Privacy Policy

Last updated: 5 August 2026

1. Data Controller

Connecta Life
Carrer d'Amàlia Soler, 16, 2
08720 Vilafranca del Penedès, Barcelona, Spain
Email: stef@connecta.life
Phone: +33 7 66 65 87 74

2. Purposes of Data Processing

We process your personal data for the following purposes:

• Booking management: Processing of registrations for spiritual retreats
• Commercial communication: Sending information about our services (with your consent)
• Customer support: Responding to your information requests
• Legal obligations: Compliance with Spanish and European regulations
• Safety: Protection of participants and staff
• Optional public reviews: Publishing, with your explicit consent, the public name, rating and text you choose after a retreat
• Optional Wellbeing Observatory: Linking WHO-5 check-ins with a strictly limited medical profile, under separate explicit consent, to produce observational analyses and public aggregated statistics
• Website measurement and enquiry attribution: Analysing traffic, journeys, technical performance and the probable source of enquiries in order to improve the website and guide our actions

3. Personal Data Collected

We collect the following categories of data:

• Identification data: Last name, first name, date of birth, nationality
• Contact data: Email address, phone number, postal address
• Health data: Medical information necessary for the safety of participants
• Browsing data: Visit logs may process the IP address, a pseudonymised fingerprint of that address, a pseudonymous session identifier, the browser, device, approximate geographic area, source, campaign parameters and page paths without parameters. When a visitor submits a form, the human visit made during the previous 30 minutes may be linked to the contact using the session or, failing that, the IP fingerprint, in order to record the probable source of the enquiry. Our separate in-house behavioural measurement processes page-to-page transitions, button and link actions, active time, scroll thresholds, exits and booking-funnel steps. It receives no entered text, form data, IP address, user-agent, prospect identifier or participation identifier
• Payment data: Billing information (not stored on our servers)
• Public review data: Chosen display name, rating, text, relevant retreat and timestamped evidence of consent. The invitation is internally linked to the participation and customer record to verify authenticity, but remains independent of any anonymous satisfaction survey answers
• Observatory data: WHO-5 scores, measurement stages and dates, answers to the three context questions, derived age band, sex, anxiety level and a small number of authorised binary indicators. Identity, contact details, exact date of birth, diagnoses, medication and free text are excluded from the analysis profile

4. Legal Basis for Processing

In accordance with the GDPR and the LOPD-GDD, processing is based on:

• Article 6.1.a GDPR: Consent for commercial communication
• Article 6.1.b GDPR: Performance of the services contract
• Article 6.1.c GDPR: Compliance with legal obligations (safety, health)
• Article 6.1.f GDPR: Legitimate interest for the improvement of our services
• Article 9.2.a GDPR: Explicit consent for health data
• Article 6.1.a GDPR: Explicit consent to publish a named or pseudonymous review
• Articles 6(1)(a) and 9(2)(a) GDPR: Explicit, optional and revocable consent for the Observatory and the limited linking of health data

5. Data Retention

Your data is retained for the following periods:

• Booking data: 5 years after the end of the contract
• Health data: 3 years after the last participation
• Communication data: 3 years after the last contact
• Browsing data: Individually distinguishable visit logs are retained to compare traffic, technical performance and the source of enquiries across several activity cycles. Aggregated statistics that have been anonymised may be retained to monitor long-term trends. Pseudonymised technical fingerprints used by the in-house behavioural measurement are deleted after 72 hours; only daily aggregated counters, with no individual identifier, are then retained
• Accounting data: 6 years (Spanish legal obligation)
• Optional public review: Until you withdraw your consent. The review is then unpublished; the information strictly necessary to record and honour the withdrawal may be retained within legal limits
• Wellbeing Observatory: The limited profile is deleted when consent is withdrawn and no later than the three-year health-data retention period following the last participation. Statistics already rendered anonymous and aggregated may be retained

6. Data Recipients

Your data is disclosed only to recipients required for the purposes described in this policy and is limited to the information they need to perform their role:

• Authorised staff and operational partners: Active team members and, where required for your support, specifically involved collaborators or partners. Their access is limited to the information necessary for organisation, follow-up and participant safety
• Hosting, domain and email: OVH SAS hosts the website and its data in France. Infomaniak Network SA manages the domain name, DNS and the email accounts used for communications, bookings, confirmations and invitations. Emails may also pass through the recipient's email provider
• Technical geolocation: ipapi.co may receive the visitor's IP address, exclusively over an HTTPS connection, to derive an approximate geographic area, such as country and city, for traffic analysis and enquiry attribution. If the service is unavailable, no data is sent to an unencrypted fallback provider
• Artificial intelligence, translation and transcription: OpenRouter and the model provider selected through it may process content required to qualify and continue conversations, translate responses or summaries — including medical information when this function is required — and analyse written feedback. OpenAI may receive the complete audio file of a voice message when Whisper transcription is enabled. Model providers' practices may vary; the OpenRouter privacy policy describes this routing
• Messaging services: Meta Platforms, through WhatsApp Business or WhatsApp groups, may process phone numbers, identifiers, messages, templates, acknowledgements and group membership. Telegram may receive information required for internal administrative notifications, such as identity and contact details, a request or conversation summary, booking or payment information and certain private links
• Emailing and contact management: Brevo may receive the email address, first name, last name, phone number, language, acquisition source and relevant list, as well as delivery, open, click, unsubscribe or complaint events, when this synchronisation is enabled
• Backups: Google Drive may host technical backups whose content is encrypted before transfer. These archives may contain the categories of data held in the application, including identities, communications, bookings, payments, private documents and health data
• Google services: Google Calendar may process the dates, locations, titles, links and email addresses required for team or participant calendars. When the website displays reviews, ratings, links or elements from Google Maps, Google may process technical data such as the IP address, browser and interactions. This content is subject to the Google Maps Platform terms and Google's privacy policy
• Payments: BilletWeb and, depending on the selected option, Revolut, Wise or a partner payment gateway may receive the data required to prepare and process the transaction, including identity, contact details, participation, price, amount and payment reference. Card or account credentials entered with the provider are not stored by Connecta Life; however, we retain the information required for accounting and payment reconciliation
• Meta advertising measurement: When this service is enabled for a contact originating from a Meta campaign, the Conversions API may receive the campaign or form identifier, events such as a reply or booking, and the email address and phone number after hashing, in order to measure and optimise campaigns
• Competent authorities: Strictly necessary data may be disclosed where required by law, a court decision or a valid request from a competent authority
• Search engines: A review you choose to publish is public and may be indexed, including through the structured data on the retreat page
• Observatory public: Researchers, journalists, search engines and AI assistants can access only aggregates above the confidentiality threshold; no individual or pseudonymised file is transferred to them

The presence of a service in this list does not mean that it systematically receives your data. Conditional providers are contacted only when the corresponding feature is enabled and your journey requires it. Some providers, particularly payment or messaging providers, may also act as separate controllers for processing carried out under their own terms.

7. International Transfers

Your data is mainly processed within the European Union, notably in Spain and France through OVH hosting. Infomaniak Network SA processes certain data in Switzerland, a country recognised by the European Commission as providing an adequate level of protection. Depending on the service used, technical routing and the selected model provider, some of the recipients listed above may process data in the United States or another country outside the European Economic Area.

Where such a transfer is subject to the GDPR, it is governed by a recognised mechanism, such as an adequacy decision or the European Commission's standard contractual clauses, supplemented where necessary by additional measures. You may ask us for information about the country of processing and the safeguards applicable to your situation by writing to stef@connecta.life.

8. Your Rights (GDPR and LOPD-GDD)

You have the following rights:

• Right of access (Art. 15 GDPR): To know what data we hold about you
• Right to rectification (Art. 16 GDPR): To correct inaccurate data
• Right to erasure (Art. 17 GDPR): To request the deletion of your data
• Right to restriction (Art. 18 GDPR): To restrict the processing of your data
• Right to data portability (Art. 20 GDPR): To receive your data in a structured format
• Right to object (Art. 21 GDPR): To object to the processing of your data
• Right to withdraw consent: At any time for processing based on consent

9. Exercising Your Rights

To exercise your rights, contact us:

• Email: stef@connecta.life
• Postal mail: Connecta Life, Carrer d'Amàlia Soler, 16, 2, 08720 Vilafranca del Penedès, Barcelona, Spain
• Response time: 1 month maximum (2 months if complex)

10. Right to Lodge a Complaint

If you consider that your rights are not being respected, you may lodge a complaint with:

Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Phone: +34 901 100 099
Website: www.aepd.es

11. Cookies and Similar Technologies

Our site uses:

• Technical cookies: Necessary for the operation of the site
• In-house audience measurement: Google Analytics 4 is disabled. This first-party tool uses only the technical session already required by the site, with no additional analytics cookie, no analytics localStorage or sessionStorage, and no transmission of its events to Google or another measurement provider
• Preference cookies: To remember your choices

Global Privacy Control and Do Not Track signals are respected. You can also disable or re-enable audience measurement for this browser below, without a banner on the home page.

12. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of sensitive data
• Restricted access to personal data
• Staff training on data protection
• Regular security audits

13. Minors

Our services are not intended for minors under 18. We do not knowingly collect personal data from minors.

14. Changes to This Policy

This policy may be modified. Any substantial change will be notified to you by email or via our website. The current version is always available on this page.

15. Contact

For any question regarding this privacy policy:

Connecta Life
Carrer d'Amàlia Soler, 16, 2
08720 Vilafranca del Penedès, Barcelona, Spain
Email: stef@connecta.life
Phone: +33 7 66 65 87 74