Privacy Policy
Effective date: 17 September 2026
1. Introduction
Claudia De Veis, trading as Brewing Minds ES (“Brewing Minds”, “we”, “us” or “our”), organises events and provides ticketing and related services through https://spain.brewing-minds.com/ (the “Site”).
We respect your privacy and process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”), and other applicable data-protection legislation.
This Privacy Policy explains what personal data we collect, why we use it, who may receive it, how long we retain it and the rights available to you.
2. Data Controller
The controller responsible for processing personal data through this Site is:
Data controller: Claudia De Veis, autónoma
Trading name: Brewing Minds ES
NIF/NIE: Y9087100K
Business address: Calle Cadiz 59, Puerta 3, Piso 1, 46006 Valencia
Privacy contact email: team.es@brewing-minds.com
Brewing Minds has not appointed a Data Protection Officer because it is not currently subject to a mandatory Data Protection Officer appointment under Article 37 GDPR.
Privacy enquiries and requests concerning your personal data may be sent to team.es@brewing-minds.com.
3. Personal Data We Process
3.1 Information you provide to us
Depending on how you interact with us, we may process:
Identification and contact information, including your name, email address, postal address and telephone number
Ticket and transaction information, including events booked, number of tickets, prices, billing information and payment status
Account information, if you create an account on the Site
Information contained in enquiries, support requests, feedback or other communications
Newsletter subscriptions and marketing preferences
Information submitted through speaker, collaboration, sponsorship or other website forms
Information necessary to organise and administer an event where you voluntarily provide such information
Please do not provide health or other special-category personal data unless it is necessary and specifically requested by us.
Where we need to process information relating to accessibility requirements or other information that may constitute special-category personal data, we will process that information only where there is an appropriate legal basis under applicable data-protection law and will provide any additional information required by law.
3.2 Information collected automatically
When you use the Site, we may automatically receive certain technical information, including:
IP address
Browser type and version
Operating system and device information
Pages visited and actions performed
Date and time of access
Referring URLs
Session, security and error-log information
We use this information to deliver, maintain and secure the Site, diagnose technical problems and protect the Site against misuse.
3.3 Cookies and similar technologies
The Site uses cookies and similar technologies.
Some cookies may be strictly necessary for the operation, security, user sessions, shopping cart and ticket-purchasing functions of the Site.
Where consent is legally required, non-essential cookies will not be activated before you provide the required consent.
Where a cookie-consent mechanism is provided, you can use it to accept, reject or modify your choices in accordance with the options made available through the Site.
4. Purposes and Legal Bases
We process personal data for the following purposes:
4.1 Ticket purchases and event administration
We process your identification, contact and transaction information to:
Process ticket orders and payments
Send booking confirmations and tickets
Communicate important information about an event
Manage cancellations, refunds and attendee support
The legal basis is the performance of a contract or taking steps at your request before entering into a contract under Article 6(1)(b) GDPR.
4.2 Enquiries and customer service
We process information submitted through email or contact forms to answer questions and provide support.
The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or potential booking, and otherwise our legitimate interest in managing enquiries and providing effective customer service under Article 6(1)(f) GDPR.
4.3 Newsletter and marketing communications
Where you subscribe to our newsletter or otherwise provide consent where consent is required, we process your name, email address and marketing preferences to send newsletters and information about Brewing Minds events.
The legal basis is your consent under Article 6(1)(a) GDPR (and Article 21 of Spanish Law 34/2002, LSSI-CE). The consent checkbox identifies both Claudia De Veis, trading as Brewing Minds ES, and Brewing Minds UG (haftungsbeschränkt), Germany, as joint controllers for this purpose under Article 26 GDPR. Your ticket-purchase data is never used for this purpose.
You can withdraw your consent at any time by using the unsubscribe link included in our marketing communications or by contacting us at team.es@brewing-minds.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
4.4 Website operation, security and fraud prevention
We process technical and usage information to operate the Site, maintain its security, detect misuse and prevent fraud.
The legal basis is our legitimate interest in providing a secure and reliable service under Article 6(1)(f) GDPR and, where applicable, compliance with a legal obligation under Article 6(1)(c) GDPR.
4.5 Accounting and legal compliance
We process invoices, transaction records and related information to meet accounting, tax and other statutory obligations.
The legal basis is compliance with legal obligations under Article 6(1)(c) GDPR.
4.6 Other website forms
Information submitted through speaker, collaboration or sponsorship forms is processed to assess and respond to the relevant proposal.
The legal basis is taking steps at the individual’s request before entering into a possible agreement under Article 6(1)(b) GDPR or our legitimate interest in managing collaborations and business relationships under Article 6(1)(f) GDPR, depending on the circumstances.
4.7 Event photography and video recording
Brewing Minds events may be photographed or filmed for event documentation, communications, marketing and social-media purposes.
Attendees may therefore appear in photographs or recordings made during an event.
The applicable legal basis will depend on the circumstances and the nature and use of the recording. Where consent is required, we will obtain consent before carrying out the relevant processing.
Where processing is based on legitimate interests, we will balance those interests against the rights and freedoms of individuals and provide the information and objection mechanisms required by applicable law.
If you do not wish to appear in photographs or recordings, please inform a member of our team at the event or contact us at team.es@brewing-minds.com. We will make reasonable efforts to accommodate your request, subject to applicable law.
5. Recipients and Service Providers
We disclose personal data only where necessary for the purposes described in this Privacy Policy, where required by law, or where otherwise permitted under applicable data-protection legislation.
Depending on the services used by Brewing Minds, recipients may include:
Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium — website hosting/platform, customer management, ticketing and invoicing
Stripe Payments Europe, Limited — Ireland — payment processing
Payment service providers used to process ticket payments
Accountants, tax advisers and other professional advisers where necessary for accounting, tax and legal compliance
Providers used to deliver and manage email communications
Cookie-consent, analytics or other technical service providers where applicable
Venues and event-service providers where access to limited information is necessary to organise an event
Public authorities, courts, tax authorities or law-enforcement bodies where disclosure is required by law
We do not sell or rent personal data.
We do not disclose personal data to unaffiliated third parties for their own independent marketing purposes unless you have provided the required consent or disclosure is otherwise permitted by applicable law.
Relationship with Brewing Minds UG (haftungsbeschränkt)
Brewing Minds ES operates under a franchise licence from Brewing Minds UG (haftungsbeschränkt) in Germany.
Certain technical infrastructure or business activities may involve Brewing Minds UG.
Where Brewing Minds UG processes personal data on behalf of Claudia De Veis, it will do so in accordance with the applicable data-protection requirements governing processors.
Where Brewing Minds UG processes personal data for its own independent purposes, it will act as an independent controller and will be responsible for the processing for those purposes.
Essential terms of the joint-controller arrangement (Article 26(3) GDPR): Claudia De Veis is your primary point of contact for the purposes above and will handle your enquiries and requests. You may also contact Brewing Minds UG directly — both parties can be approached under Article 26(3) GDPR. Each party notifies the other of a security incident within 24 hours of becoming aware of it, and each notifies its own competent supervisory authority as legally required.
6. Payment Information
Payments for tickets are processed through the payment service provider made available during the purchase process.
Payment-card or bank details may be entered directly into the payment provider's secure systems.
Where applicable, we do not receive or store complete payment-card details.
Payment providers may process personal data as independent controllers for purposes such as payment authorisation, fraud prevention, security and compliance with financial regulations.
For further information about processing carried out by a payment provider, please consult the provider's applicable privacy information.
7. International Data Transfers
Some service providers may process personal data outside Spain or outside the European Economic Area (“EEA”).
Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we will use an appropriate transfer mechanism in accordance with applicable law, which may include an adequacy decision, the European Commission's Standard Contractual Clauses or other legally recognised safeguards.
Where required, additional safeguards will be implemented to protect personal data transferred internationally.
You may contact us at team.es@brewing-minds.com for further information about the safeguards applicable to relevant international transfers.
8. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected and for any subsequent period required to establish, exercise or defend legal claims or comply with applicable statutory obligations.
Retention periods may therefore vary depending on the type of data and the purpose for which it is processed.
In particular:
Ticket and contractual records: retained for the duration of the customer relationship and, thereafter, for up to 5 years, unless a longer period is necessary to establish, exercise or defend a legal claim or is otherwise required by law.
Invoices, accounting records and supporting commercial documents: retained for 6 years from the date of the last relevant accounting entry, in accordance with the Spanish Commercial Code, and for any longer period required by applicable tax legislation or necessary to establish, exercise or defend legal claims.
Contact and customer-support correspondence: retained for 2 years after the last interaction, unless the correspondence relates to an ongoing contractual relationship, complaint, dispute or potential legal claim, in which case it may be retained for as long as reasonably necessary to manage that matter.
Speaker, collaboration and sponsorship enquiries: retained for 2 years after the last interaction, unless the information is required for an ongoing business relationship or potential legal claim.
Newsletter and marketing information: retained until you unsubscribe or withdraw your consent. After withdrawal, we may retain limited information necessary to record your withdrawal and ensure that no further marketing communications are sent to you.
Technical and security logs: retained for 12 months, unless a longer period is reasonably necessary to investigate a security incident, prevent fraud or abuse, comply with a legal obligation or establish, exercise or defend a legal claim.
Cookie-consent records: retained for a maximum of 24 months from the date on which consent is given or updated, after which consent will be requested again where required. This is consistent with the Spanish Data Protection Agency's guidance on cookie consent.
Attendee-continuity data: if, at any point, there is no active organiser for this territory, identifying attendee data kept for possible continuity of the customer base is retained for a maximum of 12 months, after which it is deleted or anonymised — unless you have kept your newsletter consent active, in which case your contact data for that purpose follows the newsletter retention rule above.
When a retention period expires, personal data will be securely deleted or anonymised, unless continued retention is required or permitted by applicable law.
Where a legal claim, investigation, audit or other legal obligation requires continued retention, the relevant data may be retained until that matter has been finally resolved.
9. Your Data-Protection Rights
Subject to the conditions established by applicable law, you may exercise the following rights:
Access: obtain confirmation of whether we process your personal data and receive a copy
Rectification: correct inaccurate or incomplete data
Erasure: request deletion where continued processing is no longer justified
Restriction: request that processing be limited in certain circumstances
Data portability: receive certain data in a structured, commonly used and machine-readable format
Objection: object to processing based on legitimate interests or to direct marketing
Withdrawal of consent: withdraw consent at any time without affecting the lawfulness of earlier processing
Not to be subject to certain automated decisions: where the requirements of Article 22 GDPR apply
To exercise your rights, contact team.es@brewing-minds.com. Please identify the right you wish to exercise and provide sufficient information for us to identify the relevant records. We may request additional information where reasonably necessary to verify your identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency:
Agencia Española de Protección de Datos (AEPD)
Calle Jorge Juan, 6
28001 Madrid, Spain
You may also contact the data-protection authority responsible for your habitual residence or place of work within the European Union.
Because Claudia De Veis (Brewing Minds ES) and Brewing Minds UG are joint controllers for the newsletter and for attendee-database continuity (see Section 5), you may exercise these rights against either party for those specific purposes.
10. Automated Decision-Making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects concerning you.
Where third-party payment or fraud-prevention providers use automated systems, those providers may process personal data in accordance with their own privacy policies and applicable legal obligations.
11. Security
We apply appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include HTTPS/TLS encryption, access controls, authentication measures, restricted staff access and maintained software systems. No internet-based service can guarantee absolute security.
12. Children and Minors
Brewing Minds events and online ticketing services are intended for adults aged 18 or over unless a particular event expressly states otherwise.
We do not knowingly collect personal data directly from children through the Site for events intended exclusively for adults.
Where an event permits minors to attend, any processing of their personal data will be carried out in accordance with applicable data-protection and consumer legislation.
If you believe that a child has provided personal data to us without appropriate authorisation, please contact us at team.es@brewing-minds.com.
13. Third-Party Links
The Site may contain links to third-party websites or services. We are not responsible for the privacy practices of independent third parties. We encourage you to review their privacy information before providing personal data.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our activities, service providers or legal obligations. The effective date shown at the top identifies the latest version.
Where appropriate, we will communicate material changes through the Site or by email.
15. Contact
For questions about this Privacy Policy, our processing activities or the exercise of your rights, contact:
Claudia De Veis, trading as Brewing Minds ES
NIF/NIE: Y9087100K
Email: team.es@brewing-minds.com
Business address: Calle Cadiz 59, Puerta 3, Piso 1, 46006 Valencia