Privacy policy

Data controller

The controller of your data is Play Jump Park S.L., tax ID B22670053, registered at Calle Los Alcázares, 13, 30562 Ceutí (Murcia). For any question about this policy or to exercise your rights, write to us at info@playjump.es.

What data we process and where it comes from

We process the data you give us when you create your account, book or sign; the data other people give us when they invite you to a party or sign for a minor; and the data generated when you use the website and enter the park. Each section tells you what the data is, what we use it for, on what legal basis and how long we keep it. Cookies have their own policy, in the footer.

Your account and how you sign in

To create your account we ask for your name and email address, and we keep your language. We also ask for your phone number when you book something that needs it, such as a birthday party, so that we can contact you about your booking. Your date of birth is optional: if you give it to us, we use it in aggregate figures, to better understand who visits the park and, only if you agree to receive news, to wish you a happy birthday on the day. We do not use passwords: you sign in with a one-time code that we send to your email and that expires after 10 minutes; for each code we keep only an encrypted fingerprint, the email address and the IP address it was requested from, and we delete it after 24 hours. If you tick «Keep me signed in», we remember that device for up to 90 days without use. The legal basis is the contract you ask us for (Art. 6.1.b GDPR); for your date of birth, your consent when you give it (Art. 6.1.a GDPR), which you withdraw by deleting it in «My account → Your details».

Signing in with your Google account

You can create your account or sign in with your Google account. If you choose that route, Google gives us your email address, your name and a unique, permanent identifier of your Google account, which we keep to recognise you on your next visits. We never know your Google password, and we only receive this data when you press that button and authorise it on Google’s screen. We use it to create your account and give you access, on the same basis as the rest of your account (Art. 6.1.b GDPR). You can unlink Google from «My account» and keep signing in with the code by email.

Your purchases and bookings

When you buy tickets or book a birthday party or a school trip, we process the order data: products, date and time slot, quantities, add-ons, amounts and payment status, and whatever you tell us in the booking form. Payment always takes place in Redsys’s secure environment: we never know or keep your card number, and from the bank’s response we keep only what is needed for support and reconciliation (card brand and country, authorisation codes, amounts and dates). The legal basis is the contract (Art. 6.1.b GDPR) and, for invoicing and bookkeeping, a legal obligation (Art. 6.1.c GDPR).

Birthday guests and health data

After booking a birthday party you can give us, in the booking form, the details it asks for each guest: their name and, if the pack asks for it, allergies or intolerances, special menu and remarks. Allergies and intolerances are health data, a special category: we use them only to prepare the party and for food safety, with the explicit consent of whoever provides them as the person responsible for the child (Art. 9.2.a GDPR) and, where necessary, to protect a vital interest of the child (Art. 9.2.c GDPR). By entering them you confirm that you have the permission of their parents or guardians. We delete this data 14 days after the party; only the quantities and amounts remain in the order.

Minors in your care

In «My account» you can add the minors in your care (first name, surnames, date of birth and relationship) to sign the liability waiver on their behalf and so that we know which bookings are theirs (for example, whose birthday it is). Only their parent or guardian can do this. If you agree to receive news, we also use their name and date of birth for the birthday messages described in «Marketing communications». If you remove a minor, we delete their data, unless they have a signed waiver, which is kept as explained in «The liability waiver». The legal basis is the contract (Art. 6.1.b GDPR).

The digital invitation

If your pack includes it, you can create a digital invitation and share its link with the guests’ families. The invitation shows the name and age of the birthday child, who is inviting, the words and gift hints you choose to write and, if you decide so, your phone number. Each family replies on it whether they are coming, with their child’s name and, if the pack asks for it, their allergies: each family provides that data and we use it only to prepare the party. 14 days after the party we delete the replies and empty the invitation of everything personal (who is inviting, the age, your words and the hints), and its link stops working; sooner, if you delete your account. Anyone with the link can open the invitation: share it only with the people you invite and, if it spreads, ask us to change it; the old one stops working at once.

The liability waiver

To use the attractions, every participant needs a signed liability waiver. You sign it on the website, for yourself and for the minors in your care; the signature is completed when you confirm your email, when you pay for a booking or, at the park, in front of our staff. To be able to prove who signed, which text and when, we keep a record of each signature: the name, email and phone number of the signer and, if they sign for a minor, their relationship and the minor’s name and date of birth; the version of the text accepted; the date and time; and the IP address and browser. Each record is chained to the previous one with fingerprints, so that any alteration is detected. The legal basis is our legitimate interest in being able to prove that acceptance in the event of a claim (Art. 6.1.f GDPR). The record is kept even if you delete your account, set apart and accessible only to authorised staff, for five years from signature, the limitation period for liability claims; a minor’s, for five years from their 18th birthday.

«We will save it for you»

While booking, if you choose a day and a time and would rather leave it for later, you can ask us to save it for you: you give us your email and we send you your plan (what, which day, what time and how many) with a link to book it and, at most, one reminder. You do not need an account, and the time is not held. We keep your email, your language, your plan, when you asked us and the IP address you did it from, as proof that you asked. The legal basis is your consent (Art. 6.1.a GDPR); every email has a link so that we stop writing to you, and after 14 days we delete the plan with all that data.

Your card and entry to the park

Your account has a card with a QR code that identifies you at the entrance. When it is scanned, our staff see your name, your bookings for today and the coming days, whether the waivers are signed and, for minors, their name, age and waiver status, never their surnames; and they record your visit. If you lose your card, you can renew it from «My account» and the old one stops working. The legal basis is the contract (Art. 6.1.b GDPR).

Surveys

We may ask how your visit went with a short survey: at the entrance, on our staff’s screen when your visit is registered, or by email the next day. It is anonymous: after 90 days your answer is completely separated from you, and nobody can tell what you replied; the answers, with nobody behind them, are kept for 24 months. If there is no survey, the next-day email only invites you, if you wish, to leave your review on Google. The legal basis is our legitimate interest in improving the service (Art. 6.1.f GDPR). If you do not want to receive these emails, turn them off in «My account → Privacy» or from the unsubscribe link in each one.

The emails we send you

We keep a record of the emails we send you (address, date, subject and a copy) to be able to prove they were sent and to help you if something does not arrive: the copy is deleted after 6 months and the record after 24. In your booking emails we count which links you click, to know what information is useful to you; the legal basis is our legitimate interest (Art. 6.1.f GDPR) and you can object in «My account → Privacy». If you accepted analytics cookies, a tiny image tells us when you open the email; without that acceptance, the email is sent without it (Art. 6.1.a GDPR). Neither clicks nor opens store your IP address or browser, and the survey carries neither mark.

Marketing communications and how to unsubscribe

We only send you news and offers if you expressly say yes: we ask you when you finish a booking, in «My account» and when you add a minor, always with the option to say no and never with a box ticked in advance (Art. 6.1.a GDPR and Art. 21 of the Spanish LSSI). We keep when and where you told us, as proof of your permission. You can withdraw it in «My account → Privacy» with one click, from the unsubscribe link in every marketing email, or by writing to us at info@playjump.es. We send you two marketing emails a month at most. With that permission we tell you about the park’s offers and occasions (holidays, celebrations…), and we choose whom to write to for each one based on what we know from your bookings, for example whether you usually come with children. We also write to you if you have not visited for a while. A few weeks before the birthday of a minor in your care, we let you know in case you want to celebrate it here. And, when the anniversary of the party of a minor in your care is approaching, we remind you of it with the pack for their new age. With that same permission we wish you a happy birthday, you and the minors in your care. We do not sell or share your data for other people’s advertising.

Website measurement, analytics and advertising

To know how many people visit the website and how they book, we use our own aggregate measurement: a cookie with a random identifier, which lasts 13 months, and data that is deleted after 25 months, without combining it with other data or sharing it; we also use it to test different versions of some pages. Only if you allow it in the cookie notice («analytics» category), we link your browsing to your account to understand how you use the website and improve it, with PostHog, which can also record how you browse (which pages you visit, where you tap and how you move through them) to see where people get stuck; in those recordings what you type and any text with personal data are masked; you can withdraw it whenever you like in «My account → Privacy» or in the cookie settings, and we unlink what was recorded. Only if you accept advertising («marketing» category), Google Ads, Meta and TikTok measure whether an ad ended in a booking: their pixels load on the website and receive the order code when you pay. We also send it to Meta and TikTok from our server, with your email and phone number turned into a fingerprint (SHA-256): it is still your data, but with it they cannot read your email or your phone number, only match them with accounts that platform already has. For that transmission, we and each platform are joint controllers; what each one does with it afterwards is explained in its own privacy policy. The details of each cookie are in the Cookie policy.

The Google reviews we show

On the website we show reviews of the park published on Google, with their author’s name and photo as they appear there, their stars, text and photos, and the park’s reply. We copy them from our Google listing and keep them while we show them. The legal basis is our legitimate interest in showing what people who have visited think (Art. 6.1.f GDPR). If you wrote one and do not want it to appear here, write to us at info@playjump.es and we will remove it.

Contact

If you write to us or call us, we use your data to reply (Art. 6.1.f GDPR, or the contract if it is about your booking). If you write to us on WhatsApp, that service is provided by Meta, which processes your messages under its own terms.

Recipients and data processors

We do not sell your data. They are processed on our behalf, as data processors and only to provide their service to us, by: Redsys and the bank, which process the payment; our hosting provider, which keeps the website and the database on servers in the European Union; and the booking platform provider, for maintenance and support. Emails are sent from our own servers. Cloudflare protects the forms against bots. Bunny Fonts (BunnyWay d.o.o., Slovenia, EU) serves the fonts of some pages: it receives your browser’s IP address and uses no cookies. With your consent, Google shows you the map of how to get here. With your consent, PostHog helps us with website analytics. With your consent, Google Ads, Meta and TikTok measure advertising. And the authorities, when a law requires us to.

International transfers

Some of these providers are based in the United States (Google LLC, Cloudflare, Inc. and Meta Platforms, Inc.) and are certified under the EU-US Data Privacy Framework, which the European Commission recognises as an adequate safeguard. TikTok also processes data outside the European Economic Area, under the European Commission’s standard contractual clauses. PostHog keeps the analytics data on servers in the European Union. Hosting is in the European Union, so it involves no transfer.

How long we keep your data

Your account, as long as you keep it (when you delete it, we anonymise it). Orders and invoices, six years from their date (Art. 30 of the Spanish Commercial Code), blocked and available only to the authorities. Birthday guests, 14 days after the party. The digital invitation and its replies, 14 days after the party (of the invitation, only the fact that it existed remains, with nothing personal). Signed waivers, five years from signature (a minor’s, five years from their 18th birthday).Sign-in codes, 24 hours; the session, 2 hours without use, or 90 days if you asked to stay signed in. The email record, 24 months (the copy, 6). Surveys, 90 days linked to you and 24 months with nobody behind them. Website measurement, 25 months. Your cookie choices, 24 months. Google reviews, while we show them. Security records, 24 months.

Your rights

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting what was done before. Many of them you exercise yourself from «My account»: download a copy of your data in a machine-readable file (access and portability); correct your name, phone number, date of birth, language or email; in «Privacy», object to analytics and surveys and withdraw your permission for marketing communications; and delete your account. When you delete it we do not delete your orders, because invoices must be kept: we anonymise your account (we remove your name, email, phone number and date of birth, withdraw your consents, close your sessions and your card, and unlink Google and your browsing) and we delete your guests’ data, your invitations, the copies of your emails and the minors in your care who do not have a signed waiver. If you have a paid booking still to come, it must first be cancelled or take place. Whatever the law requires us to keep, or whatever proves a signed waiver, is set apart with restricted access. For any other right, or if you prefer to ask in writing, write to us at info@playjump.es; we may ask you to prove your identity.

Automated decisions and profiling

We do not make automated decisions that produce legal effects on you or significantly affect you. Beyond what is described in «Website measurement, analytics and advertising», which only happens with your permission, we do not profile you with your data.

Security measures

We apply technical and organisational measures to protect your data. There are no passwords to steal: you sign in with a one-time code that expires after 10 minutes and allows 5 attempts, and we limit how many codes are requested and how many attempts are made per email address and per IP address. If you change your email, we do not replace the current one until you confirm the new one with a code, and we notify the old one. From «My account» you can close your sessions on other devices. We protect public forms against bots, apply security headers and a content security policy (CSP), log staff actions on your data and, in our internal records, do not keep personal data in plain text, but encrypted or reduced to the minimum.

Complaint to the supervisory authority

If you consider that the processing of your data does not comply with the rules, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, or at its electronic office, www.aepd.es. We would appreciate it if you wrote to us first at info@playjump.es to try to resolve it.