Privacy policy

Last updated: September 2026. This is a courtesy translation; the Spanish version is the legally binding one.

1. Data controller

• Controller: Bruno Bonnier
• Tax ID: X7700154F
• Address: Calle Llull 290, 2.º 2.ª, 08019 Barcelona
• Email: hola@confetticlub.es
• Phone: +34 683 429 508

2. What we collect

Only what you voluntarily enter in the quote form:

• Name
• Phone number
• Email address
• Event date, event type, town, approximate guest count and hours of service
• Anything you add in the free-text field

When you submit the form, these details are sent to our server at Cloudflare, which does two things: it stores them in our enquiries database, also at Cloudflare, and it turns them into an email delivered to our inbox at hola@confetticlub.es. We store the enquiry so we can deal with it and so we know how many we receive and where they come from, and it is deleted within the period set out in section 5.

If you would rather not use the form, the confirmation screen offers to send us the same message over WhatsApp or from your own email client, and you can always write to hola@confetticlub.es directly.

When you send the form we also record the IP address it was sent from and the country Cloudflare tells us, only to stop a person or a bot flooding the form. The IP address is erased after seven days, because past that it is no use for that.

Apart from that we collect nothing else automatically beyond what section 8 explains, which covers analytics and cookies.

3. Why we use it

Solely to answer your quote request and manage any resulting booking: to contact you, prepare the proposal, coordinate the details of the event and, if you book, issue the invoice.

We do not build profiles, we make no automated decisions with legal effect, and we send no marketing unless you explicitly ask us to.

4. Legal basis

Processing is based on your consent, given by ticking the box on the form before submitting it (GDPR article 6.1.a).

If you go on to book, subsequent processing is based on performance of the contract (article 6.1.b) and on compliance with applicable tax and accounting obligations (article 6.1.c).

5. How long we keep it

If we do not end up working together, we keep your details for a maximum of 24 months from our last contact in case you come back to us, and then delete them.

If you book, we keep them for the duration of the relationship and afterwards for the statutory limitation periods for tax and accounting obligations (currently 6 years under the Spanish Commercial Code and 4 years under tax legislation).

6. Who we share it with

We do not sell or transfer your data to third parties for commercial purposes.

This site is hosted, and the form is delivered, by Cloudflare, Inc. (Cloudflare Workers), acting as a data processor: its network serves the pages, turns your enquiry into an email and delivers it to our inbox.

Our email is hosted by Google Ireland Ltd. (Gmail), also as a data processor: your enquiry sits in that inbox.

If you accept analytics cookies, Google LLC additionally processes the browsing data described in section 8. We never pass it anything from the form.

If you also message us on WhatsApp, that conversation is governed by the privacy policy of WhatsApp Ireland Ltd. (Meta group), over which we have no control.

In every case we are the controller of the data you send us, on the terms of this policy.

Where any of these suppliers is located outside the European Economic Area, the transfer is covered by the Standard Contractual Clauses approved by the European Commission or by a valid adequacy decision.

7. Your rights

You can exercise the following rights at any time by writing to hola@confetticlub.es, stating which right you wish to exercise and enclosing a copy of your ID:

• Access: find out what data of yours we process.
• Rectification: correct anything inaccurate.
• Erasure: ask us to delete it.
• Restriction: ask us to suspend processing.
• Portability: receive it in a structured, commonly used format.
• Objection: object to the processing.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

We will respond within one month. If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).

8. Cookies and analytics

This site sets no cookie until you allow it. On your first visit you will see a notice with two equally prominent buttons, accept and reject; until you choose, no cookie is set.

If you accept, we use Google Analytics 4 to see which pages are visited, where people arrive from and how many quote requests are sent. It sets two first-party cookies, _ga and _ga_<id>, which expire after two years and distinguish a new visit from a returning one.

Google LLC acts as a data processor and may process that data outside the European Economic Area, under the EU-US Data Privacy Framework and the Standard Contractual Clauses. It receives your truncated IP address and technical browsing data; we pass it no name, phone number or email, and advertising and personalisation storage stay switched off.

If you reject, Google Analytics is never loaded and none of its cookies are set. If you had accepted before, rejecting deletes them.

Either way Cloudflare Web Analytics keeps running: it uses no cookies, does not track users across websites and produces only aggregated statistics on page views, country and traffic source. Rejecting does not leave us blind — the basic measurement is unchanged.

Your answer is kept for a year in your browser’s local storage (key “cc-consent”) so you are not asked on every visit. That information never leaves your device and identifies nobody.

You can change your mind at any time through the “Cookies” link in the footer, which reopens the notice. You can also delete or block cookies in your browser settings.

9. Security

The site is served entirely over an encrypted connection (HTTPS). We apply reasonable technical and organisational measures to protect data against loss, unauthorised access or alteration.

Even so, no system is completely infallible: absolute security cannot be guaranteed.

10. Changes to this policy

We may update this policy to reflect legal changes or changes in how the service is delivered. The date of the last update appears at the top of this page.