Privacy policy

Last updated: 29 September 2026

This Privacy Policy describes how Nuestra Cosa Creativa, S.L., responsible for the Vendetta Race project, processes the personal data of users of the website vendettarace.com, its subdomains and the various contact channels and services associated with the project.

Personal data will be processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (“LOPDGDD”), Spanish Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI-CE”), and any other applicable legislation.

1. DATA CONTROLLER

Controller: Nuestra Cosa Creativa, S.L.
Trading name / project: Vendetta Race
Tax identification number: B27672088
Address: Calle de los Herreros, 28, Oficinas 2.ª Planta, 36002 Pontevedra, Spain
Email: info@nuestracosacreativa.com
Website: https://vendettarace.com

Nuestra Cosa Creativa, S.L. will act as controller for personal data whose processing purposes and means it determines directly.

Where certain services are provided by third parties acting as independent controllers, users will be informed at the appropriate time and will also be subject to those third parties’ privacy policies.

2. SCOPE

This Privacy Policy applies to personal data processed as a result of:

Browsing and using the Website.
Queries and communications sent to Vendetta Race.
Forms that may be enabled on the Website.
Relationships with customers, providers, collaborators, sponsors and professionals.
The purchase or management of tickets, products or services where NCC is involved in that processing.
Signing up for informational or commercial communications.
Participation in promotions, competitions, prize draws or activities where enabled.
Interaction with Vendetta Race through social networks and other digital channels.
Attendance or participation in activities or events associated with Vendetta Race, where applicable.
Technical, statistical and security needs associated with the operation of the Website.

3. PERSONAL DATA WE MAY PROCESS

Depending on your relationship with Vendetta Race and the services you use, we may process the following categories of data:

3.1. Identification data

First name, surnames and, where necessary, identity document, date of birth or other data needed to correctly identify the data subject.

3.2. Contact data

Email address, telephone number, postal address and other contact details provided voluntarily.

3.3. Professional data

The company or entity you work for, position, professional role, area of responsibility and professional contact details.

This data may be particularly relevant in relationships with sponsors, providers, collaborators, agencies, media and other companies associated with the project.

3.4. Data relating to contracting or purchasing services

Where Vendetta Race is directly involved in selling or managing tickets, products or services, data relating to the following may be processed:

Purchase made.
Ticket number or reference.
Category or area purchased.
Amount and transaction status.
Data required for invoicing.
Purchase-related incidents.
Requests for changes, cancellations or refunds, where applicable.

Full payment method details may be processed directly by specialist payment service providers without NCC necessarily having access to them.

3.5. Financial and invoicing data

Where necessary due to a contractual or commercial relationship, we may process invoicing data, information about payments and collections, and other information required for administrative, accounting and tax management.

3.6. Communications

We may process information voluntarily included in emails, forms, messages, proposals, requests, complaints and other communications with Vendetta Race.

Please avoid providing particularly sensitive information that is not necessary for the purpose of the communication.

3.7. Technical and browsing data

Accessing the Website may generate certain technical data, including:

IP address.
Date and time of access.
Device type.
Browser and operating system.
Source address or referral URL.
Technical server logs.
Information necessary to ensure the security and operation of the service.

The use of cookies or other similar technologies is specifically governed by the Cookie Policy.

3.8. Image and voice data

Where applicable due to participation or attendance at events, presentations, activities, interviews or audiovisual productions associated with Vendetta Race, images, video or voice recordings may be processed.

In each case, processing will take place in accordance with the applicable legal basis and the specific information provided to the data subject where required.

4. SOURCE OF DATA

Personal data will generally be obtained directly from the data subject.

We may also receive certain data through:

Companies, entities or professionals represented by the data subject.
Collaborators or providers involved in providing certain services.
Ticket or service sales platforms where necessary to manage the relationship with the user.
Organisers or collaborators of activities associated with Vendetta Race.
Lawfully accessible professional sources, where the data consists solely of professional information necessary to maintain relationships with the company or entity employing the data subject.
Social networks where users themselves interact with Vendetta Race’s official profiles.

Where legislation requires specific information about the source of data, that information will be provided to the data subject.

5. PROCESSING PURPOSES AND LEGAL BASES

5.1. Handling queries and requests

Purpose: to respond to queries, requests for information, proposals, complaints or communications received.

Legal basis: taking pre-contractual steps where the query concerns a potential contractual or commercial relationship; otherwise, NCC’s legitimate interest in handling and managing incoming communications.

5.2. Managing contractual relationships

Purpose: to establish and manage relationships with purchasers, customers, providers, participants, collaborators and other parties contractually associated with Vendetta Race.

Legal basis: performance of a contract or taking pre-contractual steps.

5.3. Ticket management and event attendance

Purpose: to process ticket reservations or purchases, identify transactions, manage access, resolve incidents and handle event-related requests.

Legal basis: performance of the corresponding contract and compliance with associated legal obligations.

Where tickets are sold or managed by a third party, that provider may act as a processor or as an independent controller, depending on the specific service arrangements.

5.4. Invoicing, accounting and legal obligations

Purpose: to issue invoices, manage collections and payments, and comply with applicable tax, commercial, accounting or administrative obligations.

Legal basis: compliance with legal obligations.

5.5. Relationships with sponsors, businesses and professionals

Purpose: to manage commercial, institutional and professional relationships with companies, sponsors, providers, agencies, collaborators and other entities associated or potentially associated with the project.

Legal basis: performance of a contract, taking pre-contractual steps or NCC’s legitimate interest in maintaining relationships with the legal entity for which the data subject works.

In the latter case, processing will be limited to the professional data necessary to establish or maintain that relationship.

Purpose: to send updates, information, news, promotions, ticket sales opening announcements, content or communications relating to Vendetta Race.

Legal basis: the data subject’s consent where required.

Data subjects may withdraw their consent or unsubscribe from these communications at any time through the mechanism included in each communication or by writing to info@nuestracosacreativa.com.

Where legislation permits certain communications to previous customers without requesting fresh consent, the statutory requirements and users’ right to object to further communications will be respected in all cases.

5.7. Website security and operation

Purpose: to ensure Website security, prevent unauthorised access, detect abusive activities, investigate technical incidents and maintain system integrity.

Legal basis: NCC’s legitimate interest in maintaining the security of its systems, services and users.

5.8. Cookies and similar technologies

The purposes and legal bases associated with cookies and similar technologies will depend on their nature.

Strictly necessary cookies may be used to ensure the technical operation of the Website.

Where analytics, advertising or personalisation cookies or technologies requiring consent are used, they will only be activated in accordance with the preferences expressed by users through the consent management system.

Loading Google Tag Manager, which installs no cookies, is based on the legitimate interest in section 5.7; tags requiring consent are governed by the Cookie Policy.

Further information is available in the Cookie Policy.

5.9. Images, voice and audiovisual content

Where Vendetta Race captures or uses images or recordings relating to participants, collaborators, professionals or attendees, processing may be based, as appropriate, on:

The data subject’s consent.
Performance of a contractual relationship.
Legitimate interest where legally appropriate and not overridden by the data subjects’ rights and freedoms.
Any other legally applicable legal basis.

Where necessary, additional specific information about capturing and using images will be provided.

6. MANDATORY DATA

Data identified as mandatory in forms will be necessary to manage the corresponding request or service.

Refusing to provide that data may prevent the corresponding request, contract, purchase or service from being processed or provided.

Where data is optional, this will be expressly indicated or its absence will not prevent use of the main service.

7. RETENTION PERIODS

Personal data will only be retained for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for the periods necessary to address potential legal liabilities.

In general:

Queries and requests: for the time necessary to resolve the communication and subsequently while liabilities may arise from the relationship maintained.
Contractual and commercial relationships: for the duration of the relationship and subsequently for the applicable statutory limitation periods.
Invoicing and commercial documentation: for the periods established by applicable tax, commercial and accounting legislation.
Commercial communications: until data subjects withdraw consent, unsubscribe or object to processing, as appropriate.
Professional data: while a reasonable professional relationship exists or until data subjects indicate their data is no longer valid or request its erasure where appropriate.
Technical logs: for limited periods proportionate to security, operation and diagnostic needs.
Ticket or event-related data: for the time necessary to manage the event, address incidents and comply with associated legal obligations.

Once those periods have ended, data may remain duly blocked for the statutory limitation periods before being permanently erased.

8. DATA RECIPIENTS

Personal data will not be sold to third parties.

It may be disclosed or made available to third parties in the following circumstances:

8.1. Service providers

NCC may engage providers who need access to certain data to provide their services, including, among others:

Web hosting and technology infrastructure services.
Storage and cloud service providers.
Email services.
Technology maintenance and development providers.
Ticket management platforms.
Payment system providers.
Marketing and communications services.
Web analytics services, where authorised.
Legal, tax, accounting or administrative advisers.
Security and access control companies where necessary for events.

Where these providers act on behalf of NCC, they will be processors and subject to the obligations established in Article 28 of the GDPR.

The Website loads Google Tag Manager, provided by Google Ireland Limited, as a technical tag management tool. The technical data Google receives and the conditions under which tags are activated are described in the Cookie Policy.

8.2. Independent controllers

Some third parties may independently determine the purposes and means of processing personal data, acting as independent controllers.

This may occur, among other cases, with certain:

Payment providers.
Ticketing platforms.
Social networks.
External technology services.
Organisers or collaborators of particular activities.

In such cases, the corresponding third party’s privacy policies will also apply.

8.3. Public administrations and authorities

Data may be disclosed to public administrations, courts, law enforcement agencies or other authorities where there is a legal obligation or valid request.

9. INTERNATIONAL DATA TRANSFERS

Some technology providers used by NCC may process personal data outside the European Economic Area.

Where an international data transfer takes place, NCC will adopt the safeguards required by applicable legislation.

These safeguards may include:

Adequacy decisions adopted by the European Commission.
The recipient’s participation in adequacy mechanisms recognised by the European Union, where applicable.
Standard Contractual Clauses approved by the European Commission.
Other valid safeguards provided for by the GDPR.

Where necessary, additional measures will be implemented to ensure an adequate level of protection.

Google LLC, the parent company of Google Ireland Limited (Google Tag Manager), may process in the United States the technical connection data it receives when the container is loaded. It is certified under the EU-U.S. Data Privacy Framework, covered by the European Commission adequacy decision of 10 July 2023.

Data subjects may request further information about the safeguards applied by writing to info@nuestracosacreativa.com.

Vendetta Race may maintain official profiles on various social networks and digital platforms.

When users interact with those profiles, certain processing may be carried out both by NCC and by the company that owns the corresponding platform, in accordance with their respective terms and privacy policies.

NCC will only process data obtained through social networks to manage interactions with users, handle communications, administer its presence on those platforms and carry out activities legitimately associated with Vendetta Race.

Use of social networks is also subject to the terms established by their respective owners.

11. MINORS

Vendetta Race may produce content or activities that may interest minors. However, their personal data must be processed with particular respect for legislation applicable to minors.

Where processing is based on consent:

Persons over 14 years of age may consent to the processing of their personal data under the terms permitted by Spanish legislation.
For persons under 14 years of age, consent from the holder of parental responsibility or guardianship will be required, unless another legal basis lawfully permits processing.
This is without prejudice to cases where applicable legislation requires parents, guardians or legal representatives to intervene in the conclusion of a particular contract, act or legal transaction.

NCC may take reasonable measures to verify users’ ages and, where necessary, authorisation from their legal representatives.

If a parent, guardian or legal representative believes a minor has improperly provided personal data, they may request its review or erasure by writing to:

info@nuestracosacreativa.com

12. DATA SUBJECT RIGHTS

Data subjects may exercise the rights recognised by data protection legislation.

In particular:

Right of access: to know whether NCC is processing their data and obtain information about that processing.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of their data where the legal requirements are met.
Right to object: to object to certain processing based on legitimate interest or processing for direct marketing purposes.
Right to restriction of processing: to request temporary restriction of processing in the cases provided for by law.
Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, request its transmission to another controller.
Right to withdraw consent: to withdraw consent at any time without affecting the lawfulness of processing previously carried out.
Right not to be subject to certain automated decisions: where the requirements set out in the GDPR are met.

To exercise any of these rights, please contact:

Nuestra Cosa Creativa, S.L.
Calle de los Herreros, 28, Oficinas 2.ª Planta
36002 Pontevedra, Spain

Email: info@nuestracosacreativa.com

The request must enable the data subject to be properly identified and specify the right they wish to exercise.

Where there are reasonable doubts about the requester’s identity, NCC may request additional information strictly necessary to verify it.

13. COMPLAINTS TO THE SUPERVISORY AUTHORITY

If data subjects consider that processing of their personal data breaches applicable legislation, they may lodge a complaint with the competent data protection authority.

In Spain, the competent authority is:

Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6
28001 Madrid
https://www.aepd.es

Without limiting this right, data subjects are advised to first contact NCC at info@nuestracosacreativa.com to try to resolve any issue relating to the processing of personal data.

14. AUTOMATED DECISIONS AND PROFILING

NCC does not currently make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them.

If such processing is introduced in future, data subjects will first be provided with the information required by applicable legislation.

15. DATA SECURITY

NCC will adopt appropriate technical and organisational measures to ensure a level of security appropriate to the risk and protect personal data against destruction, loss, alteration, disclosure or unauthorised access.

These measures will be reviewed and adapted taking into account the state of the art, implementation costs, the nature and scope of processing and the risks to individuals’ rights and freedoms.

However, no system connected to the Internet can guarantee absolute security.

16. DATA ACCURACY

Users warrant that the personal data they provide is correct, complete and up to date, and undertake to communicate any relevant changes.

Where they provide data about third parties, they must have a legitimate basis for doing so and provide those parties, where appropriate, with the necessary information about processing.

The Website may use cookies and similar technologies.

Detailed information about their use, purposes, duration, providers and mechanisms for configuring or withdrawing consent is available in the:

Cookie Policy:
https://vendettarace.com/politica-de-cookies

18. CHANGES TO THIS PRIVACY POLICY

NCC may amend this Privacy Policy to reflect legislative, judicial, technological or organisational changes or changes relating to the services offered by Vendetta Race.

The version in force will be the one published on the Website at any given time.

Where changes are substantial and legislation requires it, data subjects will be informed through appropriate means.

Last updated: 29 September 2026.