Who processes your data
Centre d'Apropament a la Natura, tax ID G64364912, registered at La Granja El Mujal, 08670 Navàs (Barcelona, Spain), is the controller of the personal data collected through www.granjanatura.com. You can reach us at reserves@granjanatura.com.
This policy explains what data we process, why, for how long and who we share it with, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and digital rights.
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Managing your booking and your admission to the centre | Name, email address, phone number (optional), any comments you write, the make-up of your group and any extras booked | Performance of the contract (art. 6.1.b GDPR) | For the duration of the relationship and, afterwards, four years for tax purposes and six for commercial records |
| Sending you the booking emails: the confirmation with your QR code and the reminder 48 hours before your visit | Name and email address | Performance of the contract (art. 6.1.b GDPR) | Same as the booking |
| Sending you a message after your visit asking for your feedback | Email address | Legitimate interest in hearing from the people who visit us (art. 6.1.f GDPR). You can object at any time | Until you object |
| Applying the accredited discounts for large families, single-parent families, teachers, retirees and guests of partner accommodation | The discount type and how many people in the group qualify for it | Performance of the contract (art. 6.1.b GDPR) | Same as the booking |
| Applying the disability discount | Only the indication that one or more people in the group have a recognised disability. See the section below | Your explicit consent (art. 9.2.a GDPR) | Same as the booking |
| Validating the birthday promotion | Children's dates of birth, provided by the adult making the booking | Performance of the contract (art. 6.1.b GDPR) | Same as the booking |
| Managing gift cards | Details of the buyer (name, email address and phone number) and of the recipient (name, email address and the personal message printed on the voucher) | Performance of the contract (art. 6.1.b GDPR) | Until the voucher is redeemed or expires, plus the statutory periods |
| Booking a table at the on-site restaurant | Name, date, number of people and menus chosen | Performance of the contract (art. 6.1.b GDPR) | Same as the booking |
| Sending you our newsletter | Email address and, if you give it to us, your name | Your consent (art. 6.1.a GDPR) | Until you unsubscribe |
| Invoicing and accounting | Transaction data | Legal obligation (art. 6.1.c GDPR) | The periods set by Spanish tax and commercial law |
| Measuring how the site is used with Google Analytics, to see which pages people read and improve the site | A cookie identifier, the pages you visit, your device type and approximate location | Your consent, given by accepting the cookie notice (art. 6.1.a GDPR) | The cookies expire after 2 years; account-side data follows the retention period configured in Google Analytics |
The disability discount
Selecting this discount is voluntary, and we handle it with particular care because the law treats it as sensitive data.
What you tell us is limited to the fact that one or more people in the group have a recognised disability, which is what determines the price. We do not ask for any certificate, diagnosis or degree of disability, and we store no supporting document. Proof is checked at reception on the day of your visit and is never recorded on the website.
You can book without selecting the discount and pay the standard rate, or request it by phone or email if you would rather not state it here. This processing is based on the explicit consent you give by ticking the box, and you can withdraw it at any time.
Children's data
Bookings are always made by an adult. For children we only process the number of participants and the age band that determines the price and, if you use the birthday promotion, the date of birth you provide. We ask for no other information about children and never send them communications.
Payments
Payments are processed through Stripe, on a payment page hosted by Stripe itself. Card details are entered directly into Stripe: they never pass through our servers and we never store them. We only receive the outcome of the transaction and the amount.
The QR code on your ticket contains only an internal booking reference. There is no personal data inside the code.
Who we share data with
For the service to work, some companies process data on our behalf, under contract and on our instructions:
| Who | What for | Where |
|---|---|---|
| Vercel | Website hosting | United States |
| DigitalOcean | Hosting of the booking system and its database | Frankfurt data centre (EU) |
| Stripe Payments Europe | Payment processing | Ireland (EU) |
| Resend | Delivery of booking emails, reminders and vouchers | United States |
| Microsoft | The centre's corporate email | Ireland (EU) |
| Mailrelay | Newsletter and campaign delivery | Spain (EU) |
| Google Ireland | Website analytics, only if you accept analytics cookies | Ireland (EU), with possible transfers to the United States |
| Partner restaurant | Only the table bookings you make there | Navàs (Spain) |
We may also disclose data to public authorities and banks where a legal obligation requires it. Beyond those cases, we do not sell or share your data with anyone. Our invoicing software receives aggregate sales figures only, with no personal data in them.
Transfers outside the European Union
Vercel and Resend are United States companies, and Google Ireland may transfer data to its US parent. Those transfers rely on the adequacy decision for the EU-US Data Privacy Framework or, where it does not apply, on the standard contractual clauses approved by the European Commission. All other providers process data within the European Union.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability. You can also withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out beforehand.
To do so, write to reserves@granjanatura.com or to La Granja El Mujal, 08670 Navàs (Barcelona, Spain), stating which right you wish to exercise. We will reply within one month. We will only ask for identification if we have reasonable doubts about who you are.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (calle de Jorge Juan 6, 28001 Madrid, www.aepd.es).
Security
The website and the booking system always run over an encrypted connection (HTTPS). Access to the booking administration is limited to authorised staff at the centre, with individual credentials. The server that runs the booking system is backed up daily, and those backups are kept for one week in the same European Union data centre; this means that if you ask us to erase your data, it may remain in those backups until they expire. We apply reasonable technical and organisational measures to protect the information, bearing in mind that no system connected to the internet can guarantee absolute security.
Changes to this policy
We may update this policy if our services, our providers or the law change. You will always find the date of the latest revision below.
Last updated: 24 August 2026