PRIVACY POLICY

1. Scope and controller

This Privacy Policy explains how personal data is processed when a person visits or communicates through https://www.coast.club (the Website). The controller is:

2. Relationship with other Coast environments and partners

The Website is a public information and member-acquisition hub. Membership and workspace links lead to a separate service environment, accommodation links lead to CoastVenture's separate accommodation-booking environment, and experience links generally lead to independent partners.

Opening an ordinary outbound link does not mean that Coast.Club collects the information subsequently entered in the destination environment. Once the destination is opened, its own privacy information and the controller identified there apply. The destination may receive ordinary connection data, the referring address and any referral parameter contained in the link. Coast.Club does not receive reservation, payment or partner-purchase details merely because a link is followed; it receives referral or conversion information only if such a flow is configured and has a valid legal basis.

3. Data we process

Depending on how the Website is used, CoastVenture may process:

• Technical and usage data: IP address, device and browser information, date and time, requested pages, interactions, referring and exit pages, security events and cookie or consent choices.
• Communications: name, contact details and the content and history of enquiries sent to a published email address.
• Measurement data: online identifiers and information about visits, referrals and interactions where optional analytics or measurement has been enabled with the visitor's consent.
• Published contributions: a name or initials, country, image and the content of a testimonial or review supplied or otherwise authorised for publication.

The Website does not require a person to create an account or provide form data merely to browse it. Certain technical data is generated automatically when the Website is requested. Sending an email is voluntary, although contact details and the substance of the request are needed in order to reply.

4. Purposes and legal bases

Personal data is processed for the following purposes and legal bases under the General Data Protection Regulation (GDPR):

• to deliver, maintain, secure and troubleshoot the Website, prevent misuse and establish or defend claims, based on CoastVenture's legitimate interests in operating a secure and reliable service (Article 6(1)(f));
• to answer enquiries and take requested steps before a possible contract (Article 6(1)(b)) or, where no contract is contemplated, based on the legitimate interest in responding and administering communications (Article 6(1)(f));
• to remember consent choices and comply with legal obligations (Article 6(1)(c)) and, where relevant, the legitimate interest in demonstrating compliance (Article 6(1)(f));
• to conduct optional audience measurement, referral attribution or marketing only on the basis of consent (Article 6(1)(a)); and
• to publish a testimonial or review on the basis of the contributor's consent or other valid authorisation for that publication (Article 6(1)(a) or, where appropriate, Article 6(1)(f)).

Where processing is based on legitimate interests, CoastVenture balances those interests against the rights and reasonable expectations of the person concerned. Where processing is based on consent, consent may be withdrawn at any time without affecting prior lawful processing.

5. Sources and recipients

Data is obtained from the user, the user's browser or device, service providers involved in delivering and measuring the Website and, where applicable, the person or source that lawfully supplied a testimonial or referral record.

Data may be disclosed, only as necessary, to:

• HubSpot and the hosting, content-delivery, technical and security infrastructure used to provide the Website;
• Google services used for external web resources and tag management and, only where enabled under the applicable consent settings, measurement or marketing;
• Metricool, where enabled for consented audience measurement;
• IT, communications, legal, accounting and other professional providers subject to appropriate confidentiality and data-protection duties; and
• public authorities, courts or other recipients where disclosure is legally required or necessary to protect legal rights.

Google Tag Manager is a tag-management system. The data processed through it depends on the tags actually configured and the visitor's consent choices. CoastVenture does not sell personal data.

6. International transfers

Some providers or their authorised subprocessors may process data outside the European Economic Area. Where required, CoastVenture relies on an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful transfer mechanism and applies supplementary safeguards where appropriate. Information about the safeguard relevant to a particular transfer may be requested using the privacy contact above.

7. Retention

Personal data is retained only for as long as necessary for the relevant purpose:

• technical and security records are kept for the period reasonably needed to operate, protect and diagnose the Website, subject to the configurations and retention periods of the relevant provider;
• enquiries are kept while they are handled and afterwards only for follow-up, legal obligations or possible claims;
• consent records are kept for as long as needed to demonstrate the choice and compliance;
• optional measurement data is retained according to the periods stated in Cookie Settings or the relevant configured service; and
• published testimonials or reviews remain available while relevant and authorised, unless earlier deletion is required.

Data may be retained longer where a legal retention duty applies or for the limitation period of a legal claim. It is then restricted to that purpose.

8. Rights

Subject to the conditions in applicable law, individuals may request access to, rectification or erasure of their personal data, restriction of processing and data portability; object to processing based on legitimate interests; and withdraw consent at any time.

Requests may be sent to info@coastventure.com. CoastVenture may request information reasonably necessary to verify identity and will respond within the legally applicable period. Individuals may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or, where applicable, the supervisory authority of their habitual residence or workplace.

CoastVenture does not make decisions about Website visitors based solely on automated processing that produce legal or similarly significant effects.

9. Security and changes

CoastVenture applies appropriate technical and organisational measures proportionate to the nature of the data and the risks of the processing. No online service is completely risk-free, and users should avoid sending unnecessary sensitive information by ordinary email.

This Privacy Policy may be updated when the Website, its providers or applicable law changes. The current version is published on the Website. Changes requiring consent will be presented through the relevant consent mechanism.