1. Who handles your data
The data controller for this site is GolfPlan Spain, owner of the domain golfplanspain.com. We are established in Spain, so Spanish and EU data protection law applies.
| Owner | GolfPlan Spain |
|---|---|
| Website | golfplanspain.com |
| Contact | contact@golfplanspain.com — or the contact form |
2. What we collect
Only what is needed to sell you the challenge and give you access. We do not buy data sets and we do not profile you with third-party data.
| Data | When we collect it |
|---|---|
| Email address | When you buy and when you log in. It is your access identifier. |
| Name and message | Only if you write through the contact form. |
| Display name and handicap | Only if you fill them in yourself under “My account”. Both optional. |
| Your progress | Days completed, drill attempts and successes, notes you write. |
| Payment data | Entered directly into Stripe. We never see or store your card — we only receive the payment confirmation and your email. |
| IP address and technical data | Automatically, in server logs and to limit abuse (anti-spam, rate limiting). |
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Give you access to the 14-day challenge, save your progress, run your account | Performance of the contract (Art. 6(1)(b)) |
| Take payment and issue the receipt | Contract and legal tax obligation (Art. 6(1)(b) and (c)) |
| Answer what you send through the form | Legitimate interest in handling your enquiry (Art. 6(1)(f)) |
| Send your access email and service notices | Performance of the contract (Art. 6(1)(b)) |
| Prevent abuse, fraud and attacks | Legitimate interest in security (Art. 6(1)(f)) |
| Audience measurement and marketing via non-essential cookies | Your consent (Art. 6(1)(a)), withdrawable at any time |
We do not carry out automated decision-making producing legal effects on you.
4. Who we share it with
Only the providers the service needs. They act as processors and are contractually bound to handle your data solely on our instructions.
| Provider | Purpose | Where |
|---|---|---|
| Stripe | Card payment processing | EU / US under appropriate safeguards |
| Resend | Sending access emails and replies | EU / US under appropriate safeguards |
| Hostinger | Server and site hosting | European Union |
If we ever switch on measurement or advertising tools (for example Google Analytics or Meta), they will load only after you accept the corresponding cookies, and they will appear in this table and in the cookies section.
We do not sell your data or hand it to third parties for their own commercial purposes.
5. How long we keep it
- Account and progress: while you keep the account. Ask us to delete it and we delete it.
- Billing records: for the period Spanish tax and commercial law requires, even after you close the account.
- Contact messages: as long as needed to help you, plus a reasonable follow-up period.
- Technical logs: short periods, for security and diagnostics.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, and withdraw any consent you gave — without affecting the lawfulness of processing before withdrawal.
Write to contact@golfplanspain.com from the address linked to your account, or use the contact form. We reply within the legal deadline of one month.
7. Cookies and measurement
We use the bare minimum for the site to work:
| Item | Type | Purpose |
|---|---|---|
gp_session | Technical cookie (necessary) | Keeps you logged in after payment or an access link. httpOnly and secure. |
gp_lang | Local storage (necessary) | Remembers whether you prefer Spanish or English. |
gp_consent | Local storage (necessary) | Remembers your cookie choice so we stop asking. |
Necessary cookies need no consent. Any measurement or advertising cookie requires your prior acceptance, and you can change your mind at any time from the “Cookies” link in the footer.
8. Security
The site runs entirely over HTTPS. Passwords, if you choose to set one, are stored hashed with scrypt, never in clear text. Access to paid content is checked server-side and fails closed: when in doubt, access is denied. We rate-limit to blunt automated attacks and we never store card data.