Privacy policy

This is an English translation for your information. If there is any difference, the Spanish version prevails.

This policy explains how the personal data you give us through this website is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights (LOPDGDD).

1. Data controller

• Controller: ADVENTURE MOUNTAIN TOURISM AND BIKE S.L. (First Route MTB)
• Tax ID (CIF): B88549357
• Registered address: Av. Príncipe de Asturias 45, 28860 Paracuellos del Jarama, Madrid (Spain)
• Email: info@firstroutemtb.com

2. What data we process

The data you give us in the booking form or on WhatsApp: name, email, phone (optional), lesson type, number of people, level, the day and time you choose, your answers to the level questionnaire and the message you write. To book you must also sign the release of liability, which includes the participant’s ID or passport number, date of birth, an emergency contact, your choice about photos and videos, your signature and, for minors, the details of their parent or legal guardian. Please do not send health data or other sensitive data through this form; if there is something the instructor needs to know for your safety, tell him in person before the lesson.

3. Purpose

• To answer your questions and manage lesson bookings.
• To provide the service you have booked and, where applicable, issue the corresponding invoice.
• To keep the signed release of liability as proof that you accepted its terms.
• Only if you tick the corresponding box: to send you news, rides, courses and offers from First Route MTB by email.

We do not build profiles or send advertising without your express consent. You can unsubscribe from our emails at any time using the link in each email or by writing to info@firstroutemtb.com.

4. Legal basis

• Your consent, when you send the form accepting this policy (art. 6.1.a GDPR), and your specific, optional consent to receive commercial communications (art. 21 LSSI-CE).
• Taking steps prior to entering into the contract and performing the lesson contract (art. 6.1.b GDPR).
• The organiser’s legitimate interest in being able to prove that the release of liability was accepted (art. 6.1.f GDPR).
• Compliance with legal obligations, such as tax obligations (art. 6.1.c GDPR).

5. Retention

Enquiries that do not end in a booking are deleted no later than 12 months after the last contact. If you have subscribed to our news, your name and email are kept until you unsubscribe. Customer data is kept for as long as the relationship lasts and then for the legal limitation periods (for example, 6 years for accounting obligations). Signed releases of liability are kept for as long as liabilities may arise (as a general rule, 5 years).

6. Recipients

We do not share data with third parties unless required by law. To provide the service we use providers that act as data processors: web hosting and email (Soluciones Corporativas IP, S.L. – DonDominio, with servers in Spain); Google (Google Drive, to store signed releases, and Google Calendar, to organise lessons), which may process data outside the European Economic Area with the safeguards provided for in the GDPR; the email tool we use for news (only if you subscribe); and, if you write to us on WhatsApp or Instagram, Meta Platforms, which may process data outside the European Economic Area with the safeguards provided for in the GDPR.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to info@firstroutemtb.com and stating which right you are exercising. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Security

The website uses an encrypted connection (HTTPS) and we apply technical and organisational measures to protect your data against unauthorised access, loss or alteration.

9. Minors

If the student is under 14, the request must be sent by their mother, father or legal guardian. If the participant is under 18, the release of liability must be signed by their mother, father or legal guardian.