Privacy policy.

1. Data controller

• Controller: María Retamero Pascual
• Spanish tax ID (NIF): 74684910T
• Address: Calle del General Ricardos 44, 28019 Madrid, Spain
• Email: legal@casocero.net
• Phone: +34 614 15 43 42

2. Personal data we collect

Through the contact form we collect the following data, all of it provided voluntarily by the user:

• Full name.
• Work or personal email.
• Company and job title (the latter optional).
• Event data: number of participants, tentative date, preferred format, indicative budget.
• Free-text comments provided in the corresponding field.
• Where applicable, indication of belonging to an event agency.

Additionally, through analytical cookies (with your consent), we may collect aggregated and anonymised browsing data. More detail in our cookies policy.

When you book tickets (The Tailor's Murder or The Last Curtain) we also collect: phone number, number of players, the booking and payment code and status, the date, time and IP address of your acceptance of the terms, the language and website you booked from, and how you reached our site (source, campaign and pages viewed), used only to know how you found us. Card details are processed directly by Stripe: Casocero never receives or stores them. On the day, venue staff see your name, number of players and outstanding balance to register your arrival.

3. Purposes of processing

We process your personal data for the following purposes:

1. To handle your enquiry: draft and send you the custom event proposal, manage contracting if applicable and execute the agreed service.
2. Operational communications: contact you by email to resolve queries, adjust logistics, send the proposal and, after the event, request feedback (NPS).
3. Compliance with legal obligations: issuing invoices and retaining accounting and tax documentation.

We do not send unsolicited commercial communications, do not profile users and do not sell data to third parties.

Ticket bookings: processing the booking and the deposit payment, sending the confirmation, reminder, address and, where applicable, cancellation and refund notices; registering your arrival; waiting-list alerts if you sign up; and, only if you tick the box, news about upcoming dates and offers (you can unsubscribe from any email).

4. Legal basis

• Performance of a contract or pre-contractual measures at the data subject's request (Art. 6.1.b GDPR): for handling the form and drafting the proposal.
• Compliance with legal obligations (Art. 6.1.c GDPR): for invoicing and accounting retention.
• Consent (Art. 6.1.a GDPR): for optional analytical cookies.

For ticket bookings: performance of a contract (art. 6.1.b GDPR) for the booking, payment and service emails; consent (art. 6.1.a) for the waiting list and marketing emails; legitimate interest (art. 6.1.f) to know how bookings reach us and to prevent payment fraud (you may object at any time).

5. Retention periods

• Form data without subsequent contracting: 12 months from last contact, unless prior request for deletion.
• Client data with contracting: for the duration of the relationship plus the legally required periods (Spanish Commercial Code: 6 years; tax legislation: 4-10 years depending on the case).
• Analytical cookies data: the period defined in our cookies policy.

Booking data: for the duration of the relationship and the legally required periods afterwards (up to 6 years for accounting records); visit-source data, 12 months; the waiting list is deleted after the session date.

6. Recipients and processors

Your data is not communicated to third parties except by legal obligation. To deliver the service we may rely on providers acting as data processors under signed contracts with clauses compliant with Art. 28 GDPR:

• Hosting and site delivery: Netlify, Inc. (USA) — under European Commission Standard Contractual Clauses.
• Transactional email and CRM: EU-based email/CRM provider [TO BE SPECIFIED ON CONTRACTING].
• Web analytics: Google Analytics (Google Ireland Ltd.), if you give consent, with anonymised IP.

For ticket bookings we also rely on: Stripe Payments Europe, Ltd. (Ireland) for payments; Supabase, Inc. (EU hosting) for the booking database; Resend (Plus Five Five, Inc., EU region) for transactional emails; and WhatsApp (Meta Platforms Ireland Ltd.) only if you write to us or agree to be contacted that way.

7. International transfers

Some of the providers above may process data outside the European Economic Area. In those cases, the transfer is covered by Standard Contractual Clauses approved by the European Commission or other appropriate safeguards provided for in the GDPR.

8. Your rights

As the data subject you may exercise the following rights at any time:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: have us delete your data when no longer necessary.
• Objection: object to processing based on legitimate interest.
• Restriction of processing in the cases provided for in the GDPR.
• Portability: receive your data in a structured format.
• Withdraw consent given, without affecting the lawfulness of prior processing.

To exercise these rights, write to legal@casocero.net indicating the right you wish to exercise and providing, if necessary, a copy of an ID document.

If you consider that we have not properly handled your request, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss or unlawful processing, including encryption in transit (HTTPS), role-based access control and regular backups.

10. Modifications

This policy may be updated to reflect legislative, technical or operational changes. The date of the last update appears at the end of the document. In case of substantial changes, we will notify affected users.

Last update: 30 April 2026.