Privacy policy

Draft pending legal review. This text has not yet been validated by a data protection lawyer and has no definitive legal value. Do not use it as a basis for legal decisions until it is confirmed.

Last updated: 3 November 2026.

This policy explains what personal data we process when you visit this website, use the cost calculator, sign a child up for L'Amagatall Christmas Camp (Vic and La Garriga) or contact us; what we use it for, who we share it with, how long we keep it and what rights you have. It follows Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE). The camp is for children from i2 to i5, so a large part of the data concerns minors and is always provided by their parent or legal guardian.

Data controller

The controller of the data processed on this website is the entity that runs L'Amagatall Christmas Camp at the Vic and La Garriga locations:

Company name: Amagatall Cafè i Jocs
Tax ID (NIF): B21971833
Address: Carretera Nova 4, 08530 La Garriga, and Passatge Joan Puig 2, 08500 Vic
Contact email for data protection matters: privacitat@lamagatalljocs.com

You can also contact us on WhatsApp.

Children: who provides the data and who gives consent

Children's data (name, school year from i2 to i5, attendance days, allergies and intolerances, the name and school year of a brother or sister if you sign them up too — data about another minor — and, if you authorise it, images) is always provided by their parent or legal guardian, never directly by the child. Children of these ages cannot give any consent themselves.

Only a holder of parental responsibility or legal guardian of the child, or a person authorised by the holders, may sign the child up and give the consents requested in the forms: confirmation that you have read this policy, the optional image checkbox and, where applicable, consent for health data. If there is more than one holder of parental responsibility, the adult completing the form must be entitled to do so.

Allergies and intolerances are health data, a special category of data (Art. 9 GDPR). We only process them with your explicit and separate consent; only the team's authorised account can access them in the administration panel; and they never appear in emails, CSV exports, Stripe or technical logs. We do not ask for any other health data, nor for diagnoses or medication.

What data we process, why and on what basis

These are the processing activities involving personal data carried out by this website. For each one we state the purpose, the data, the legal basis and the recipients. Retention periods are in the section «How long we keep it».

Sign-up and place management

Purpose: To manage a child's sign-up to the Christmas Camp (one sign-up per child; you can sign up two siblings in the same form): reserve and confirm the place, calculate and confirm the final price (discounts included), contact the family, organise the camp and email you the confirmation with a copy of your answers. Each sign-up also triggers an internal notice to the L'Amagatall team. The team also uses, for internal purposes only, aggregated counts of children signed up per day, time slot, early drop-off and lunch (with no identifying data) to plan the space and service at the cafés where the camp takes place.
Data: About the responsible adult: full name, email, phone number and how you prefer to be contacted. About the child: name and school year (from i2 to i5). Location (Vic or La Garriga) and the camp option chosen: type, days, schedule and extras (early drop-off and catered lunch). Optionally, who told you about the camp (an L'Amagatall staff member). For discounts: whether the child already attended the Summer Camp and whether you are signing up with 3 or more families (you declare it and the team verifies it), and, if you sign up a brother or sister in the same form, their name and school year: this data is necessary to provide the service and complete the reservation, and each sibling's name is also stored in the other's sign-up so they stay linked and the sibling discount can be applied. We also store the price estimate calculated by the server, the payment status of the reservation, the date and time of the sign-up and the confirmation that you have read this policy.
Legal basis: Performance of a contract and pre-contractual steps taken at your request (Art. 6.1.b GDPR): this data is necessary to provide the service you request; if you do not provide it, we cannot manage the sign-up. The mandatory checkbox in the form is a confirmation that you have read this policy, not an optional consent. If you sign up two children in the same form, the confirmations and consents you give in it (privacy policy, images and, where applicable, health) apply to the whole family, i.e. to both, and you give them as the parent or legal guardian of both.
Recipients: Supabase, Netlify, Resend, Stripe, hCaptcha and the team's internal mailbox (see «Recipients and providers»).

Payment of the reservation and of the remaining amount

Purpose: To collect the reservation for the place, which is paid online by card (Stripe Checkout) once the form is sent, and to check that it has been paid; to collect the remaining amount by bank transfer before the camp starts; and to meet accounting and tax obligations.
Data: The following travel to Stripe: your email (for the receipt), the sign-up identifier (and the second one's, if you sign up two children), the number of children, the camp edition, the location (Vic or La Garriga) and the child's attendance days; never the child's name or any health data. You enter your card details directly in Stripe: this site does not receive or store them. We store in our database the payment session identifier and the date and time at which Stripe confirms the payment to us. For a bank transfer, we see the details shown on our bank statement (account holder and originating account).
Legal basis: Performance of the contract (Art. 6.1.b GDPR) and, to keep accounting and tax records, compliance with a legal obligation (Art. 6.1.c GDPR).
Recipients: Stripe (online payment processing) and the bank (transfers). If the online payment cannot be opened, we tell you how to pay through another channel.

Allergies and intolerances (health data)

Purpose: So that the team keeps the child's (or each child's, if you sign up two) allergies or intolerances in mind in order to look after them during the camp (for example, at breakfast and lunch). They are not used for any other purpose.
Data: Free text that you write for each child (maximum 500 characters each). The field is optional: if the child has none, leave it blank and nothing is stored. We ask you not to write diagnoses or medication. We also store the fact that you gave explicit consent.
Legal basis: Your explicit consent (Art. 9.2.a GDPR), given through its own checkbox, separate from the rest, which only appears if you write an allergy or intolerance and which covers those of the children signed up in that form. You can withdraw it at any time (see «Your rights»); if you do, we will delete the information and the team will no longer be able to take it into account during the camp, so we ask you to tell us directly.
Recipients: Only the L'Amagatall team's authorised account has access, through the administration panel. It is never included in emails (neither the confirmation nor the internal notice), nor in CSV exports, nor sent to Stripe or hCaptcha, nor in technical logs. It is stored in the Supabase database.

Photos and videos

Purpose: To take photos and videos of the children during the camp and use them to promote future editions.
Data: Images and videos in which the children appear. We store your decision (box ticked or not) in the sign-up, as proof of consent.
Legal basis: Your consent (Art. 6.1.a GDPR and Organic Law 1/1982 on the right to one's own image), always optional: it does not condition the sign-up and the box is not pre-ticked. You can withdraw it at any time, without affecting earlier use. The team manually checks, before publishing, that only images of families who have consented are published.
Recipients: Images that are published (in this site's gallery or on Instagram) can be seen by any visitor. Files are stored in Supabase (Storage), in a private space that only serves items the team has published. Instagram embeds only load if you accept non-essential cookies.

Information about benefits for camp members

Purpose: To remind enrolled families of the benefit for camp members (a discount on birthday parties at L'Amagatall): the sign-up confirmation email and the payment return page always carry a reminder, with a link.
Data: Your email address and the fact that you have signed up to the camp.
Legal basis: Legitimate interest in informing about benefits that belong to the service contracted (Art. 6.1.f GDPR). You can object at any time by writing to privacitat@lamagatalljocs.com; the email itself reminds you of this and we will respect it.
Recipients: Resend (sending the email).

Cost calculator, waiting list and interest in future camps

Purpose: To respond to your request for information or for the waiting list when you leave your details in the calculator, send you a thank-you email and contact you; and, only if you ask for it, to inform you when sign-ups open for future camps. This is not a sign-up or a reservation. Each submission also triggers an internal notice to the team.
Data: Name, email and phone number; location (Vic or La Garriga); school year (from i2 to i5) of each child, without their name, and the selection made for each child (type, days, schedule and extras); and whether you want to receive information about future camps. The calculator does its calculations in your browser: nothing you type is sent to our servers until you submit the form (except the loading of hCaptcha when the page opens and the day selection, which travels in the web address when moving from the calculator to the sign-up). No health data is requested.
Legal basis: Pre-contractual steps taken at your request (Art. 6.1.b GDPR) in order to contact you about the camp; and your consent (Art. 6.1.a GDPR), given by expressly confirming that you want to receive information, for information about future camps.
Recipients: Supabase, Netlify, Resend, hCaptcha and the team's internal mailbox (see «Recipients and providers»).

Christmas Camp interest pop-up (no longer active)

Purpose: To notify the families who left their details before places for the Christmas Camp opened. Places have now opened and the pop-up is no longer shown: this data is no longer used for anything else and will be deleted when the 2026 Christmas Camp ends; only the team can view it.
Data: Full name, email, phone number, town/city, location (Vic or La Garriga), number of children and their ages (free text, without their names). No health data was requested.
Legal basis: Your consent by voluntarily submitting the form (Art. 6.1.a GDPR), which you can withdraw at any time.
Recipients: Supabase, Netlify and hCaptcha. This form did not send any email.

Enquiries and communications (WhatsApp, phone and email)

Purpose: To answer your enquiries and communicate with you about the sign-up through the channel you have chosen (WhatsApp, email or phone call): confirming the place, the final price, payment instructions and any questions you have.
Data: Your phone number or email address, your name and the content of the messages.
Legal basis: Pre-contractual steps and performance of the contract (Art. 6.1.b GDPR) when the communication concerns a sign-up; for other enquiries, our legitimate interest in answering them (Art. 6.1.f GDPR).
Recipients: WhatsApp (Meta group), if you use this channel: it processes the conversation data under its own privacy policy.

Site security and abuse prevention

Purpose: To protect the site and the form data against automated submissions, spam and abusive use, and to keep a record of the team's actions in the administration panel.
Data: hCaptcha verification: when a form is shown, your browser loads the hCaptcha script, which receives your IP address and technical data about the browser and the interaction in order to tell people from robots; we only receive the result. Submission limit: your IP address is kept in server memory while the instance is running, only to limit repeated submissions; it is not stored in the database (hosting providers may log it in their technical logs). Hidden anti-bot field: it collects no data. Panel action log: the email of the team member, action, table affected, record identifier, date and time and a technical detail (for example, when exporting a list, the number of rows); it does not include families' data.
Legal basis: Legitimate interest in guaranteeing the security of the site and of the data (Art. 6.1.f and Art. 32 GDPR).
Recipients: hCaptcha and Netlify (technical hosting logs).

Data from the previous edition (Summer Camp 2026)

Purpose: To keep, until it is deleted, the data from the sign-ups and requests of the 2026 summer edition, which has ended, and to keep that edition in the site archive («Look back at the Summer Camp»).
Data: The same categories described above, with the specifics of that edition: weeks chosen with their schedule and extras and, for the group discount, the names of adults from other families. The 2026 summer sign-up was handled in part with a Google form (Google Forms and spreadsheet).
Legal basis: That of the original processing: performance of the contract and, for images, consent.
Recipients: Supabase and, for the form archive, Google.

Mandatory data and source of the data

The data marked as mandatory in the forms is necessary to provide you with the service: if you do not provide it, we cannot manage the sign-up or your request. Optional items are allergies and intolerances, the image authorisation, who told you about the camp, the data for discounts (whether they attended in summer, families, brother or sister) and interest in future camps. You provide all the data yourself. If you give us data about other people (for example, the name of a brother or sister), make sure you have their parental authority or authorisation. We do not use the data in the forms to build profiles.

Recipients and providers

To provide the service we use providers that process data on our behalf and services that process it as independent controllers. These are they, and the data they receive:

Supabase. Database, team authentication (Supabase Auth) and file storage (gallery). The sign-ups, requests and the rest of the data described in this policy reside there.
Netlify. Website hosting and execution of the server code through which forms and payments pass. It may record technical data about visits, such as the IP address, in its logs.
Resend. Sending of emails: the confirmation the family receives (the sign-up one includes a copy of the answers: name of the adult and of the child, phone number, contact preference, location, school year, camp option chosen and who told you about the camp, if you indicated it; never allergies; if you sign up two children at once, the name and school year of both appear) and the internal notice to the team. The email address is not verified before anything is sent to it: type it carefully. Resend has its own subprocessors; the list is public at resend.com/legal/subprocessors.
Team internal mailbox. Each sign-up and each calculator submission generates an internal notice in the L'Amagatall team's mailbox. The sign-up notice carries the sign-up data (name of the adult and of the child, email, phone number, preferred contact, location, school year, camp option chosen, discount data, estimate and your decision on images), but never allergies (there is one notice per child); the calculator one carries name, email, phone number, location and the school year of each child with their selection.
Stripe. Collects the reservation by card (Stripe Checkout). It receives your email, the sign-up identifier (and the second one's, if you sign up two children), the number of children, the edition, the location (Vic or La Garriga) and the child's attendance days, and the payment details you enter directly in Stripe; never the child's name or health data. Stripe processes payment data under its own privacy policy.
hCaptcha. Anti-bot verification. It loads when a form with verification is shown (calculator and sign-up). Your browser connects to hCaptcha, which receives your IP address and technical data about the browser and the interaction in order to tell people from robots; we only receive the verification result.
Meta (Pixel and Instagram, only with consent). Only if you accept the corresponding purpose: the Meta Pixel (measuring and optimising advertising) and the Instagram embeds in the gallery. The provider is Meta Platforms Ireland Limited, which processes the data under its own privacy policy and, as regards the Pixel, as joint controller with L'Amagatall.
Google (Analytics and Ads, only with consent). Only if you accept non-essential cookies: Google Analytics (site usage statistics) and, when we run advertising campaigns on Google, Google Ads (conversion measurement and remarketing). Google Ireland Limited and Google LLC process the data under their own privacy policy.
WhatsApp. If you write to us or we call you on WhatsApp, the conversation goes through the WhatsApp platform (Meta group), which processes it under its own privacy policy. The button on this site only opens WhatsApp: it loads no script or tracking.
Google (summer 2026 archive only). Part of the 2026 summer sign-up was handled with a Google form (Google Forms and spreadsheet), where data may remain until it is deleted.

We do not sell your data or hand it to third parties for their own purposes. We only disclose it to public authorities, courts or law enforcement when the law requires us to.

International transfers

Some providers may process data outside the European Economic Area. When this happens, it is done with the safeguards required by the GDPR (a European Commission adequacy decision or standard contractual clauses) and you can ask for information about them by writing to privacitat@lamagatalljocs.com.

How long we keep it

General criterion: we do not keep data longer than necessary for the purpose for which it was collected and, afterwards, only blocked during the limitation periods for possible liabilities (Art. 32 LOPDGDD). The periods are as follows:

Sign-ups (data about the adult, the child and the camp): up to 24 months from collection, without prejudice to what the law says about accounting records.
Sign-ups with the reservation unpaid: until the camp ends. After 24 hours without payment, the sign-up stops counting as an occupied place.
Allergies and intolerances: until the camp ends, or earlier if you withdraw your consent.
Photos and videos: as long as you do not withdraw your consent. If you withdraw it, we will stop using them and remove them from the website and from our social media; we cannot control copies that third parties may already have downloaded.
Calculator requests (waiting list): until the edition they refer to ends. Interest in future camps: until you withdraw it and, at most, 24 months.
Interest in the Christmas Camp (pop-up no longer active): until the 2026 Christmas Camp ends.
Internal notices in the team mailbox and conversations with families (WhatsApp, email, phone calls): 24 months.
Data from the 2026 summer edition that is still kept: it will be deleted or anonymised when the 2026 Christmas Camp ends.
Log of administration panel actions: 24 months.
Payment receipts and accounting and tax records: the periods set by law.
Providers (Stripe, Resend, Netlify, Supabase, hCaptcha, Meta, Google Analytics and Ads): they keep the data they process under their own policies.

Deletion is done manually: the team deletes or anonymises data at the end of each edition and whenever we receive a request to exercise rights.

Automated decisions

We do not take decisions based solely on automated processing, nor do we build profiles, that produce legal effects on you or similarly affect you (Art. 22 GDPR). The site performs automatic calculations (the price estimate, which is indicative: the final price is confirmed by the team, and the check for fully booked days) and anti-bot systems may reject a submission they consider automated; if that happens, try again or write to us.

Your rights

You can exercise the following rights over your data and the child's data at any time, free of charge (on behalf of the child, they are exercised by the holder of parental responsibility or legal guardian):

Access: find out whether we process data about you and obtain a copy and information about the processing.
Rectification: correct inaccurate data or complete incomplete data.
Erasure: ask us to delete the data when, for example, it is no longer necessary or you withdraw your consent.
Restriction: ask for the data to be kept, without any other use, while a claim or an objection is being resolved.
Objection: object to processing based on legitimate interest, on grounds relating to your particular situation.
Portability: receive in a structured, commonly used format the data you have given us, when the processing is based on the contract or on consent and is carried out by automated means.
Withdrawal of consent: you can withdraw at any time the consents you have given (images, allergies and intolerances, information about future camps and non-essential cookies) without affecting the lawfulness of earlier processing.

How to exercise them: write to us at privacitat@lamagatalljocs.com or on WhatsApp, stating the right you want to exercise, the name of the person who made the sign-up and of the child, and the email used. We may ask you to prove your identity (and, if you act on behalf of the child, that you are the holder of parental responsibility or legal guardian) in order to protect the data. To withdraw cookie consent, use the «Cookie settings» link in the footer.

We will reply within one month of receiving the request, extendable by two further months if it is complex or if there are many requests (Art. 12.3 GDPR).

If you consider that we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es), without prejudice to telling us first so that we can resolve it.

Cookies and local storage

Third-party cookies and similar technologies are only activated with your prior consent (Art. 22.2 LSSI-CE and Art. 6.1.a GDPR), which you can give or refuse separately for each purpose from the banner. Technical ones (language, cookie decision, hCaptcha, admin session) do not need it. These are the purposes, followed by the detail of each cookie:

Analytics (Google Analytics 4): site usage statistics, to know which pages are visited, for how long and where traffic comes from, and to improve it. Recipients: Google Ireland Limited and Google LLC. Legal basis: your consent.
Advertising (Meta Pixel and, if we run campaigns on Google, Google Ads): measuring the effectiveness of L'Amagatall's ad campaigns and optimising them, that is, helping the platform show the ads to the people most likely to be interested (for example, based on the notice that someone clicked to start the sign-up, left their details in the calculator or paid the reservation). Recipients: Meta Platforms Ireland Limited, which acts as joint controller with L'Amagatall for the collection and transmission of data through the Pixel (Art. 26 GDPR), and Google. The Meta Pixel is shared with other L'Amagatall websites (tickets, bookings and birthdays), so Meta may link visits across all of them; your consent here only covers this site. These providers may process data outside the European Economic Area (for example, in the United States) under the safeguards provided by law. Legal basis: your consent.
Embedded content (Instagram, from Meta): showing L'Amagatall's Instagram posts in the gallery. When loaded, Instagram receives your IP address and browser data. Recipient: Meta Platforms Ireland Limited. Legal basis: your consent.
Where nothing is tracked: neither the Meta Pixel, nor Google Analytics, nor Google Ads send anything while you fill in the sign-up form, which contains data about your family. The only thing recorded, from the page where you click, is that you clicked to start the sign-up, with no form data. No tracking tool acts on the page you return to after payment either, except that, if you have accepted advertising, the Meta Pixel reports there that you paid the reservation (the amount and the name of the camp), after the payment identifier has been removed from the page address.

Language preference (first-party, technical; NEXT_LOCALE cookie): remembers the interface language. It is only created in some cases (when the page language differs from the browser's) and it is a session cookie: it disappears when you close the browser. It does not require consent.
Cookie decision (first-party, technical; browser local storage, key «consentiment-cookies»): stores what you accepted or rejected for each purpose (analytics, advertising and embedded content), the date and the version of the banner text, so that it can be demonstrated. It is not sent to our servers and is kept until you delete it with «Cookie settings» or from the browser.
hCaptcha verification (third-party; technical): it loads when a form with verification is shown, without waiting for the banner, because it protects the form you have decided to use. It may use its own cookies or storage in your browser.
Administration panel session (first-party, technical): only the L'Amagatall team receives it when logging in to the panel; families and visitors do not.
Meta Pixel (third-party; advertising purpose, only with consent): if you have accepted it and the Pixel is active on the site, a Meta script (connect.facebook.net) is loaded that stores the first-party cookie _fbp and, only if you arrive from an ad, _fbc (up to 90 days) and sends Meta the page visited and browser identifiers, in order to measure and optimise advertising. It also tells Meta about three actions: that you clicked to start the sign-up, that you left your details in the calculator and that you paid the reservation (with the amount paid), without your name, email or phone number. No data about you (name, email, phone number…) is passed to it, and automatic event setup and automatic advanced matching are switched off. While you fill in the sign-up form the Pixel is switched off, and on the return from payment it only sends the notice that the reservation was paid. Without your consent it is not loaded.
Google Analytics 4 (third-party; analytics purpose, only with consent): if you have accepted it and the tag is active on the site, a Google script (googletagmanager.com) is loaded that stores the first-party cookies _ga and _ga_XXXXXXXXXX (up to 2 years) and sends Google the page visited, the visit duration, the traffic source, your IP address, device data and basic interactions (scrolling, outbound clicks and downloads), for statistics only. It sends nothing while you are on the sign-up or the return from payment. Without your consent it is not loaded.
Google Ads (third-party; advertising purpose, only with consent): when we run advertising campaigns on Google, the Google tag may measure conversions (for example, a family signing up after seeing an ad) and build remarketing audiences so that L'Amagatall ads can be shown to you elsewhere. To do so, Google may store advertising cookies and receive the page visited, browser identifiers and browsing data, and process them outside the European Economic Area under the safeguards provided by law. You can manage ad personalisation from your Google account. Without your consent it is not loaded.
Instagram embeds (third-party; only with consent): in the gallery, some items are Instagram posts. The Instagram (Meta) frame only loads if you have accepted the embedded content purpose; otherwise you see a link to Instagram, which only contacts Instagram if you click it.

You can accept or reject non-essential cookies, for each purpose, at any time: the «Cookie settings» link, at the bottom of any page, deletes the decision and shows the banner again, where you can choose again. When you withdraw a consent, the site deletes the first-party cookies of that purpose and reloads the page so that the tool stops acting immediately. Cookies that third parties may have stored on other domains must be deleted from your browser.

Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: encrypted connections (HTTPS); forms send their data through the server, which validates it and applies anti-bot verification and a submission limit; database access rules that prevent anyone other than the team's authorised account from reading sign-ups and requests; access to the administration panel restricted to the team's authorised account, with personal login; health data never leaves by email or in exports; panel exports are logged; and the services' secret keys only live on the server.

If a personal data breach occurs that poses a risk to your rights, we will notify the Spanish Data Protection Agency within a maximum of 72 hours and, if the risk is high, the affected individuals as well (Arts. 33 and 34 GDPR).

Changes to this policy

We may update this policy. If the changes are substantial (for example, a new provider or a new purpose), we will indicate it on this site.