Privacy policy
What data we collect, what we use it for and what you can do about it. No small print.
Who handles your data.
The data controller is ALMIBUENS, S.L., with its registered address at Calle Doctor Barraquer 6, 5.º 2.ª, 08860 Castelldefels (Barcelona) and Spanish tax number (NIF) B24755332. You can write to us at hola@420tourspain.com about anything to do with your data.
Last updated: 23 September 2026.
What data we collect.
- Contact forms, club sign-up and listing claims
- Your name, email address, phone number if you give us one, and the message you write. If you sign a club up, also the photos and the video you upload. We use this to reply to you and to review the listing; the legal basis is your consent.
- Membership sign-up
- First name, surname, identity document number and email address. This information is sent to the club or clubs you choose, because they are the ones who have to identify you at the door, as their internal rules require. The legal basis is your consent and acting on your request.
- Reviews
- Your first name or initial, the text of the review and the rating. Your email address is never published: we keep it turned into an irreversible code whose only purpose is to prevent duplicate reviews of the same club.
- Technical data
- Server access logs including the IP address, needed to keep the site running and to protect it from abuse. The legal basis is our legitimate interest.
Who we share it with.
Your data is never passed to third parties for commercial purposes, and it is never shared with advertisers. To keep things running we use these providers, who act as data processors and can only use the data by following our instructions:
- Supabase — database and hosting for the photos and videos that are uploaded. Servers in the European Union.
- Vercel — hosting for the website.
- Resend — sending the automated emails (confirmations, codes and invitations to leave a review).
- Anthropic — automated screening of sign-up requests and reviews using artificial intelligence, to spot content that breaks our rules. The text sent is not used to train models.
- Google — the Google Maps listing shown on each club page is loaded from their servers.
When a provider handles data outside the European Economic Area, it does so under the standard contractual clauses approved by the European Commission.
The clubs are separate data controllers.
When you sign up, your details go to the club you chose. Every association is a separate legal entity: from that moment it is the data controller in its own right and applies its own policy. If you want your data deleted, you need to ask that association directly.
How long we keep it.
Messages from the forms, two years from the last contact. Membership sign-ups, for as long as it takes to process them and up to a year afterwards in case of complaints. Published reviews stay up for as long as the club's listing is active. Photos and videos of clubs that are not published are deleted after six months.
Your rights.
You can ask us for access to your data, to correct it, to delete it, to limit how it is used, to hand it to you in a portable format or to stop handling it altogether. Write to us at hola@420tourspain.com from the address you used and we will resolve it within a month at most.
If you think we have not got it right, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).
Cookies.
We do not use advertising or analytics cookies, and we do not track you across other websites. We only keep two technical things: the language you have chosen, so that we do not have to ask you again, and a temporary session if you are part of the team and you log in to the internal tools. Neither of them needs your consent, because the site would not work without them.
Changes.
If we change anything significant, we will update this page and the date at the top. Important changes are announced by email to anyone who has given us their address.