Last updated: November 2026
This policy explains what personal information Difuso Ibiza collects through difuso.net, why we collect it, how we look after it and the rights you have over it. We are committed to handling your information with the same care and confidentiality we bring to every stay.
Who we are
The data controller responsible for your information is Difuso Ibiza (“Difuso”).
For any question about this policy or your data, write to us at [email protected].
What we collect and why
Enquiries and reservation requests
When you contact us or send an enquiry through our forms (such as “Reserve Your Experience”, the property enquiry form or the contact box), we collect the information you choose to give us: your name, email address, phone number, country, preferred contact method, preferred dates and length of stay, what is bringing you to Difuso, your previous therapeutic experience and any message you write.
We use this information only to understand your needs, reply to you, assess whether our programmes are the right fit for you and prepare your stay. The legal basis is the steps you ask us to take before entering into an agreement with us (Article 6.1.b GDPR) and your consent.
Health information
Some of our forms invite you, optionally, to share information about your physical or mental health or your wellbeing so that we can support you safely. This is a special category of personal data. We only process it with your explicit consent (Article 9.2.a GDPR), which you give by ticking the consent box when you submit the form. It is shared only with the members of our team and the facilitators directly involved in your care, and you can withdraw your consent at any time.
Newsletter
If you subscribe to our monthly mailing list, we collect your email address (and your name, if you give it) to send you news about Difuso. The legal basis is your consent. You can unsubscribe at any time using the link in any of our emails or by writing to us.
Website statistics and cookies
We use Google Analytics and Metricool to understand, in aggregate, how visitors use our website (for example, which pages are visited and how people arrive at the site). These tools use cookies and similar technologies. We also use Google reCAPTCHA on our forms to protect them from spam, and Cloudflare to keep the website fast and secure; both may process technical data such as your IP address and browser information.
Analytics cookies are only used with your consent, which you can give or withdraw through the cookie settings on our website. Strictly necessary technical processing (security and spam protection) is based on our legitimate interest in keeping the website safe.
Who we share your information with
We never sell your information. We share it only with the people and service providers we need to run Difuso, all bound by confidentiality and data protection obligations:
- The Difuso team and, where relevant to your stay, the facilitators who will work with you.
- The providers that host our website and deliver our emails.
- Google (Analytics, reCAPTCHA and Google Workspace/Sheets, where we keep enquiry and subscriber records), Cloudflare, Metricool and Slack (which we use to notify our team of new enquiries).
Some of these providers may process data outside the European Economic Area, for example in the United States. When that happens, the transfer is protected by appropriate safeguards such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
How long we keep your information
- Enquiries that do not lead to a stay: only for as long as we need to reply to you and follow up on your enquiry, and then deleted.
- Guests: for as long as needed to provide your stay and afterwards for the periods required by Spanish tax, accounting and tourism law.
- Health information: only for as long as it is needed to support you, and deleted when you withdraw your consent.
- Newsletter: until you unsubscribe.
Your rights
You have the right to access your personal data, correct it, ask us to delete it, restrict or object to how we use it, receive it in a portable format and withdraw your consent at any time, without affecting anything we did lawfully before you withdrew it. To exercise any of these rights, write to [email protected]. We will reply within one month.
If you believe we have not handled your data properly, you can also file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
Security
We take appropriate technical and organisational measures to protect your information against loss, misuse and unauthorised access, and we limit access to the people who need it to support you.
Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page, with the date it was last updated.