Privacy Policy
Information about the processing of your personal data at creedencerock.com.
1. Data controller
Creedence Rock Bar by 21, S.L. (hereinafter, "CREEDENCE" or "the owner") is the controller of the personal data collected through this website.
- Company name: Creedence Rock Bar by 21, S.L.
- Tax ID (CIF): B70580790
- Address: C/ Manuel Murguía 32 Bajo Izquierda, 15011 A Coruña, Spain
- Contact email: creedencerockbar@gmail.com
- Data Protection Officer: Not applicable
2. Data we collect and purpose
The personal data we process, depending on the service you use, is as follows:
| Service | Data | Purpose | Legal basis |
|---|---|---|---|
| Registration in the customer area | Full name, nickname, email, password | Create and manage your account, allow you to participate in the pool, access VIP offers and identify you on future visits. | Contract performance (art. 6.1.b GDPR) |
| Contact form | Name, email and message | Reply to your inquiry. | Consent (art. 6.1.a GDPR) |
| Depor Pool | Nickname, email, encrypted password, date of birth, predictions with creation and modification date and time, correct predictions, awarded prizes and, at each prize redemption attempt, IP and browser used | Manage your account and participation in the pool: verify age of majority (mandatory to participate), record predictions, calculate correct predictions, publish rankings (nickname only), assign and validate prize redemption, and prevent fraudulent uses. | Contract performance (art. 6.1.b GDPR) and legitimate interest in fraud prevention (art. 6.1.f GDPR) for technical redemption data |
| VIP card balance | VIP card code, name associated with the card and current balance | Show you your VIP balance in your customer area, automatically synchronized from our POS system, without you having to ask at the bar. | Contract performance derived from your VIP club membership (art. 6.1.b GDPR) |
| VIP card transaction history | Date and amount of each top-up and consumption with your VIP card during the last month | Show in your customer area the details of your recent top-ups and consumption. | Contract performance derived from your VIP club membership (art. 6.1.b GDPR) |
| Sending commercial communications | Inform you about bar events and promotions (only if authorized). | Consent (art. 6.1.a GDPR) | |
| Website usage statistics | Page visited, the domain you arrived from, language, device type (mobile, tablet or desktop) and an irreversible fingerprint of your IP address and browser. Your IP address is never stored in the clear, nor is any data that identifies you directly. | To find out which sections of the site are used and which are not, so we can improve them. Measurement is carried out entirely on our own server and uses no cookies or third-party tools. | Legitimate interest in understanding how our website is used (art. 6.1.f GDPR) |
In public pool rankings and standings, only the nickname is shown, never the full name or email.
Minimum age: participation in the Depor Pool is reserved for those over 18 years old, since the prizes consist of alcoholic beverages. The date of birth is requested solely to verify this requirement and is not shown in any ranking or profile public.
Technical prize redemption data: when a prize is redeemed at the bar, the system records the IP address and browser (user agent) from which the redemption is made, along with date and time. This data is kept as internal proof to prevent fraud and is not used for any other purpose.
VIP card balance: if you are a holder of a VIP card at Creedence Rock Bar, your card code, name and current balance are automatically synchronized from our POS system to the web, so you can check it from your customer profile. Only you can see your own balance, and the linking between your web account and your VIP card is exclusively performed by authorized bar staff; you cannot activate it yourself from your profile.
VIP card transaction history: together with the balance, your customer area shows the date and amount of your VIP card top-ups and consumption. This history is always limited to the last month: transactions older than 30 days are automatically removed from the web periodically and are no longer available, both for you and for us, in this system.
3. Retention period
We keep your data for the following periods:
- Customer account: while you keep the account active. If you delete it or have not accessed for more than 3 years, the data will be deleted.
- VIP card balance: while the link between your account and your VIP card is active. If you delete your account or the bar unlinks your card, the balance stops being visible on the web immediately; the data itself continues to exist in our internal POS system while you keep the VIP card with us.
- VIP card transaction history: 30 days from the date of each transaction, after which it is automatically deleted from the web.
- Contact form: while the query lasts and up to 12 months afterwards.
- Tax or accounting data (invoices, if any): during the period required by tax regulations (minimum 4 years, up to 6 years for the Commercial Code).
- Website usage statistics: 90 days, after which they are deleted automatically.
4. Recipients
Your personal data will not be transferred to third parties, except by legal obligation. The data is stored on the servers of our hosting provider, with whom we maintain a data processing contract in accordance with art. 28 GDPR.
Additionally, this website incorporates the Google Maps map (Google Ireland Limited) on the contact page. When loading the map, Google may process technical data such as your IP address and browsing data. Google has adhered to the Data Privacy Framework, which allows international transfers of data to the United States with adequate guarantees. You can find more information at Google's Privacy Policy.
Except for this service, no other international data transfers are made.
5. Your rights
As the data subject, you have the right to:
- Access: know what data we have about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): request that we delete your data.
- Opposition: object to processing in certain cases.
- Restriction of processing: request that we suspend the use of your data.
- Portability: receive your data in a structured and readable format.
- Withdraw consent at any time, without retroactive effect.
You can exercise these rights by writing to creedencerockbar@gmail.com, indicating the right you wish to exercise and attaching a copy of your ID or equivalent document.
If you consider that we have treated your data incorrectly, you can file a complaint before the Spanish Data Protection Agency (AEPD): www.aepd.es.
6. Security
We have implemented technical and organizational measures to protect your data against unauthorized accesses, losses and alterations: encrypted passwords (Argon2id hash), secure connections and restricted accesses to the administration panel.
7. Changes to this policy
We reserve the right to modify this policy to adapt it to legislative changes or changes in the service. The current version will always be the one published on this page.