PECTRAHospitality +34 691 70 34 41 Let's talk about your event ESEN

Privacy Policy

Last updated: September 2026

This policy explains how Xpectra Hospitality, S.L.U. processes the personal data of those who visit this website, request information or hire our services, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights.

1. Data controller

  • Xpectra Hospitality, S.L.U. — Tax ID B93893204
  • Travessera de les Corts, 369, entresuelo, door 1, 08029 Barcelona, Spain
  • info@xpectrahospitality.com
  • Data Protection Officer: not appointed

2. Data we process

  • Identification and contact data: full name, company, position, email and phone number.
  • Request or booking data: event, zone, number of attendees, additional services and comments.
  • Billing and payment data, when a booking is formalized.
  • Browsing data: IP address, device and pages visited, as described in the Cookie Policy.

3. Purposes and legal bases

  • Answering enquiries and preparing proposals — basis: pre-contractual measures at the data subject's request (Art. 6.1.b GDPR).
  • Managing bookings, payments and service delivery on event day — basis: performance of the contract (Art. 6.1.b).
  • Complying with legal, accounting and tax obligations — basis: legal obligation (Art. 6.1.c).
  • Sending commercial communications about similar events and experiences to clients — basis: legitimate interest (Art. 6.1.f), with the right to object at any time.
  • Sending commercial communications to non-clients — basis: consent (Art. 6.1.a), which may be withdrawn at any time.
  • Website usage analytics — basis: consent given in the cookie banner.

4. Retention periods

Data from enquiries that do not lead to a contract is kept for a maximum of twelve months. Contract data is kept for the duration of the relationship and then blocked for the statutory limitation periods —six years for commercial records and four for tax obligations. Data processed on the basis of consent is kept until consent is withdrawn.

5. Recipients

The technology and operational providers needed to deliver the service may access the data as processors, under a contract compliant with Article 28 GDPR: web hosting, email, CRM, payment gateway, accounting firm and on-site service providers (venues, catering, transport and accommodation), strictly to the extent needed to carry out the booking.

Data will also be disclosed to the Tax Authority and other public bodies where legally required.

6. International transfers

If any provider is located outside the European Economic Area, the transfer is based on a European Commission adequacy decision or on standard contractual clauses, with any additional safeguards required.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, by writing to info@xpectrahospitality.com or to the postal address above, proving your identity.

If you believe the processing does not comply with the regulations, you may file a complaint with the Spanish Data Protection Agency (aepd.es).

8. Security

Xpectra applies appropriate technical and organizational measures to ensure a level of security appropriate to the risk, and requires the same of its processors.

9. Changes

This policy may be updated to reflect regulatory or service changes. The date of the latest version appears at the top.