Privacy policy

Data controller

Belabarce SL, with tax ID (NIF) B46694873 and registered office at Av. Mediterráneo 44 - Puerto de Sagunto (Valencia), registered in the Registro Mercantil de Valencia, tomo 2769, libro 85, folio 193, sección 8.ª, hoja V-1300. Email: info@grupo-cocoa.com. Telephone: +34 675 09 49 39. For any privacy matter: info@grupo-cocoa.com.

What data we process

When you buy tickets or book a table: name, email address, phone number (so that we can contact you about your purchase or booking if needed, and as the reference for your customer record), your date of birth (to check that you meet the event’s minimum age) and, if you write one, a comment for the venue. When you book a VIP table, also the DNI, NIE or passport of the person booking, who must be an adult: it is checked at the door. If the event requires it, also the name, ID document and date of birth of each attendee.

Payment is handled by Stripe: we neither see nor store your card number. If a table requires a guarantee card, Stripe stores it so that the penalty can be charged if you do not turn up, under the conditions you accept when booking.

If you request a full invoice: name or company name, tax ID (NIF) and address, as required by invoicing regulations.

If you sign up for "Let me know when tickets go on sale": your name, email address and phone number, to let you know by email or SMS when tickets go on sale (it is an alert you request). If you also tick the promotions box and confirm it from the email, also to send you news (consent).

If you join the waiting list for something that has sold out: your email and, if you give them, your phone number and how many of you there are. Only to let you know if a spot opens up: it’s an alert you ask for and it contains no marketing.

To prevent abuse (bots, attempts to guess codes) we keep the IP address and the email or phone number of the attempts for a few days. During the purchase we also use a code derived from your connection, which does not reveal your IP address, to limit unpaid bookings from the same connection.

If you were already a Cocoa Beach Club customer on Fourvenues (the ticketing platform we used before), your customer record (name, email, phone, history of visits and purchases and, if you were subscribed, your consent to promotions) was brought over from there when we changed platforms.

Purposes and legal basis

Managing your purchase or booking, sending you your tickets or booking and letting you in: necessary for the performance of the contract.

Checking the minimum age for the event: a legal obligation and an obligation under the contract itself.

Keeping a customer record with your previous purchases and bookings, to serve you better and understand what works: legitimate interest. You can object by writing to us.

In your record the system adds tags based on your history (for example, whether you book tables again, whether you have spent more than a certain amount, whether you missed a booking or often cancel) and the team may note incidents (for example, not turning up for a booking or problems at the venue). With this, the team may offer you preferential treatment (for example, a discount), or ask you to pay in advance or to book by calling the venue, based on our legitimate interest in avoiding unused bookings and in the safety of the venue. Automatic tags (for example, “Missed a booking”) only inform the team: preferential treatment, the requirement to pay in advance or to book by calling the venue is assigned by a member of the team in your record, and the website applies it when you book. This is profiling; you can ask us to see what has been noted, correct it or object by writing to info@grupo-cocoa.com.

If you arrive through a link from one of the Cocoa Beach Club promoters, we note in your purchase or booking who shared it with you, to calculate their commission: legitimate interest. For the table bookings attributed to them, they see your first name, how many of you there are, the area, the table, the arrival time, the amount and what is still to pay, and whether you have already entered; never your email address or phone number. For tickets they only see how many and the amount.

Sending you news and promotions about our events by text, WhatsApp or email. If you have bought a ticket or booked a table from us: legitimate interest (art. 21.2 of the Spanish LSSI), unless you tick “I don’t want to receive promotions” when doing so. If you sign up for an alert without buying: only if you agree (consent). Only about our own events and services, never other companies. You can object or unsubscribe at any time using the link in each message or by writing to us.

We do not send promotions to anyone under 18.

Asking for your opinion just once, after an event you attended (an email with the link to leave it on Google): on the same basis, and with the same ways to object, as news and offers.

Issuing invoices (the simplified invoice for each payment and the full one, if you request it) and keeping them: legal obligation.

Complying with accounting and tax obligations and preventing fraud: legal obligation and legitimate interest.

The data marked as required are needed to manage your purchase or booking; without them we cannot complete it.

Who else processes it

We do not sell or disclose your data. It is processed on our behalf, under contract and solely to provide us with their services, by: Stripe (payments; there may be transfers outside the EU with the safeguards of the EU-U.S. Data Privacy Framework and standard contractual clauses), Scaleway (sending emails, France), OVH (website hosting, France) and, if we send promotions by SMS or WhatsApp, the provider of that service.

To prevent fraud, comply with its own legal obligations and, if you use it, for Link, Stripe also processes some payment data as a controller, under its own privacy policy (https://stripe.com/privacy).

We send text-message promotions through Acumbamail (Spain).

If you write to us on WhatsApp, or if the team sends you your booking or your payment link on WhatsApp, that message goes through WhatsApp (Meta), under its own terms and privacy policy.

Our tax and accounting advisers, for invoices, and, where required by law, the Spanish Tax Agency, the courts or the police.

If you buy for other people and give us their details, we ask you to inform them of this policy.

How long we keep it

Purchases and bookings: for as long as accounting and tax obligations require (up to 6 years).

Invoices and billing data: the periods set by commercial and tax law (generally 6 years).

The buyer’s date of birth, the ID document and date of birth of the person booking the table and of attendees, and attendees’ names: deleted 30 days after the event.

"Let me know when tickets go on sale" lists: deleted 30 days after the event.

Waiting lists for sold-out items: deleted the day after the event.

Promotions: until you unsubscribe. We keep proof of your consent and of your unsubscription for as long as we may be asked to provide it.

Customer record: for as long as you remain a customer; you can ask us to delete it at any time.

Backups: kept for 30 days on the server itself and, off the server, encrypted and on OVH servers in France, daily backups for 35 days and monthly backups for about 13 months (400 days). Anything we delete disappears from the backups within those periods.

Security logs: a few days.

Your rights

You can request access to your data, its rectification or erasure, object to or restrict its use, and take it with you (portability), by writing to info@grupo-cocoa.com and stating your email address or phone number. If you are not satisfied with our reply, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

To buy tickets you must be at least the event’s minimum age, shown on its page, or the ticket’s, if it requires a higher one; to book a VIP table, 18. Age is checked at the door with an ID document.