PRIVACY POLICY


Asociación Cultural de la Lavanda, with tax identification number G09880196 and registered address at calle Barrionuevo Alto, 30, 19400 Brihuega (Guadalajara), is the controller of the personal data it processes to manage the Festival de la Lavanda and the services on this website.

This policy explains what personal data we process, why we use it, the legal bases for processing, who receives it, how long we retain it and how you can exercise your rights.

When you use external platforms to buy tickets or other services, also consult the privacy information they provide about the processing they carry out.

For any questions about data protection or to exercise your rights, you can write to info@festivaldelalavanda.com


1. Personal data we process


Depending on the service you use or your relationship with the Festival, we may process:


  • Identification and contact details: name, surname, email address and telephone number you provide when buying tickets, making enquiries or requesting services.
  • Purchase data: tickets purchased, order reference, amount, payment status and, where necessary, billing details. Bank details are processed through the system of the payment provider used.
  • Subscription data: email address and preferences you provide when subscribing to the newsletter.
  • Enquiry and request content: information you send through forms or by email.
  • Event images: photographs and recordings, in accordance with the rules on the right to one’s own image and the applicable legal bases.
  • Browsing data: information collected through cookies and similar technologies, according to your settings and the terms described in the Cookie Policy.


Only the data necessary for each purpose will be requested. Mandatory fields will be identified in the relevant form; if you do not provide them, we may be unable to handle your request or complete your purchase.


2. Purposes and legal bases for processing


We process personal data for the following purposes:


  • Manage purchases and services: process orders, deliver tickets and provide necessary information about the event booked. The legal basis is the performance of a contract.
  • Responding to enquiries before a contract is made: preparing proposals or responding to enquiries about groups, businesses or other services. The legal basis is taking steps at the request of the person concerned before entering into a contract.
  • Respond to general enquiries: handle messages and requests for information. The legal basis is the Association’s legitimate interest in assisting people who contact it.
  • Meeting legal obligations: managing invoicing and responding to legally binding requests. The legal basis is compliance with those obligations.
  • Send the newsletter: share news and promotions with people who have voluntarily subscribed. The legal basis is consent, which can be withdrawn using the unsubscribe link in each communication or by writing to info@festivaldelalavanda.com.
  • Use images for advertising purposes: where it is necessary to identify an individual in advertising materials, their specific consent will be requested. Buying a ticket does not constitute such consent.


General images in which individuals appear incidentally may be documented and shared to inform the public about the event, based on the Association’s legitimate interest in reporting on the Festival, after assessing the necessity of doing so and respect for the rights of those affected. The use of cookies and tracking technologies is detailed in the Cookie Policy. Where consent is required, they must not be used before it is obtained.


3. Data recipients


Personal data may be processed by service providers needed to manage the website, purchases, communications and user support. When these providers act on behalf of the Association, they will act as data processors, with the required contractual safeguards and in accordance with its instructions.

We use Mailjet to manage and send the newsletter. Mailjet processes the data necessary to provide this service on behalf of the Association. You can find information about its data processing in the Mailjet Privacy Policy.

Ticketing platforms and payment providers may act as independent controllers for processing activities they determine themselves. Their privacy information will be available through the relevant channel.

Data may also be disclosed to public authorities, courts and other authorities where there is a legal obligation to do so.

Publishing photographs and recordings will make them accessible to the public and, where applicable, to the platforms on which they are shared. These uses will comply with the information in section 2 and the rules on the right to one’s own image.

Data will not be disclosed to third parties for their own marketing campaigns without a valid legal basis and the required prior information.


4. Links and cookies


This website may include links to external websites. When you visit them, consult their privacy information to find out how they process your personal data. Information about cookies and similar technologies used on this website, their purposes and how to manage your preferences is set out in our Cookie Policy. Technologies that require prior consent may only be used after it has been obtained. Browsing the website does not, by itself, constitute acceptance of their use.


5. Security measures


The Association will implement technical and organisational measures appropriate to the risk to protect personal data against loss, alteration, disclosure or unauthorised access. Access to data will be limited to the people and providers who need it to perform their duties, and who are subject to the relevant confidentiality obligations. The measures will be reviewed and updated in line with the risks of processing. No system can guarantee absolute security. If a personal data breach occurs, its consequences will be assessed and notifications will be made to the supervisory authority and affected individuals where required by applicable law.


6. International data transfers


The use of certain technology providers may involve the processing of data outside the European Economic Area.

Where international transfers take place, they must rely on a valid mechanism under the General Data Protection Regulation, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where applicable. You can request information about the recipients, countries and safeguards involved, as well as a copy of those safeguards where applicable, by writing to info@festivaldelalavanda.com.


7. Retention of personal data


Data will be kept for as long as necessary to fulfil the purpose for which it was collected:

  • Purchases and services: while the order is being processed and the service is being provided. Afterwards, the data needed to meet legal obligations and address potential liabilities will be retained for the applicable periods.
  • Enquiries and requests: until they have been handled and, where appropriate, for as long as necessary to deal with any claims.
  • Newsletter: for as long as you remain subscribed. When you unsubscribe, you will stop receiving communications, and the minimum data necessary to demonstrate consent and honour your request may be retained.
  • Photographs and recordings: for as long as necessary for the relevant informational or promotional purpose. Their retention will be reviewed periodically, and requests for removal will be handled in accordance with applicable law.
  • Cookies and similar technologies: for the periods specified in the Cookie Policy and the relevant list.

When the data are no longer necessary, they will be deleted or anonymised. If they must be retained to meet legal obligations or responsibilities, they will be blocked where applicable and deleted once the relevant retention periods have expired.


8. Your rights


You may exercise the following rights in the circumstances provided for by law:

  • Access: find out what personal data we process about you and obtain a copy.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: request the deletion of your data where applicable.
  • Restriction: request that the processing of your data be restricted.
  • Objection: object to processing based on legitimate interests and, in all cases, to the use of your data for direct marketing.
  • Data portability: receive the data you have provided in a structured format and transmit it to another controller where the legal requirements are met.
  • Automated decision-making: not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you, except in the cases permitted by law.

You may also withdraw your consent at any time. This will not affect the lawfulness of processing carried out before you withdrew it.


How to exercise your rights


Write to info@festivaldelalavanda.com or send your request to Asociación Cultural de la Lavanda, calle Barrionuevo Alto, 30, 19400 Brihuega (Guadalajara), stating which right you wish to exercise and the information needed to locate your request. You are not generally required to provide a copy of your ID. If there are reasonable doubts about your identity, additional information may be requested to verify it.

Exercising these rights is generally free of charge. We will respond within one month of receiving your request. If its complexity or the number of requests requires it, this period may be extended by a further two months. We will inform you during the first month of the extension and the reasons for it. You may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es, without first having to submit a complaint to the Association.


9. Updates to this policy


This Privacy Policy may be updated to reflect changes in data processing or applicable regulations. The current version will be available on this page and will indicate the date it was last updated. Where significant changes occur, affected individuals will be informed through appropriate channels. If a new processing activity requires consent, consent will be requested before it takes place. Publishing a new version does not, by itself, constitute consent to use data for new purposes.



Last updated: October 10, 2026.

‍