Who is responsible for your data
- Data controller: Summer Up, S.L. (Up! idiomes)
- Tax number (CIF): B17721127
- Address: Passeig General Mendoza, 7, principal, 17002 Girona
- Phone: +34 972 21 23 54
- Email: …
What data we collect
- Booking and contact form: your name, email address, the course and start date you are interested in, the number of travellers, whether you want accommodation, and anything you write in your message.
- Phone and WhatsApp: if you call or message us, your phone number and what you tell us.
- Bookings: if you book, the details we need to organise your course and stay, and to invoice you.
- Technical data: like any website, our hosting provider processes your IP address and basic browser information to deliver the pages and protect the site against attacks.
- Visit statistics: we use Cloudflare Web Analytics, which counts visits anonymously and in aggregate (pages viewed, country, type of device), without cookies and without building profiles of visitors.
Please do not send us sensitive information (for example about your health) through the form. If you have dietary or accessibility needs, a short note is enough.
Why we use it, and on what legal basis
- To answer your enquiry and prepare your booking: steps you ask us to take before a contract (GDPR art. 6.1.b), and your consent when you tick the box on the form (art. 6.1.a).
- To run your course and stay: performing the contract with you (art. 6.1.b).
- Invoicing and accounting: our legal obligations (art. 6.1.c).
- Security of the website and the form (spam and abuse protection): our legitimate interest in keeping the service safe (art. 6.1.f).
We do not use your data for advertising, and we do not send newsletters unless you ask for them.
How long we keep it
- Enquiries that do not lead to a booking: up to two years, so we can answer follow-up questions, unless you ask us to delete them sooner.
- Booking and invoicing data: for the periods required by Spanish tax and commercial law.
- Technical data: for the short periods our providers need for security and operation.
Who processes data for us
We do not sell or rent your data. These service providers process data on our behalf, under data processing agreements:
- Cloudflare (website hosting, delivery and security).
- Resend (sends the messages from our contact form to our inbox).
- Google, only for the Google reviews shown on some pages: reviewers' profile pictures are loaded from Google's servers.
- WhatsApp (Meta), only if you choose to contact us on WhatsApp; in that case WhatsApp's own privacy policy also applies.
Some of these providers may process data outside the European Economic Area, for example in the United States. When that happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We may also share data with public authorities when the law requires it.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can withdraw your consent at any time, without affecting what was done before. To exercise your rights, contact us through the contact form, by phone or by post at the address above. We may ask you to confirm your identity.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
Minors
Our short courses are designed for adults. If you are under 14, a parent or guardian must contact us on your behalf.
Security
The website uses encrypted connections (HTTPS). We do not publish email addresses on the website, and our contact form is protected against automated spam.
Changes
We may update this policy, for example if we add a new service. The date of the latest version is shown below.
Last updated: 3 November 2026