Privacy policy
Who is responsible for your data
The controller is LIGHTS OUT, S.L., Av. Ernesto Sarti 10, 38660 Adeje, Santa Cruz de Tenerife, Spain, NIF B88998778 (provisional). You can reach us at hello@lightsout.gp.
What we collect
Only what you type into the enquiry form. Nothing on this site collects data in the background.
- Required: your name, your email address, the race you are interested in, and how many people are travelling.
- Optional: your telephone number and its country code, where you are travelling from, your budget level, your accommodation preference, the kind of tickets you want, and anything you write in the free-text message.
- Your choices: whether you agreed to receive a proposal, and whether you separately opted in to marketing.
Please do not include health information, or any other special category of personal data, in the free-text message. We do not ask for it and do not need it to prepare a proposal.
Why we use it, and on what legal basis
- To answer your enquiry and prepare a proposal. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
- To send you marketing, if you ticked that box. Legal basis: your consent (Article 6(1)(a) GDPR). The marketing tick box is separate from the enquiry, is never pre-ticked, and you can withdraw your consent at any time — that does not affect the lawfulness of what we did before you withdrew it.
- To keep the form from being abused. We use an anti-spam check and limit how many enquiries can come from one internet connection in an hour. Legal basis: our legitimate interest in keeping the site working (Article 6(1)(f) GDPR).
Providing the required fields is necessary for us to reply. There is no automated decision-making and no profiling.
Who else sees it
We use a small number of service providers, each acting on our instructions under a data processing agreement:
- Cloudflare — hosts this website and provides the anti-spam check on the form.
- Resend — delivers the enquiry to us by email and sends you the acknowledgement.
- Our email provider — holds the enquiry in our inbox once it arrives.
Where a provider processes data outside the European Economic Area, that transfer is covered by the European Commission's Standard Contractual Clauses. We do not sell your data and we do not share it for anyone else's marketing.
If you go on to book with us, we will need to pass the relevant details to the suppliers who deliver your trip — the ticket provider, the hotel, the transfer operator. We will tell you who they are before you book, and that sharing is covered by our booking terms.
How long we keep it
- Enquiries that do not lead to a booking: up to [TO BE CONFIRMED BY THE CLIENT — commonly 12 or 24 months], then deleted.
- Enquiries that lead to a booking: for the duration of the booking and afterwards for as long as Spanish commercial and tax law requires records to be kept.
- Marketing consent: until you withdraw it, plus a record of the withdrawal so we can honour it.
- Anti-abuse counter: we store a one-way cryptographic hash of your IP address — never the address itself — which expires automatically within an hour.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or provide it in a portable format. You can object to processing based on our legitimate interests, and you can withdraw marketing consent at any time — every marketing email has an unsubscribe link. Write to hello@lightsout.gp; we reply within one month.
If you are not satisfied, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority where you live.
Security
The site is served over an encrypted connection and enquiries are transmitted encrypted. We keep no database of enquiries on this website: the form sends an email and stores nothing else.
Cookies
This site sets no cookies. See our cookie policy.
Changes
If we change this policy we will update this page. Where the change is significant we will say so here.