Privacy policy

The detail

Short version: we collect what you send us, we use it to answer you and to keep you safe on the hill, and nobody buys it from us.

Who’s responsible

Charles Antony Centa, NIF ESY2633736C, Disseminat Camp de Fútbol 1, Garòs, 25539 Lleida, Spain. hola@breadandbutterclimbing.com · +34 650 801 075.

What we collect, and when

• When you enquire through this site: your name, email address, phone number, and whatever you write — the activity or trip, rough dates, group size and your climbing experience. The enquiry also carries how you reached the site — the link you arrived by, or the page that sent you — so we know which of the things we make actually brought you here. That part is about the route in, not about you, and it reaches nobody but us.
• When you join the list: your email address, and nothing else.
• When you message on WhatsApp: your phone number and the conversation. That lives on WhatsApp under their terms, not ours.
• When you book, on the participation form: your date of birth and ID number, address and phone, an emergency contact, your own insurance or federation licence details, your previous climbing experience, and a health declaration.

We never ask for payment card details through this website.

Health data, specifically

The health declaration is the most sensitive thing we hold, so it gets its own rules. It is collected only to keep you safe during the activity, it is processed only on your explicit consent under article 9(2)(a) of the GDPR, and it is used for nothing else — not marketing, not analysis, nothing.

Why we’re allowed to hold it

• To run the booking and provide the service — performance of the contract.
• To meet tax, accounting and insurance obligations — legal obligation.
• To keep you safe during the activity — and for health data specifically, your explicit consent.

Who else sees it

The insurers and their assistance networks; emergency and rescue services, if that ever becomes necessary; and the tax and accounting adviser. Nobody buys it and nobody rents it. Your booking details stay within the EEA. The website’s host, Netlify, and — only if you accept them — Google and Meta are US companies that process data under the EU–US Data Privacy Framework.

The website itself runs on Netlify, which hosts the pages and receives what you submit through the forms (that is how an enquiry reaches us). If you accept analytics, Google processes the analytics data as described below. If you accept advertising, Meta does the same for the advertising data. The map tiles on one page come from OpenFreeMap, also described below.

How long we keep it

For as long as we’re working together, and after that for the statutory limitation and claims periods that apply.

Photographs

Photographs and video of you are used only with your separate, explicit consent, given on the participation form. It’s voluntary, you can withdraw it whenever you like, and refusing changes nothing about the service or its price.

Cookies, analytics and advertising

We ask about two things, separately, and you can say yes to one and no to the other. Both set cookies, so neither runs unless you agree to it — nothing is loaded and no cookie is set until you do. If you say no to both, nothing about the site changes, and you won’t be asked again unless you ask to be.

Which pages people read. Google Analytics tells us things like which pages are visited, roughly where visitors come from and which links get clicked — including when someone sends an enquiry, clicks through to WhatsApp or signs up to the list, so we can tell what is actually useful. It does not tell us who you are, and it never receives what you typed into a form. Google Analytics 4 does not store your full IP address: it uses it to work out roughly where you are and discards it.

Advertising. We sometimes run ads on Instagram and Facebook, and if you accept this, Meta’s pixel tells us whether they worked — that someone who saw an ad later read the trip page or sent an enquiry — and lets us show the ads to people whose climbing it might genuinely suit. Meta receives that you visited, and which of those things you did. It does not receive your name, your email or anything else you typed. If you say no, no advertising script loads at all, and every page still works exactly the same.

You can change your mind whenever you like: the Cookies link at the bottom of any page reopens the choice, one purpose at a time. Switching either from yes to no clears the cookies that had been set and reloads the page clean.

Beyond those two, nothing on this site tracks you, and neither runs until you say so. There are no other advertising pixels, no social media trackers and no third-party embeds that watch you. Videos play in a YouTube player that loads only when you press play, in YouTube’s privacy-enhanced mode, so YouTube sees nothing until you choose to watch. The fonts are served from this site rather than from Google.

One exception, on one page. The map on Where we climb draws its map tiles from OpenFreeMap, so loading that page means your browser asks their servers for the tiles — which shows them your IP address, as any request does. They set no cookies and run no advertising. Apart from that map and any video you choose to play, every page is served entirely from here.

Your rights

You can ask for access, correction, erasure, objection, restriction or portability at any time — email hola@breadandbutterclimbing.com. To come off the mailing list, email us and we’ll take you off it.

If you think your data has been handled badly, you can complain to the Spanish Data Protection Agency, the AEPD.

Governing rules: Regulation (EU) 2016/679 and Spanish Organic Law 3/2018.

Last updated: 8 September 2026