Privacy policy

Who is responsible for your data

• Zone World, S.L. (Granati Project)
• Tax ID (CIF): B76293109
• Address: C/ Presidente Alvear 34, 35007 Las Palmas de Gran Canaria
• Email: info@granatiproject.com
• Phone: 828 070 734

We have not appointed a data protection officer, because we are not required to. For any question about your data, write to info@granatiproject.com.

When you visit our website

granatitrainingclubs.com uses no cookies, analytics or advertising, and loads no third-party content: fonts and images are served from our own server.

Like any web server, ours logs each visit: the IP address, the page requested, the date and time, and browser details. We use this only to keep the website secure and fix errors, which is our legitimate interest (Article 6(1)(f) GDPR). These logs are deleted after 14 days.

The links to WhatsApp, Instagram, Google Maps and our store take you to those services. What you do there is covered by their own privacy policies.

When you buy in our online store

Our store, granatiproject.com, runs on Shopify. When you pay for an order, the store sends its details to our management system so we can handle it. From it we get:

• Your name, email address and phone number.
• Your customer number in the store.
• The order number, date and amount, the taxes and the products bought.

We do not keep your address or payment details. The full notice the store sends us, which does include the addresses, is kept encrypted for 30 days so we can fix errors, or 90 days if it could not be processed.

If you buy a membership or a class pass, we look up your email address in WodBuster, the software we use for bookings and memberships, to register you or renew your membership there. For this we send WodBuster your email address, your store customer number, the plan and the dates paid for. WodBuster may send you an invitation to set up your login.

Legal basis: performing the purchase contract and your membership (Article 6(1)(b) GDPR).

How long: we keep your name, email address, phone number and customer number for 3 years after your most recent order, then delete them automatically. Each order's number, date, amount and products are kept without your name or contact details, for our accounts.

When you message us on WhatsApp or Instagram

When you write to our WhatsApp or Instagram accounts, we keep the conversation in our management system so we can answer you and know what you asked before. We keep:

• On WhatsApp, your phone number, or your user ID if you hide it, and your profile name. On Instagram, the ID Instagram gives us for your account.
• The text of your messages and of our replies, reactions, which message you reply to, and the date and time.
• The type of file you send, such as a photo or a voice message. We do not download the files: they stay on WhatsApp or Instagram.

Legal basis: our legitimate interest in answering and organising the questions you send us (Article 6(1)(f) GDPR) and, if you ask about becoming a member, taking steps at your request before a contract (Article 6(1)(b)).

We do not ask for health information. If you tell us something like that, such as an injury, we use it only to answer you, and it is deleted with the conversation. If you would rather we did not keep it, do not send it through these channels, or ask us to delete it.

Only our admin team can read the conversations, and every time someone opens one, it is logged. We do not use artificial intelligence or automatic replies on your messages.

How long: we delete each conversation 6 months after its last message. If you unsend a message, we delete its text as soon as WhatsApp or Instagram tells us. The technical notice in which Meta delivers the messages is deleted after 30 days, or 90 days if it could not be processed.

WhatsApp and Instagram are services of Meta Platforms Ireland Limited. Meta delivers your messages to us and also handles your data under its own privacy policy.

When you have an account in our management system

If we create an account for you, we keep your first and last names, your email address, your phone number if you give it to us, and your preferred language. For logging in we also keep your password, protected so that nobody can read it, and your two-step verification settings.

Legal basis: your relationship with us as a member or as part of the team (Article 6(1)(b) GDPR).

How long: we delete the account at most one month after you stop being a member or part of the team.

Who else handles your data

• IONOS SE (Germany) hosts our server, as a processor.
• WodBuster runs our bookings and memberships, as a processor.
• Shopify runs our online store and sends us the orders.
• Meta Platforms Ireland Limited delivers the WhatsApp and Instagram messages to us.
• Public authorities and courts, when the law requires it.

We do not sell your data or pass it to anyone else.

Transfers outside the European Union

Our server is in the European Union. Shopify and Meta may process data in the United States and other countries, with the safeguards the GDPR requires: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep your data

• Server logs: 14 days.
• Order details: 3 years after your most recent order.
• WhatsApp and Instagram conversations: 6 months after their last message.
• Technical notices from the store and from Meta: 30 days, or 90 if they could not be processed.
• Accounts: up to one month after you stop being a member or part of the team.
• Record of who viewed your data: 24 months. It holds none of your data, only which order or conversation was opened, by whom and when.

After each period, the data is deleted automatically, except accounts, which our team deletes.

Your rights

You can ask us at any time to:

• Access your data and get a copy.
• Correct it if it is wrong.
• Delete it.
• Object to our handling it, or ask us to restrict its use.
• Receive it in a format you can take to another service (portability).

Write to info@granatiproject.com or by post to C/ Presidente Alvear 34, 35007 Las Palmas de Gran Canaria. Tell us how to find you: for an order, the email address you bought with; for a conversation, the phone number or Instagram account you wrote from. We answer within one month.

If you ask us to delete your data, we also delete your WhatsApp and Instagram conversations and pass the request on to the store and to WodBuster. Messages that stay on your phone, on WhatsApp or on Instagram are managed by those services.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.

Minors

Our website and channels are not aimed at people under 18. If you are under 18, do not send us personal data. If you already have, write to us and we will delete it.

How we protect your data

We keep the contact details of orders and conversations encrypted. Only the team members who need them can see them, they log in with two-step verification, and who views them is logged. All connections use HTTPS.

Cookies

granatitrainingclubs.com sets no cookies or similar technologies.

gpai.granatitrainingclubs.com, our internal system, only uses the technical cookies the team needs to log in: a session cookie, a security cookie against forged requests, one that remembers the login if chosen, and others that keep display preferences, such as dark mode. These cookies need no consent (Article 22(2) LSSI).

Changes to this policy

If we change how we handle your data, we will update this page and the date at the top.