Cookie Policy

At Kidtastic Costa del Sol (“we”, “us”, “our”), we use cookies and similar technologies on this site to enhance user experience, manage bookings/rentals, support marketing, and comply with legal obligations. This policy explains what cookies we use, why, and how you can control them.

What are cookies and related technologies?
Cookies are small text files stored on your device when you visit a site. They help your browser remember certain information. Similar technologies include localStorage, pixels, tracking scripts, or identifiers used by third-party services (e.g. Meta, Zoho) to enable marketing, analytics, or form embedding.

Under EU laws (GDPR + the ePrivacy Directive), cookies that are not strictly necessary require your consent before being placed or activated.

We use Cookiebot to manage and record user consent for cookies on our website. Cookiebot automatically controls which cookies are activated based on your preferences and ensures compliance with applicable data protection laws (GDPR and ePrivacy Directive). Information about your consent (such as the time and date of consent and anonymised IP address) is securely stored by Cookiebot.

The legal basis
We collect and process personal data as part of providing our services.

For cookies, we rely on:

• Strictly necessary cookies that support essential site functionality. These do not require consent.
• For all other cookies (performance/analytics, marketing, preferences), we obtain your explicit, informed consent.
• You have rights under GDPR (access, correction, erasure, portability, withdrawal of consent). See our Privacy Policy for details.
  

Cookies we use

Type	Purpose	Examples / Tools
Essential / Strictly Necessary	To enable core site features: checkout/form submissions, booking forms, site security	WooCommerce cart/session cookies, form submission functions, Zoho CAPTCHA, Google reCAPTCHA
Performance / Analytics	To understand site usage so we can improve it (visits, page views, errors)	Google Analytics, Zoho/embedded analytics (if enabled)
Marketing / Advertising	To deliver relevant ads, track ad performance, retarget users	Facebook Pixel, Instagram Ads, Google Ads remarketing
Preferences / Functional	To store your user preferences: language, display settings, etc.	Theme settings, site preferences
Functional / Security	Protect online forms against automated spam and abuse; ensure safe and valid submissions	Zoho CRM form integrations (data capture and secure submission), Zoho CAPTCHA or Google reCAPTCHA

Data collected via cookies
Cookies and tracking tools may collect:

• IP address (possibly anonymised), browser type, device type, operating system
• Pages viewed, time spent on site, click paths
• Referral source (how you found us)
• For embedded forms, any information you voluntarily enter (name, email etc.), only if those forms set cookies or trackers
• Marketing cookies may associate your browsing behaviour with your email or phone, if you’ve shared those in forms and granted permission
• For security and spam protection, CAPTCHA tools (such as Zoho CAPTCHA or Google reCAPTCHA) may collect and analyse technical data including IP address, device/browser characteristics, and interactions with the page (e.g. mouse movements, keystrokes). This is solely for the purpose of verifying that a form submission is human.
  

Third-party data processors
We use third-party services that may place cookies / trackers:

• Google Tag Manager, Google Analytics, and Google Search Console (performance analytics)
• Facebook and Instagram (Meta) marketing and retargeting pixels
• Zoho One applications
• Google reCAPTCHA (form security and anti-spam protection)
  
  Who these third parties are, where they are located (servers in EU or compliant under Standard Contractual Clauses or other legal transfer mechanisms) — we ensure they comply with GDPR/appropriate safeguards.
  
  Our website uses Google Tag Manager to manage website tags (small code elements) and integrate third-party services such as Google Analytics. Google Tag Manager itself does not collect personal data or store cookies. However, it may trigger other tags that do collect data, in which case those services are separately described in this policy.
  
  Form submissions are transmitted into Zoho CRM, our customer relationship management platform. Zoho Corporation (Zoho CRM and related Zoho One applications) acts as a data processor. Data from CAPTCHA verification may be processed by Google Ireland Ltd. (with transfers to Google LLC in the United States under Standard Contractual Clauses).

Consent, control, and your rights
On your first visit, we show a cookie banner asking you to accept or decline non-essential cookies. Strictly necessary cookies are enabled by default.

You can accept or refuse different types of cookies (e.g. analytics, marketing, preferences) via the preferences panel. Consent must be freely given, specific, informed, and an explicit action (not pre-ticked boxes). This is required by EU law. You can withdraw your consent at any time. Please note: if you decline functional or security cookies, certain forms may not be submittable, as CAPTCHA validation is required to prevent spam and automated abuse.

Storage, retention and deletion

Cookies have expiry dates (session cookies expire when you close your browser, persistent cookies after a set period). We retain logs and analytics data only as long as needed to provide services or comply with legal obligations.

Personal data collected via forms is handled according to our privacy policy; cookies linked to that data are subject to the same retention limits.

• Special note for children’s data
  If children’s names or ages are collected, this is only done with parental or guardian consent. Any cookies or trackers that might link to that data are clearly explained, and you have the right to request deletion or correction.

For an up-to-date overview of all cookies currently in use, please refer to the Cookie Declaration at the bottom corner of the page, provided by Cookiebot.

Legal & regulatory context (Spain / EU)
GDPR (EU Regulation 2016/679) applies across the EU and Spain. The Spanish law “Organic Law 3/2018 on Protection of Personal Data and Guarantee of Digital Rights” integrates GDPR into Spanish law.

The Spanish Data Protection Authority (AEPD) has guidelines (2022–2023) requiring “reject” option in cookie banners, no cookie walls, and consent banner transparency.

Changes to this Cookie Policy
We may update this policy to reflect changes in technology, law or tools we use (e.g. new analytics or marketing platforms). We’ll update the effective date and notify you where appropriate.

Contact
If you have questions about our cookie practices, choices, or rights, you can contact us at: rebecka@kidtasticcostadelsol.com.