Privacy Policy

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of December 5 (LOPDGDD), we inform you that the personal data collected through ludico.es is processed by:

Name

Joana Maria Martins Ramos

NIF

Y8363573M

Address

Rambla del Poblenou, Barcelona, Catalonia, Spain

Contact email

hola@ludico.es

Website

https://ludico.es

Hereinafter, “LUDICO” or “we/us”.

Depending on the activity you carry out on our platform, we process the following categories of data:

2.1 Users (people who book activities)

• Identification data: first name, surname, email address, phone number.
• Account data: username, password (stored in hashed format), activity preferences, booking history.
• Payment data: processed entirely by Stripe Payments Europe Ltd. LUDICO does not store card numbers or complete bank details.
• Usage data: IP address, device and browser type, visited pages, access date and time, traffic source.
• Geolocation data: approximate location derived from the IP address to show nearby activities. Precise geolocation is not collected without explicit consent.
• Communications: messages sent through contact or support forms.

2.2 Partners (activity providers)

• Professional identification data: first name and surname or business name, NIF/NIE/CIF, tax address, phone, email.
• Bank details: IBAN and account holder, collected exclusively to configure payment through Stripe Connect.
• Tax data: entity type (self-employed, SL, association), IAE heading, VAT and personal income tax status.
• Venue data: name, description, address, photographs, activity categories, schedules, and prices.
• Supporting documentation: Modelo 036/037, qualification certificates or civil liability insurance, voluntarily provided during onboarding.

2.3 Website visitors

• Technical, analytics, and preference cookies, in accordance with our Cookies Policy.
• Browsing data collected through analytics tools.

3.1 Management of the contractual relationship

Legal basis: performance of a contract (art. 6.1.b GDPR).

• Creation and management of user and partner accounts.
• Processing bookings and payments through Stripe.
• Management of cancellations, refunds, and incidents.
• Issuing invoices on behalf of partners (third-party billing).
• Management of the payment platform and settlement of commissions.

3.2 Compliance with legal obligations

Legal basis: legal obligation (art. 6.1.c GDPR).

• Compliance with Spanish tax regulations: personal income tax withholding (Modelo 190), VAT returns (Modelo 303/390), and other tax obligations before the Tax Agency.
• Retention of accounting records and invoices under article 30 of the Commercial Code (minimum 6 years).
• Compliance with anti-money laundering regulations where applicable.

3.3 LUDICO’s legitimate interest

Legal basis: legitimate interest (art. 6.1.f GDPR), provided that the rights of the data subject do not prevail.

• Fraud prevention and verification of partner identity.
• Statistical and platform usage analysis to improve the service.
• Management of claims and legal defense.
• Platform security and detection of abusive behavior.

3.4 Consent of the data subject

Legal basis: consent (art. 6.1.a GDPR). Consent may be withdrawn at any time without retroactive effect.

• Sending commercial communications and newsletters about new activities and offers (explicit opt-in).
• Use of analytics and marketing cookies (managed through the cookie consent banner).
• Initial contact with potential partners through the interest form.

Once the above periods have elapsed, the data will be deleted or irreversibly anonymized.

5.1 Processors

LUDICO shares data with the following service providers as processors, with whom data protection agreements (DPAs) are in place:

• Stripe Payments Europe Ltd. (Ireland): payment processing. Transfer covered by European Commission Standard Contractual Clauses (SCCs).
• Vercel Inc. (USA): infrastructure and hosting. Transfer covered by the EU-U.S. Data Privacy Framework (DPF) and SCCs.
• Resend (USA): transactional email delivery. Covered by SCCs.
• Mapbox Inc. (USA): maps and geographic integration service. Covered by SCCs.
• Web analytics provider (to be determined): aggregated and anonymized usage analysis.

5.2 Third-party recipients

• Spanish Tax Agency (AEAT): in compliance with tax obligations (IRPF withholdings, VAT).
• Courts and tribunals: when legally required.
• No commercial transfers of data to third parties are carried out.

5.3 International transfers

Transfers to providers located outside the European Economic Area (EEA) are carried out under appropriate safeguards pursuant to article 46 GDPR (Standard Contractual Clauses) or an adequacy decision of the European Commission. For more information about applicable safeguards, contact us at hola@ludico.es.

In accordance with articles 15 to 22 of the GDPR, you have the right to:

• Access: know what personal data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): request deletion of your data when it is no longer necessary for the purpose for which it was collected or when you withdraw consent.
• Objection: object to processing based on legitimate interest or to receiving commercial communications.
• Restriction of processing: request temporary restriction of the processing of your data.
• Portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Not to be subject to automated decisions: LUDICO does not make automated decisions with significant legal effects without human intervention.

To exercise your rights, contact hola@ludico.es indicating your full name, the right you wish to exercise, and a copy of your DNI/NIE or other identification document. We will respond within a maximum period of 30 calendar days.

If you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

LUDICO uses cookies and similar technologies in accordance with Spanish Law 34/2002 on Information Society Services (LSSI) and the GDPR.

• Technical cookies: essential for platform operation (user session, booking cart, language preferences). They do not require consent.
• Analytics cookies: allow platform usage to be analyzed in aggregate form to improve the service. They require prior consent.
• Preference cookies: remember user-selected options (neighborhood, category, language). They require prior consent.
• Third-party cookies (Stripe, Mapbox): necessary for payment and map services. Governed by the privacy policies of the respective providers.

You can manage your cookie preferences at any time through the configuration panel available in the website footer, or by configuring your browser to reject or delete cookies. Please note that rejecting technical cookies may affect platform functionality.

For detailed information about each cookie, its duration, and provider, see our full Cookies Policy at ludico.es/cookies.

LUDICO’s services are intended for people over 18 years old. We do not intentionally collect personal data from children under 14 without verified consent from their parents or legal guardians, in accordance with article 8 GDPR and article 7 LOPDGDD.

For activities aimed at minors under 18, we require express consent from the parent or legal guardian at the time of booking, who assumes responsibility for the minor’s participation. The minor’s data is processed exclusively for managing the booked activity.

If we become aware that we have collected data from a child under 14 without the corresponding parental consent, we will delete it immediately. To notify us, contact hola@ludico.es.

LUDICO implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with article 32 GDPR:

• Encryption of communications using TLS 1.2 or higher (HTTPS).
• Password storage using secure hash functions (bcrypt).
• Access to data restricted to strictly necessary personnel, with permission controls.
• Payment data processed exclusively by Stripe, PCI-DSS level 1 certified.
• Periodic backups and incident recovery procedures.
• Periodic review of security measures.

If a security breach occurs that poses a risk to your rights and freedoms, LUDICO will notify the AEPD within 72 hours of becoming aware of it (art. 33 GDPR), and affected data subjects when the risk is high (art. 34 GDPR).

LUDICO has profiles on social networks (including Instagram). The processing of follower data is governed by the privacy policies of each platform.

LUDICO only processes the data necessary to manage communication and the relationship with followers within each social network, without transferring that data to its own systems unless express consent is given.

LUDICO reserves the right to modify this Privacy Policy to adapt it to legislative, case-law, or business practice changes. Changes will be published on this page with the update date.

In the event of substantial changes affecting processing based on consent, we will request new consent.

Date of last update: June 11, 2026.

For any query related to the processing of your personal data, you can contact LUDICO at: hola@ludico.es.

LUDICO is not required to appoint a Data Protection Officer (DPO) at this initial stage of activity. However, if the requirements of article 37 GDPR are met in the future, a DPO will be appointed and communicated to the AEPD.

For any data protection matter, the contact point is the email address indicated above.