Privacy policy

1. Data controller

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “GDPR”) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, “LOPDGDD”), users are informed of the following data controller details:

• Company name: BACUS EVENTOS SOCIALES, S.L.
• Tax ID (CIF): B25313743
• Address: Carrer de Sardenya, 83 · 08018 Barcelona · Spain
• Email: info@bacusevents.com
• Phone: +34 934 120 066

2. Personal data collected

Bacus Events collects and processes the personal data that users voluntarily provide through contact forms on the Website, communications by email, telephone calls or any other channel enabled for the commercial relationship. Data typically collected includes:

• Identification data: first name, surname, job title.
• Contact data: professional email address, telephone number.
• Professional data: company, sector, area of responsibility.
• Message content: event brief, tentative dates, approximate number of attendees, indicative budget and any other information the user chooses to provide.

3. Purposes of processing

Bacus Events processes the personal data collected for the following purposes:

• Handling and responding to enquiries, requests for information and commercial proposals submitted through the Website or any other channel.
• Managing the contractual relationship when users engage Bacus Events' services: drafting proposals, contracting, event execution and invoicing.
• Complying with applicable legal obligations (commercial, tax, employment, data protection).
• Sending commercial communications related to Bacus Events' services where the user has given explicit consent to do so.

4. Legal basis for processing

The legal basis for processing depends on the specific purpose:

• Performance of pre-contractual measures and, where applicable, performance of the contract (Art. 6(1)(b) GDPR) when handling commercial enquiries or managing the contractual relationship.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) for commercial, tax and document retention obligations.
• Legitimate interests (Art. 6(1)(f) GDPR) for managing the commercial relationship with existing clients and Website security actions.
• Consent (Art. 6(1)(a) GDPR) for sending unsolicited commercial communications, non-strictly-necessary cookies and any other processing subject to prior consent.

5. Data retention

Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected, and for as long as legally required. In particular: data of contractual clients will be retained for the duration of the contractual relationship and subsequent legal retention periods (generally up to six years for commercial retention, up to four years for tax retention, without prejudice to longer periods required by other sectoral rules). Data of users who have only requested information without establishing a contractual relationship will be retained for the time necessary to handle the enquiry and for a reasonable subsequent maximum period.

6. Recipients and data transfers

Bacus Events does not transfer personal data to third parties, except in the following cases:

• Where there is a legal obligation to communicate data to Public Administrations, courts and tribunals, security forces or other competent authorities.
• Service providers acting as data processors for Bacus Events (hosting services, project management tools, accounting and tax advisory, etc.), bound by a data processing agreement pursuant to Article 28 GDPR.
• International sub-processors in specific cases and with the guarantees required by the GDPR (see section 7).

7. International data transfers

In the provision of certain services (cloud hosting infrastructure, analytical tools, communication services), data may be processed by providers located outside the European Economic Area. Bacus Events ensures that international transfers are made to countries that have an adequacy decision from the European Commission or, failing that, by means of appropriate safeguards provided for in the GDPR (standard contractual clauses).

With regard to transfers to the United States, Bacus Events verifies that its providers are certified under the EU-U.S. Data Privacy Framework, pursuant to Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, which replaces the revoked Safe Harbor regime. Users may request detailed information about these transfers by writing to info@bacusevents.com.

8. User rights

Users may exercise the following rights at any time:

• Access (Art. 15 GDPR): obtain confirmation as to whether Bacus Events is processing their personal data and, if so, access that data.
• Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR): request deletion of data when it is no longer necessary for the purposes for which it was collected, among other legally provided grounds.
• Objection(Art. 21 GDPR): object to the processing of data on grounds relating to the user's particular situation.
• Restriction of processing (Art. 18 GDPR): request restriction of processing in the cases provided for by the GDPR.
• Portability (Art. 20 GDPR): receive personal data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Withdrawal of consent (Art. 7(3) GDPR) at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• Not to be subject to automated decisions (Art. 22 GDPR), including profiling.

Exercising these rights is free of charge. To do so, simply send a written request to info@bacusevents.com indicating the right you wish to exercise and attaching a copy of your national ID, passport or other document that allows the identity of the applicant to be verified.

If you do not receive a response or consider the attention received unsatisfactory, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the independent supervisory authority for data protection in Spain. More information at www.aepd.es.

9. Security measures

Bacus Events has adopted the necessary technical and organisational measures to guarantee the security of personal data and prevent its alteration, loss, processing or unauthorised access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying probability and severity to the rights and freedoms of natural persons, pursuant to Article 32 GDPR.

10. Amendments

Bacus Events reserves the right to amend this privacy policy to adapt it to legislative, jurisprudential or company practice developments. Any amendment will be published on the Website with reasonable notice before it takes effect.

Last updated: 2026.