Privacy policy

Last updated: 30 September 2026

Data controller Pixelatto Games, S.L. (trading as Malaga Secret Experiences) — Tax ID B93331841 — C/ Graham Bell 6, 29590 Málaga (Spain) — info@pixelatto.com

What data we process Bookings, waiting list, date requests and contact: first and last name, email, phone (optional), number of guests, chosen experience and date, and your message. Payment: amount, date and transaction ID. You enter your card details directly with Stripe: we never see or store them. Messages: whatever you send us by email, WhatsApp or Instagram. Images: photos or videos taken during an experience, only with your consent. Why we process it and on what legal basis Purpose Legal basis (GDPR) Managing your booking and payment, sending you the confirmation and location, and telling you about changes or cancellations Performance of a contract (art. 6.1.b) Answering your questions and date requests, and letting you know if a waiting-list spot opens up Your consent and pre-contractual steps (art. 6.1.a and b) Issuing invoices and meeting accounting and tax obligations Legal obligation (art. 6.1.c) Publishing photos or videos of the experience on our website and social media Your consent (art. 6.1.a), which you can withdraw at any time We will not send you advertising or make automated decisions about you.

How long we keep it Booking and billing data: for as long as commercial and tax law requires (up to 6 years). Questions, requests and waiting list: until resolved and for no more than 1 year. Photos and videos: until you withdraw your consent. Who we share it with We never sell or hand over your data. It is only accessed by the providers we need to run the service, under data processing agreements:

Vercel Inc.: website hosting. Supabase Inc.: booking database. Stripe Payments Europe Ltd.: payment processing. For fraud prevention and its own legal obligations, Stripe also acts as an independent controller (Stripe privacy policy). Resend (Plus Five Five Inc.): confirmation emails. Google Ireland Ltd. (Gmail): email. WhatsApp Ireland Ltd. and Meta Platforms Ireland Ltd. (Instagram): if you choose to contact us through those channels. Some of these providers may process data outside the European Economic Area (mainly in the USA). In those cases the transfer is covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

We will also disclose data to public authorities when required by law (for example, the Spanish Tax Agency).

Minors If you are under 14, your parent or guardian must provide the data and make the booking for you.

Your rights You can ask us for access to, rectification, erasure, restriction or portability of your data, and you can object to its processing. You can also withdraw your consent at any time. To do so, email info@pixelatto.com and say which right you want to exercise.

If you feel we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Cookies This website does not use analytics, advertising or tracking cookies; only the technical cookies strictly necessary for it to work.