Privacy policy
Last updated: October 29, 2026
This is what personal data we process when you book a class, buy a gift card or a class pass, or simply visit bizcocho.art; what we use it for; and what rights you have.
Who is responsible for your data
- Controller: Olga Kovalenko
- Tax ID (NIF): Y7692398Q
- Address: Calle Uría 25, 33202 Gijón, Asturias, España
- Email: hola@bizcocho.art
What data we process
- Your account: first and last name, email, phone (if you give it), preferred language and your password, which we store encrypted. If you sign in with Google, Google gives us your name, your verified email, your profile picture and an identifier for your Google account.
- Your bookings: the classes or courses you book, how many people are coming, the booking's status, whether you attended, the amount and the payment's identifier, and any codes, gift cards or passes you use.
- Payments: card payments are processed by Stripe. We never see or store your card details.
- Gift cards: for the buyer, name, email and phone; for the recipient, name, email and the message you write. If you buy a gift card for someone else, make sure they're happy for you to give us their details.
- Communications: the emails we send you (confirmations, gift cards, password resets and, unless you've unsubscribed, news and offers) and anything you write to us by email or WhatsApp.
- Browsing, only if you accept cookies: the pages you visit, where you click, your device and browser type, and how you reached the site (for example, from an ad). The details are in the Cookie policy.
What we use it for, and the legal basis
- Purpose
- Create and manage your account, bookings, passes and gift cards; take payment and send confirmations
- Legal basis (GDPR art. 6.1)
- Performance of a contract (b)
- Purpose
- Send a gift card to its recipient
- Legal basis (GDPR art. 6.1)
- Contract with the buyer (b); legitimate interest regarding the recipient (f)
- Purpose
- Keep invoices and payment records
- Legal basis (GDPR art. 6.1)
- Legal obligation, accounting and tax (c)
- Purpose
- Send you news and offers from bizcocho by email: if you've booked with us and didn't say «No, thanks» when you created your account, or if you ticked the offers box in your profile
- Legal basis (GDPR art. 6.1)
- Legitimate interest (f) for existing customers, as art. 21.2 of the LSSI allows; consent (a) if you ticked the box. You can unsubscribe in your profile or from the link in any such email
- Purpose
- Analyse how the site is used (PostHog in your browser)
- Legal basis (GDPR art. 6.1)
- Consent (a), through the analytics cookies
- Purpose
- Measure whether our ads work, and tell Google Ads when a booking came from an ad
- Legal basis (GDPR art. 6.1)
- Consent (a), through the advertising cookies
- Purpose
- Keep internal statistics on sign-ups, bookings and purchases, linked to your account
- Legal basis (GDPR art. 6.1)
- Legitimate interest (f) in understanding and improving our business
- Purpose
- Protect the site against abuse (for example, limiting sign-in attempts)
- Legal basis (GDPR art. 6.1)
- Legitimate interest (f)
We only send Google Ads the ad click's identifier, the date, the amount and an order number. Never your name, email or phone.
Who else sees your data
We don't sell your data. We share it only with the providers we need to run the service, who process it on our behalf under contract:
- Provider
- Stripe
- What for
- Taking payments
- Where it processes data
- EU and US
- Provider
- Railway
- What for
- Hosting the site and the database
- Where it processes data
- EU (Netherlands)
- Provider
- Cloudflare
- What for
- Network, security and file storage (for example, gift card PDFs)
- Where it processes data
- EU and US
- Provider
- Resend
- What for
- Sending emails
- Where it processes data
- US
- Provider
- PostHog
- What for
- Site analytics and internal statistics
- Where it processes data
- EU
- Provider
- What for
- Sign-in with Google; ad measurement (Google Ads)
- Where it processes data
- EU and US
We may also disclose data to public authorities, courts or the police when the law requires it.
Transfers outside the European Economic Area
Stripe, Cloudflare, Resend and Google may process data in the United States. When they do, it's under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Account: while you have it. If you ask us to delete it, we do so within one month.
- Bookings and payments, gift cards and passes included: 6 years, for accounting obligations (Spanish Commercial Code, art. 30), even if you delete your account.
- Email offers: until you unsubscribe.
- Analytics: 1 year in PostHog.
- Advertising cookies: 90 days in your browser.
Your rights
You can ask us to access your data, correct it, delete it, object to or restrict how we process it, or receive it in a format you can take to another service. You can also withdraw any consent at any time, without affecting what we did before.
- You can change your name, phone, language and the offers box yourself in your profile. To stop receiving offers, the unsubscribe link in each email works too.
- For anything else, including deleting your account, write to hola@bizcocho.art. We'll answer within one month.
- If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).
Children
You must be at least 14 to create an account. Some classes are for children: an adult books them from their own account, and we don't ask for the children's details.
Changes to this policy
If we change it, we'll update the date at the top. If the change is significant, we'll tell you by email or on the site.