Privacy Policy
Last updated: September 2026
1. Data controller
- Controller: Leire Ibáñez Esquisabel
- Address: Avenida de Zarautz 129, 2.º C, 20018 Donostia-San Sebastián, Spain
- Contact: info@20eventos.com
2. What we process and why
Enquiry form. When you send an enquiry we collect: your name (and your partner's name if you give it), email, phone, proposed date and location, indicative budget, package of interest, your message and preferred reply language. We use it to reply to you, assess whether the project is feasible and, if you decide to proceed, coordinate the planning.
Web analytics. If you accept analytics cookies, we process aggregated usage data (pages viewed, time on site, traffic source, device type, approximate location from IP) to understand how the site is used and improve it.
Form security. To tell people apart from automated submissions, the form uses a verification system that processes technical data from your browser and your IP address.
3. Legal basis
- Replying to your enquiry and managing the project: your consent when submitting the form and, where applicable, pre-contractual and contractual measures (Art. 6(1)(a) and 6(1)(b) GDPR).
- Web analytics: your consent, which you can withdraw at any time from the cookie notice (Art. 6(1)(a) GDPR).
- Security and spam/fraud prevention: our legitimate interest in protecting the site and the form (Art. 6(1)(f) GDPR).
4. Retention
We keep enquiry data for up to 3 years. If you engage us for a project, we keep the information for the duration of the relationship and afterwards for the periods required by tax and commercial law. Analytics data is kept per the Google Analytics setting (14 months).
5. Recipients and processors
We do not share your data with third parties except where required by law. To deliver the service, the following may access your data:
- Suppliers needed for the proposal (photographers, florists, venues), only once you confirm the details and with the minimum information required.
- Technology providers acting as processors: the web hosting provider (OVH, servers in the European Union) and Google (Google Workspace email and Google Analytics).
- Cloudflare, Inc., for the form's anti-spam verification.
6. International transfers
Google and Cloudflare may process data on servers outside the European Economic Area, mainly in the USA. These transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to info@20eventos.com. If you believe the processing does not comply with the rules, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Minors
This site is not aimed at children under 14 and we do not knowingly collect their data. If you are under 14, do not use the form without your parent or guardian's consent.
9. Security
We apply reasonable technical and organisational measures to protect your data against loss, misuse or unauthorised access.
10. Applicable law and changes
This processing is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD). We may update this policy to reflect legal or site changes; the version in force is the one published on this page.