1. Data controller

CAROLINA LAW LEE, tax ID 41551729K, of c/ Sèquia 5, 5-1, 17001 Girona (Spain), trading as EquiCoach Girona. Contact: info@equicoachgirona.com.

2. What we process and why

  • Booking data: full name, email, phone, language, profile (child, adult, family or organisation) and your message, plus the date and time of the session. Purpose: managing your booking and contacting you. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).
  • Session history and follow-up notes: observations on how the process is progressing. Purpose: continuity of support. Legal basis: performance of the service and, where health data is involved, your explicit consent (Art. 9(2)(a) GDPR).
  • Newsletter: email and language, only if you tick the box. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
  • Payment data: where the session must be paid in advance, card details are collected and processed directly by Stripe. We never see or store them.

3. How long we keep it

For the duration of the relationship and afterwards for statutory tax and accounting retention periods (up to 6 years). Newsletter data is kept until you unsubscribe. You may request erasure at any time.

4. Cookies this site uses

First-party cookies, all strictly technical; no consent required:

  • eq_csrf — Protects forms against fraudulent submissions (CSRF). Duration: 12 hours.
  • eq_consent — Remembers whether you accepted or refused third-party cookies. Duration: 6 months.
  • eq_admin — Keeps the admin panel session. Only created if someone logs in. Duration: 8 hours.

Third-party cookies, only if you accept them:

  • Google Maps (NID and similar, Google Ireland Ltd.) — Allow the embedded map on the Facilities and Contact pages to display. Duration: up to 6 months, per Google's policy. If you refuse, the map isn't loaded and Google receives no request at all.

We use no analytics, advertising, profiling or remarketing tools. Typefaces are hosted on this same domain.

5. Who we share your data with

  • Brevo (Sendinblue SAS, France) — Processor. We pass on the email address, language and activity group (service profile) of people who subscribe to the newsletter. Purpose: sending the communications you subscribed to. Servers in the European Union. Data processing agreement in place under Article 28 GDPR.
  • Stripe (Stripe Payments Europe Ltd., Ireland) — Processor. Receives your email address and payment details when a session must be paid in advance. Purpose: processing the payment. Acts as an independent controller for fraud prevention.
  • Website hosting provider — Processor, with servers in the European Union.

We share data with no other third party and make no international transfers outside the European Economic Area. Session reports are never stored on this site: only a link to an external, credential-protected document is kept.

6. Your rights

You have the right to access your data, rectify it, erase it, object to processing, restrict it, exercise portability and withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, write to info@equicoachgirona.com stating which right you wish to exercise. We will reply within one month at most. If you believe your request was not handled properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).

7. Security

Emails, phone numbers, messages and notes are stored encrypted in the database. Access to the admin panel is protected by a password plus a second factor sent by email.