プライバシーポリシー

Privacy policy

Last updated: 10 November 2026

This policy explains how we process your personal data on www.caranvasports.com and its country domains (caranvasports.es, .fr, .de, .it, .pt, .nl and .cat), in the booking widget, chat, forms and emails, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).

1. Data controller

Controller: Caranva Sports S.L.
Tax ID (CIF): B75520114 · Registered in the Mercantile Registry of Ciudad Real
Address: Calle Pretorio, 6, 13332 Villahermosa (Ciudad Real), Spain
Data protection email: caranvasports@gmail.com
Phone: +34 699 631 613

Caranva Sports S.L. is not required to appoint a data protection officer; privacy enquiries are handled directly by the management at the email above.

2. What data we process, why, on what legal basis and for how long

a) Bookings and purchases. Data: name, email, phone, billing address, language, dates, details of each skier or rider (level, height, weight, shoe size), pick-up point, notes, amount and payment status. Purpose: to manage and charge the booking, send you the confirmation, reminders and changes, and give the shop or school what it needs to prepare your service. Legal basis: performance of the contract (art. 6.1.b GDPR) and accounting and tax obligations (art. 6.1.c). Retention: for the duration of the booking and then 6 years (art. 30 Spanish Commercial Code) plus tax limitation periods.

b) Optional or included insurance. If your booking includes or you buy insurance (no-show, damage and theft), we share your booking data with Reale Seguros Generales, S.A.U. to issue and manage the policy. Legal basis: performance of the insurance contract (art. 6.1.b GDPR).

c) Request, quote, group and contact forms. Data: name, email, phone, number of people, dates, destination and what you write to us. Purpose: to reply, prepare the quote or offer and, if you ask, pass your request to the provider that can handle it. Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR). Retention: as long as needed to handle your request and, if you do not book, up to 2 years.

d) Chat and customer service by email. Purpose: to answer your questions and prepare your booking. Replies may be drafted with the help of artificial intelligence models; no automated decisions with legal effects are taken about you. Legal basis: pre-contractual steps or contract (art. 6.1.b GDPR). Retention: up to 2 years after the last conversation.

e) Marketing communications. Purpose: to send you offers for services similar to those you already booked (offers for your trip, season openings) or, if you subscribed, our newsletter. Legal basis: legitimate interest for customers and similar services (art. 21.2 LSSI-CE and art. 6.1.f GDPR) or your consent (art. 6.1.a). You can unsubscribe in every email. Retention: until you unsubscribe or object.

f) Ratings and reviews. Purpose: to ask for your opinion after the service and publish it if you send it. Legal basis: legitimate interest in improving the service; publication, your consent.

g) Shops, schools and professionals. Data: business contact details from public sources (the business website, Google Maps) or provided by you and, if you partner with us, tax, signatory and bank details. Purpose: to propose the partnership, manage the agreement, send you bookings and pay you. Legal basis: legitimate interest in contacting businesses in the sector (art. 6.1.f GDPR) and performance of the agreement (art. 6.1.b). You can object by replying "no" to any email.

h) Browsing, analytics and advertising. Data: cookie identifiers, device, pages viewed and ad clicks. Purpose: to measure use of the website, improve booking and measure campaigns. Legal basis: your consent in the cookie banner (art. 6.1.a GDPR and art. 22.2 LSSI-CE), which you can withdraw at any time. See the Cookie policy.

i) Security and fraud prevention. IP address and technical access and payment logs, on the basis of legitimate interest (art. 6.1.f GDPR), for up to 12 months.

Fields marked as mandatory in each form are needed to handle your request. If you give us data about other people (for example, your group), you must have informed them. We do not process special categories of data. Children under 14 may not give us their data without the consent of their parents or guardians.

3. Recipients and processors

We do not sell your data. We only share it with those who need it to provide your service or where required by law:

Shops, schools, resorts and providers of your booking: the data needed to provide the service booked.
Reale Seguros Generales, S.A.U.: if your booking includes insurance.
Shopify International Ltd. (Ireland): online store and payment platform (Shopify Payments).
Payment providers (Stripe Payments Europe Ltd., Revolut Bank UAB, MONEI Digital Payments S.L.): process the payment; we do not store your card details.
Caranva (www.caranva.app), Vercel Inc. and Neon Inc.: booking widget, booking management, hosting and database.
Google Ireland Ltd. / Google LLC: email, Google Analytics and Google Ads (only with consent), maps and translation.
Microsoft Ireland Operations Ltd.: Microsoft Clarity, only with your consent.
Judge.me: management and publication of reviews.
NVIDIA Corporation, Groq Inc., Anthropic PBC and Google: artificial intelligence models that help draft chat and customer service email replies.
Accountants and advisers, and public authorities and courts where required by law.

4. International transfers

Some providers are located in the United States or may access data from there. Transfers rely on the EU-US Data Privacy Framework adequacy decision (for certified companies) or on the European Commission's Standard Contractual Clauses (art. 46 GDPR). You can ask us for a copy of the safeguards at caranvasports@gmail.com.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given (without affecting prior processing), by writing to caranvasports@gmail.com or by post to Calle Pretorio, 6, 13332 Villahermosa (Ciudad Real), Spain, stating which right you are exercising. We will reply within one month. To stop receiving marketing emails, just use the unsubscribe link in each email.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, or with the supervisory authority of your country of residence.

6. Security

We apply technical and organisational measures appropriate to the risk: TLS encryption for all communications, role-based access to data, payments tokenised by the payment provider and backups.

7. Changes

If we change this policy, we will publish the new version here with its date and, if the change is significant, we will let you know.