To exercise them, write to info@madlandmadrid.es.

For what purposes do we process your data?

We process your data to book your session and that of the attendees you indicate, to handle the contact form, to manage the purchase and redemption of gift cards, to manage applications to work with us, to issue the operational communications related to your booking (confirmation, modification, reminder, invoice), to comply with applicable accounting and tax obligations, and to prevent fraud. We do not perform profiling or automated decisions with legal effects on you.

How long do we keep your data?

Data linked to a booking or purchase is kept for the time needed to provide the service and, afterwards, for the legal retention periods applicable (in particular 6 years under accounting and commercial law, plus the prescriptive periods of tax law). Contact form data is kept until your enquiry is resolved and for a reasonable time after that. Application data is kept up to one year from last contact, unless you authorise us to keep it longer. The cookie preference is kept for 12 months.

What is the legal basis?

The legal basis depends on the purpose: the performance of the contract for your booking or gift card purchase (Art. 6.1.b GDPR); your express consent for the contact and application forms (Art. 6.1.a); the compliance with accounting, tax and consumer protection obligations (Art. 6.1.c); and our legitimate interest in the security of the site, fraud prevention and defence of legal claims (Art. 6.1.f), duly balanced.

Who do we share your data with?

We do not sell personal data. We only share it with the processors we need to provide the service, all of them bound by an Art. 28 GDPR processor agreement: Redsys Servicios de Procesamiento, S.L. (card payment processing), our transactional email provider (booking notifications), our cloud hosting provider, Cloudflare, Inc. (CDN, DDoS protection and DNS), and our file storage provider for site assets.

If you have accepted third-party cookies, technical data (including your IP address) is also shared with Google LLC when the embedded map in the FAQ section is loaded. You can withdraw this at any time from the cookie panel.

What are your rights?

You have the right to access your data, to rectify it when inaccurate, to request its deletion when it is no longer necessary, to object to processing, to request its restriction and to receive it in a structured and portable format. You can also withdraw your consent at any time without affecting the lawfulness of previous processing.

Under certain circumstances you may request the restriction of processing, in which case we will only keep your data for the exercise or defence of legal claims.

You may also object to processing for reasons related to your particular situation. We will stop processing the data unless there are compelling legitimate grounds or the exercise or defence of legal claims.

To exercise any of these rights, write to info@madlandmadrid.es identifying yourself appropriately. We will provide the corresponding templates upon request.

For more information about your rights, please visit the Spanish Data Protection Agency website: www.aepd.es.

If you believe we have not handled your request properly or that the processing does not comply with the regulation, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6 — 28001 Madrid).

Do we make international data transfers?

Some of our processors (in particular Cloudflare and Google LLC) are headquartered in the United States and may process data outside the European Economic Area. When this happens we ensure that appropriate safeguards are in place, such as the Standard Contractual Clauses approved by the European Commission and, where applicable, adherence to the EU-US Data Privacy Framework. You can request a copy of these safeguards at any time.

Do we process children's data?

The Mad Land experience has a recommended minimum age and the booking can only be made by a person over 14. If there are minors among the attendees, their data is provided and authorised by the adult who makes the booking. We do not collect data directly from children under 14.

Where does the data come from?

All personal data comes directly from you, whether when booking, buying a gift card, submitting the contact form or applying to a job opening. When you provide data of other attendees you state that you have their authorisation to do so.