Privacy policy
Data controller and contact
The controller of Rececho’s data processing is Rubén Teruel Córcoles, a self-employed professional identified in the Legal notice. For privacy matters, contact administracion@rececho.es or write to the address stated there. This policy covers Rececho.es and app functions as they are put into service.
Outfitters are controllers of the processing they carry out to provide their activities. Their details and privacy information must be available before contracting. Technology providers may act as processors, independent controllers or both depending on the service; their role is determined by the actual processing and the relevant contract.
Data and its sources
We collect the data you provide when registering, booking, requesting support, publishing content, purchasing a service or choosing preferences. We may receive data from the outfitter about your booking status and completion of the activity, from the payment provider about charges and refunds, and from Google when you authorise sign-in or Calendar connection.
We process identification and contact details, account, booking and billing data, communications, published images and text, notification preferences, ratings, incidents and evidence of consent. We also process necessary technical data such as IP addresses, session identifiers, device information, notification tokens and security logs. We do not request complete card details through our forms.
Required fields are identified by their purpose. If necessary data is missing, we may be unable to process your request; optional fields and advertising do not condition ordinary contracting. Avoid including health data, complete documents or other people’s data in public areas. If you manage a booking for others, provide them with this information and supply only necessary data.
Purposes and legal bases
| Processing | Purpose and basis |
|---|---|
| Account and access | Creating and maintaining access, verifying email and enabling service management. Performance of a contract and steps prior to entering into a contract. |
| Bookings and support | Processing requests, acceptance, payments, changes, chat and complaints. Performance of a contract, legal obligations and, where appropriate, the defence of claims. |
| Billing and tax duties | Issuing and retaining documents and responding to official requests. Legal obligation. Includes platform operator reporting where required. |
| Outfitters and content | Verifying professional registration, hosting offers and websites, and providing contracted services. Contract and legal obligations. |
| Security and abuse | Protecting accounts, payments and votes, recording incidents and moderating content. Assessed legitimate interests and legal obligations, as applicable. |
| Reviews and trophies | Publishing content requested by the participant and managing ratings. Participation relationship; specific image permission where necessary. |
| Email or push advertising | Sending offers through the chosen channel. Specific, separate and revocable consent. |
| Operational notices | Communicating payments, bookings, security and unread messages. Contract or proportionate legitimate interest; these do not constitute permission for advertising. |
| Recommendations | Sorting offers using filters and interests derived from favourites and bookings within the service. Legitimate interest subject to assessment and the right to object; advertising and optional tracking require their own basis. |
| Optional integrations | Requested Google sign-in, Calendar and external players. Performance of the chosen function and, where applicable, consent for optional access or storage. |
Legitimate interests are limited to the secure operation of the platform, preventing abuse, managing disputes and presenting relevant offers. You may request information about the balancing assessment and object on grounds relating to your situation. An objection to advertising is honoured without requiring a reason. For complaints, the necessity, basis and scope of processing evidence provided are documented; submitting it does not authorise other uses.
Public and private data
Professional profiles, offers, outfitter websites and content you identify for publication are public: questions, answers, reviews, trophies and aliases. Search engines may index them. Private telephone numbers, hunters’ tax details, documents and booking conversations will not be published. Public content may be retained by third parties outside Rececho’s direct control; removal requests will be handled in accordance with your rights.
Booking data is shared with the relevant outfitter to the extent necessary to respond and provide the activity. Chats are private between their participants and are not available to read through the administrative panel. In a complaint, a hunter or outfitter may email relevant copies or screenshots of their conversation. Administration processes this evidence, with access restricted to staff handling the case, to manage the contract, defend claims or meet legal obligations, as applicable. Affected people are informed where appropriate. The technical operation and hosting of chat remain data processing covered by this policy; no claim is made of end-to-end encryption or an absolute technical impossibility of access.
Providers and recipients
Contracted hosting and backup, email, payment, technical support and notification providers may access data subject to the appropriate safeguards. Advisers and authorities may also access it where there is an obligation or legitimate need. We do not sell personal data or give outfitters a marketing list of Rececho users.
| Service | Data or involvement |
|---|---|
| Webempresa | Website and database hosting and support according to the contracted service. |
| Brevo (Sendinblue) | Sending transactional communications and, if authorised, marketing communications; recipient addresses, content and delivery records. |
| Stripe | Payment management, fraud prevention, transaction references and data requested in its form. |
| Google sign-in, optional Calendar and YouTube videos when used. Each function has a different scope. | |
| Expo Push, Google FCM and Apple APNs | Device tokens and the minimum notification content when notifications are enabled. Marketing preferences are managed separately. |
| Booking outfitter | Data necessary for requests, service provision, contact, invoicing and handling incidents relating to its activity. |
Using third-party services may involve processing outside the European Economic Area. Where an international transfer occurs, an adequacy decision applicable to the recipient and transferred data or the required safeguards, such as standard contractual clauses and supplementary measures, will be used. You may request information and a copy of the relevant safeguards, protecting confidential information and other people’s data. A provider’s generic statement of GDPR compliance is not considered sufficient.
Google and app permissions
Google sign-in receives the basic identity information specified in the authorisation; it does not provide access to Gmail, Drive or your calendars. Calendar connection is separate and optional for each outfitter: it authorises creation and management of the Rececho bookings calendar through the integration’s specific scope. General access to all personal calendars is not required.
Disconnecting Calendar stops synchronisation and invalidates or deletes local credentials according to the disconnection procedure. Events already created may remain in the Google account. Only the reference, dates and necessary details of the hunting day will be copied, excluding tax documents and chat content. Data obtained from Google is used for the authorised function, not sold or used to create unrelated advertising.
The app may request notification permission and, when you use a specific function, access to photographs or the camera. Installing it does not imply marketing consent. Operating-system notification permission and the choice to receive promotional campaigns are managed separately. Continuous precise location tracking will not be activated to show offers.
Profiling and automated decisions
The presentation of offers may take account of selected filters, favourites, previous bookings, outfitter activity and identified promotions. These criteria do not silently change individual prices. If automated price personalisation is introduced, it and its parameters will be explained before contracting.
There are automatic checks for availability, discount eligibility, duplicate votes and seal thresholds. If an automated measure affects you significantly, you may request an explanation, provide information and ask for human review. Permanent expulsion will not be based solely on an automatic indicator without the required safeguards and legal basis.
Approximate IP-based geolocation and new analytics or AI tools will only be activated once their purpose, basis, recipients and safeguards are defined. Chats, invoices and identity documents will not be sent to AI by default to generate content or translations.
Retention
| Data | Retention criterion |
|---|---|
| Account and profile | For the duration of the relationship; after closure, unnecessary data is deleted and data required for liability purposes is restricted. |
| Bookings and financial documents | During performance and the applicable tax, commercial and claims periods; generally 4 years for tax matters and 6 years for commercial documentation where applicable, subject to interruptions and special rules. |
| Enquiries without contracting | Until resolved and, as an operational guideline, for no more than 12 months afterwards, unless there is a claim or documented need. |
| Chat and incidents | Chat: throughout the booking and the period needed for obligations and liabilities. Evidence emailed: for the duration of the case and its legally required retention. It is not used for advertising. |
| Consents and opt-outs | While valid; afterwards, minimal evidence and a suppression list to respect withdrawal and address liabilities. |
| One-time discount use | A minimal record or pseudonymised identifier to prevent repeated use while the promotion exists, with periodic review of necessity. This does not justify retaining the entire profile indefinitely. |
| Technical logs | The minimum period necessary for security. The ordinary target is up to 90 days, unless an incident or justified requirement applies. |
| Publications and promotions | While the requested publication and the edition’s rules remain in effect; afterwards, data is deleted, anonymised or archived on a limited basis where a legitimate purpose exists. |
Periods are calculated from the event specified by law or the end of the relevant purpose; legally restricted retention is not the same as everyday use. Information is deleted or anonymised when applicable periods end. Backups follow a defined rotation and are not reused to reactivate deleted data.
Your rights
You may request access, rectification, erasure, objection, restriction and portability where applicable, withdraw consent and request the safeguards applicable to automated decisions. Write to administracion@rececho.es with your request and information allowing us to locate your account. Additional identity information will only be requested where there are reasonable doubts; a complete copy of your identity document is not required by default.
A response will normally be provided within one month. If complexity or the number of requests requires an extension of up to a further two months, you will be informed within the first month, with the reason. You may complain to the Spanish Data Protection Agency at www.aepd.es . Opting out of advertising does not delete your account or affect existing bookings.
If the controller changes when a company is incorporated, its identity, legal basis and effects will be communicated at the appropriate time beforehand. Marketing consent is not assumed to cover any future company or purpose.