Privacy Policy

Last updated: March 2026

This Privacy Policy explains how Wellness Rave S.L. (“we”, “us”, or “our”) collects, uses, and protects your personal data when you visit wellnessrave.com or attend our events. We comply with the EU General Data Protection Regulation (GDPR), Spain’s Ley Orgánica 3/2018 (LOPD-GDD), and the Ley 34/2002 de Servicios de la Sociedad de la Información (LSSI).

1. Who We Are

Data Controller: Wellness Rave S.L.
Email: hello@wellnessrave.com
Address:
CIF/NIF:
Trade Registry:

No Data Protection Officer (DPO) has been appointed. For data-related enquiries, contact hello@wellnessrave.com.

2. What Data We Collect

Name, email, phone number — newsletter signup via our website contact form
Ticket purchase info (name, email) — processed by Luma; Wellness Rave receives order confirmations only
Device, IP, behavioural/session data — via Google Analytics 4 (GA4) through Google Tag Manager (GTM)
Photos and videos — taken at our events for promotional purposes (see Section 5)

3. Why We Collect Your Data & Legal Basis

Contract Performance (Art. 6(1)(b)): Ticket fulfilment, event confirmation, and entry management.

Legitimate Interest (Art. 6(1)(f)): Website analytics, communications with existing customers, promotional use of event photos/videos. We have assessed these interests do not override your fundamental rights.

Consent (Art. 6(1)(a)): Newsletter subscription — withdrawable at any time.

Legal Obligation (Art. 6(1)(c)): Financial record retention under Spanish tax law (Ley General Tributaria).

4. Cookies & Tracking Technologies

Google Analytics 4 (GA4): Tracks traffic, page views, events, and user behaviour. Opt out at tools.google.com/dlpage/gaoptout.

Google Tag Manager (GTM): Manages and delivers tracking tags. Does not collect personal data directly.

GoHighLevel / LeadConnector: CRM and email marketing platform for newsletter management.

A Cookie Policy and consent banner will be added in a future update. You may disable cookies via browser settings.

5. Photo & Video Policy

We photograph and film our events under legitimate interest (GDPR Art. 6(1)(f)) to promote our events and share the experience.

Images, video, and recordings may be used on our website, Instagram, Facebook, TikTok, in promotional materials, press coverage, and paid advertising.
No compensation is owed to attendees for use of their likeness.
You will be notified via visible signage at the venue entrance before each event.

Removal requests: Email hello@wellnessrave.com with a description or copy of the image/video. We respond within 30 days.

6. Third-Party Data Processors

Luma (ticketing) — subject to Luma’s own privacy policy; we receive order confirmations only.
Google (GA4, GTM) — analytics and tag management.
GoHighLevel / LeadConnector (CRM, email) — newsletter management. DPA in place.
Meta / Facebook (future paid advertising) — DPA to be established when Meta Pixel is deployed.

We do not sell your personal data to any third party.

7. International Data Transfers

US-based processors transfer data under Standard Contractual Clauses (SCCs) per GDPR Art. 46:

Google (GA4/GTM): Google SCCs
Luma: Luma SCCs
GoHighLevel / LeadConnector: GoHighLevel SCCs

Request copies of transfer safeguards at hello@wellnessrave.com.

8. Your Rights Under GDPR

Right of Access (Art. 15): Request a copy of your personal data.
Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion, subject to legal exceptions.
Right to Restriction of Processing (Art. 18): Limit how your data is used in certain circumstances.
Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to Object (Art. 21): Object to legitimate interest processing or direct marketing.
Right to Withdraw Consent: Unsubscribe at any time; this does not affect prior processing.

To exercise any right, email hello@wellnessrave.com. We respond within 30 days.

9. Automated Decision-Making & Profiling

We do not make automated decisions with legal or similarly significant effects on individuals. GA4 audience segmentation is for analytics only and does not constitute profiling under GDPR Art. 22.

10. Data Retention

Newsletter / CRM data: Until unsubscribe + 30 days.
Ticketing / order data: 6 years from event date (Ley General Tributaria, Art. 66).
Analytics data (GA4): 14 months (GA4 default).
Event photos/videos: Indefinitely for promotional use, unless removal is requested.

11. Contact Us & Supervisory Authority

Email: hello@wellnessrave.com

You have the right to complain to Spain’s data protection authority:
Agencia Española de Protección de Datos (AEPD) — aepd.es | C/ Jorge Juan, 6, 28001 Madrid

Please contact us first so we can address your concern directly.