Privacy policy

This policy explains how personal data collected through the website monsexperiences.com is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

1. Data controller

Controller: Mónica de Diego García (MONS Experiences)

Spanish tax ID (NIF): 71175050D

Address: Calle Toreros 14, 4.º izquierda, 47007 Valladolid, Spain

Telephone: +34 625 956 641

Email: [email protected]

2. Data we process

Data you provide in the contact form: name, telephone, job title, email address, company or organisation, type of project, objective, project sponsor, number of participants, estimated date, destination, investment range and a description of the outcome you are looking for.

Data arising from subsequent communication: the content of emails, calls or meetings held as a result of your enquiry.

Technical browsing data: IP address, device and browser type, and usage data necessary to deliver and protect the service.

No special categories of data are requested or processed. Please do not include such data in your messages.

3. Purposes and legal basis

Handling your enquiry and preparing a proposal: steps taken at your request prior to entering into a contract (Art. 6.1.b GDPR).

Managing the contractual relationship if the project goes ahead: performance of a contract (Art. 6.1.b GDPR).

Replying to enquiries that do not lead to a contract: your consent, given when submitting the form (Art. 6.1.a GDPR).

Complying with legal obligations of a tax and accounting nature: Art. 6.1.c GDPR.

Keeping the website secure and preventing automated form submissions: the controller's legitimate interest (Art. 6.1.f GDPR).

No automated decision-making or profiling producing legal effects on you is carried out.

4. Retention periods

Data from enquiries that do not lead to a contract is kept for a maximum of two years from the last contact, unless you request its deletion sooner.

Client data is kept for the duration of the relationship and thereafter for the limitation periods applicable to legal, accounting and tax liabilities.

Once those periods have elapsed, the data is deleted or anonymised.

5. Recipients of the data

Data is not disclosed to third parties except where required by law.

The following act as data processors and access the data solely to provide their services: the CRM and web hosting platform HighLevel Inc., the provider of security and anti-automation protection for the contact form, the email service provider and, where applicable, the tax and accounting advisor.

To deliver a contracted project, it may be necessary to share identifying data with suppliers at the destination — hotels, transport operators, venues or insurers — always limited to what is strictly necessary and with prior notice to the data subject.

6. International transfers

Some of the technology providers listed above are established in the United States, which may involve an international transfer of data.

Such transfers are carried out under the safeguards set out in Chapter V of the GDPR: standard contractual clauses approved by the European Commission, or the provider's adherence to the EU-US Data Privacy Framework, as applicable to each provider.

You may request information about the safeguards in place by writing to [email protected].

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time without affecting the lawfulness of processing carried out beforehand.

To do so, write to [email protected] or to the postal address above, identifying yourself and stating the right you wish to exercise.

Requests are answered within one month of receipt.

If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

8. Data security

Appropriate technical and organisational measures are applied to protect data against destruction, loss, alteration or unauthorised access, in accordance with Art. 32 GDPR.

The website is served over an encrypted connection (HTTPS).

No measure guarantees absolute security. In the event of a breach posing a risk to data subjects' rights, notification will be given in accordance with Arts. 33 and 34 GDPR.

9. Minors

These services are aimed at companies and professionals. Data relating to children under 14 is not knowingly collected.

If you become aware that a minor's data has been submitted, please write to [email protected] so that it can be deleted.

10. Changes to this policy

This policy may be updated to reflect regulatory changes or changes to the website.

The version in force is always the one published on this page, together with its last updated date.

Last updated: 21 September 2026.