Privacy policy

Who is responsible for your data

The controller of your personal data is Narelo Europe S.L., NIF B93933273, Urb. el Rosario, C. los Limoneros, Local B, 29604 Marbella, Málaga, Spain. You can reach us at hello@narelo.es or on +34 655 366 888 for anything related to your data.

Visiting this website

When you open a page, the server that hosts this website automatically records technical information your browser sends: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. We need this to deliver the website and to keep it secure.

The legal basis is our legitimate interest in a working and secure website (Article 6(1)(f) GDPR). These records are kept only as long as necessary for that purpose and are then deleted. Our hosting provider is located in the European Union and processes this data on our behalf under a data processing agreement.

Cookies and analytics

Fonts, images, videos and the map are delivered from our own server. Without your consent, this website sets no cookies and loads nothing from other companies. Your browser only stores your cookie choice itself, which is technically necessary to remember it.

If you press Accept in the cookie banner, we use two analytics services to understand how families find and use this website, for example which pages are read and how often someone starts a conversation on WhatsApp, and to improve it. The legal basis is your consent (Article 6(1)(a) GDPR and article 22.2 LSSI-CE). You can withdraw it at any time with the link “Cookie settings” at the foot of every page; this does not affect anything done before.

• Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It sets cookies (_ga, _ga_*) that are kept for up to two years and records the pages viewed, device and browser, an approximate location derived from the IP address, which Google does not store, and clicks on WhatsApp, phone and email links. Advertising features are switched off. We keep analytics data for 14 months. Google processes the data on our behalf under a data processing agreement; data may be transferred to the United States under the EU-US Data Privacy Framework.
• Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. It sets cookies (_clck for up to one year, _clsk for one day) and records how pages are used, such as scrolling, clicks and mouse movements, as heatmaps and session recordings. Text you type is masked and not recorded. Recordings are kept for 30 days, aggregated statistics for up to 13 months. Data may be transferred to the United States under the EU-US Data Privacy Framework. Both services are loaded through Google Tag Manager (Google Ireland Limited), which only loads them and sets no cookies of its own.

When you contact us

You can contact us by WhatsApp, email or telephone. We then process what you share with us: usually your name, phone number or email address, your message and, if you tell us, information about your family and your child, such as their age. We use it to answer you, to find the right age group for your child, to arrange a conversation or a visit and, if it is right on both sides, to invite your family to join.

The legal basis is taking steps at your request before entering into a membership (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).

• WhatsApp: links on this website open WhatsApp, a service of WhatsApp Ireland Limited (Meta). When you write to us there, WhatsApp’s own privacy policy also applies, and data may be transferred to the United States under the EU-US Data Privacy Framework.
• Email: our email runs on Google Workspace, provided by Google Ireland Limited, which processes messages on our behalf under a data processing agreement. Data may be transferred to the United States under the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.

Members and their children

When your family becomes a member or books an experience, we process the data needed to provide it: the names and contact details of parents or guardians, your child’s name, date of birth and age group, any information you give us that matters for their care, such as allergies or health needs, the adults authorised to accompany or collect your child, and billing details.

The legal basis is the performance of the membership or booking (Article 6(1)(b) GDPR) and our legal obligations, for example under tax law (Article 6(1)(c) GDPR). Information about your child’s health is processed only with your explicit consent (Article 9(2)(a) GDPR) and only to look after your child safely.

We take photographs or videos in which a child can be identified, and publish them, only with the explicit consent of a parent or legal guardian. The same applies to quotes from families. You can withdraw this consent at any time; this does not affect anything done before.

Instagram and Google Maps

This website links to our Instagram profile and to our location on Google Maps. These are plain links: nothing is loaded from Instagram or Google until you click. Once you do, the privacy policy of Meta Platforms Ireland Limited or of Google Ireland Limited applies.

Who receives your data

We do not sell your data and do not share it for advertising. It is processed only by our team and by the service providers named above, who act on our instructions. Where the law requires it, data may be passed to tax authorities, our tax advisor or other public bodies.

How long we keep it

Enquiries that do not lead to a membership are deleted after twelve months at the latest. Membership data is kept for as long as the membership lasts and then for as long as the law requires, for example six years for accounting records under Spanish commercial law. Consent-based data, such as photographs, is kept until you withdraw your consent or until it is no longer needed.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to object to processing based on our legitimate interest, to receive your data in a portable format, and to withdraw any consent at any time. To exercise these rights, write to hello@narelo.es. We will answer within one month.

You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es), or with the authority in your country of residence.

Security

This website is delivered over an encrypted connection. We limit access to personal data to the people who need it and take appropriate technical and organisational measures to protect it.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version.