Privacy policy

1. Who is responsible

The controller of your personal data is Nova Forest Montseny, SL, tax ID (CIF) B56629231, registered office at Via les illes s/n, Montseny 08469 (Barcelona), Spain.

You can email us at info@novaforest.es or call us on +34 690 121 664.

Nova Forest Montseny is the trading name we use for the campsite and this website.

We have not appointed a Data Protection Officer, because the law does not require us to (Article 37 GDPR). So for anything to do with your data, email us at info@novaforest.es.

2. What we collect

From the contact form: your name, your email address, your phone number if you choose to leave it, the reason for your inquiry that you pick from the list, and whatever you write in the message.

To send you an email after your stay, we use the name, email address and language on your booking.

While you browse we also collect a pseudonymous identifier assigned to your browser, the pages you visit, how long you stay and how you got here, your device type, browser, operating system and language, and the approximate country or region worked out from your IP address. If you arrived from one of our ads, the identifier for that click too.

There is one more piece, a security one: when you submit the form we store a code generated from your IP address with a secret key that exists only on our server, so we can limit how many submissions come from one place per hour. For that check we do not store your IP address itself, and without that key the code cannot be used to recover the original address.

Everything collected while you browse depends on your consent, with three exceptions that we explain in section 4: what is strictly necessary for the site to work and stay protected, the click identifier if you arrive from one of our ads on Google, and the note of how you reached the site.

3. Why we use your data, and on what legal basis

To answer your inquiry and handle your booking request, we rely on the pre-contractual steps you are asking us to take (Art. 6(1)(b) GDPR). If your inquiry is not about a booking, the basis is your consent (Art. 6(1)(a) GDPR).

To send you an email after your stay that thanks you and invites you to leave a Google review and follow us on Instagram, we rely on our legitimate interest in keeping in touch with the people who stay with us (Art. 6(1)(f) GDPR). Because you are already our customer, that email is also covered by Art. 21.2 LSSI-CE. You can object at any time: reply “UNSUBSCRIBE” to that email, or email us at info@novaforest.es, and we’ll stop sending it. If you leave a Google review or follow us on Instagram, you do so on those platforms, which handle your data under their own policies.

To understand how the site is used so we can improve it, and to show you our advertising on other platforms and measure whether it works, the basis is your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE).

To know which channel our bookings come from (one of our campaigns, a search engine, a social network or another website), our legitimate interest in measuring, in aggregate, which channels work (Art. 6(1)(f) GDPR). What we note does not identify you. You can object by writing to info@novaforest.es.

To protect the form from spam and abuse, our legitimate interest in keeping the service running and secure (Art. 6(1)(f) GDPR).

We do not make automated decisions that produce legal effects for you, and we do not build profiles that affect your rights.

4. Cookies and similar technologies

The first time you visit, we show a notice with two buttons, Accept and Reject, the same size, the same color, in the same place.

Until you choose, no analytics or advertising cookie is set. If you reject, none are set, nothing goes to Meta, and Google receives only what we describe in the next paragraph; the site keeps working the same for you. If you accept, the ones listed below are switched on.

Before you choose, and also if you reject, Google’s measurement tools do load, but without setting cookies. What they transmit are cookieless signals: date and time, browser type, the page you came from, and whether or not you have given consent. If you arrive from one of our Google ads, the page address also carries an identifier for that click, added by Google. As you browse, that identifier travels from page to page in the address and the signals include it, so Google can attribute your visit to that ad. It is not stored in your browser. Without that identifier, Google cannot recognize you or tie those signals to other visits. This is what Google calls advanced consent mode.

We also note how you reached the site. If you came from one of our ads, we note the campaign (for example, “google-verano”). If you came from a search engine, a social network or an assistant, we note which one (for example, “google-organic”). If another website linked to us, we note its name. We do this even if you reject cookies or don’t choose, because nothing is stored in your browser: the note travels in the address of the pages you visit (the “nfo” parameter) and is the same for everyone who arrives the same way, so it does not identify you. If you make a booking, it is saved with it in our booking engine, Witbooking, so we know which channels bring us bookings.

We do not use cookie walls. Rejecting locks you out of nothing.

Your choice is stored for up to 24 months, whether you accept or reject; some browsers delete it sooner, and then we ask again. We also ask again if we change how we handle data.

You can change your mind whenever you like, and as easily as you chose in the first place: there is a “Cookie preferences” link in the footer of every page. And you can always delete cookies through your browser settings.

Here is what gets set. Starting with the necessary ones, which are always on because the site does not work without them, and which for that reason do not depend on your consent.

nf_consent: first-party cookie, ours. Stores your cookie decision. Lasts up to 24 months.

nf_lead: session storage, ours. Stops a single form submission being counted twice. Gone when you close the tab.

The form is also protected by Cloudflare Turnstile, which checks that the person submitting it is a human and not an automated program. The form cannot be submitted without that check, so it is strictly necessary too, and it does not depend on your consent either. When it loads, Cloudflare receives your IP address and technical details about your browser.

The analytics ones are set only if you accept. They tell us which pages work and which don’t; the Google Analytics reports we see are aggregated.

_ga: first-party cookie, from Google Ireland Ltd. Tells one browser apart from another. Lasts 13 months.

_ga_96KN1YV90X: first-party cookie, from Google Ireland Ltd. Keeps track of the session. Lasts 13 months.

Microsoft Clarity also records how the page gets used: where you move the mouse, where you click, and how far down you scroll. It turns that into heatmaps and replays of the visit, which we use to see what isn’t landing. What you type into the form is not recorded, because Clarity hides the contents of text fields.

_clck: first-party cookie, from Microsoft Ireland Operations Ltd. Stores an identifier for your browser so Clarity can tell one visit from another. Lasts 12 months.

_clsk: first-party cookie, from Microsoft Ireland Operations Ltd. Groups the pages you view back to back into a single session. Lasts 1 day.

MUID: third-party cookie, from Microsoft, on the clarity.ms domain. Recognizes your browser across Microsoft services. Lasts 13 months.

The advertising ones, again only if you accept, let us measure whether our ads work and show you our content on Google and on Meta’s platforms.

_gcl_au: first-party cookie, from Google Ireland Ltd. Measures conversions coming from ads. Lasts 90 days.

_gcl_ls: local storage, from Google Ireland Ltd. Supports that same measurement. Stays until you delete it.

IDE: third-party cookie, from Google Ireland Ltd., on the doubleclick.net domain. Measures whether our ads work and lets us show you our ads on other sites. Lasts 13 months.

_fbp: first-party cookie, from Meta Platforms Ireland Ltd. Identifies your browser for ad measurement and targeting. Lasts 90 days.

lastExternalReferrer and lastExternalReferrerTime: local storage, from Meta Platforms Ireland Ltd. Store which website you arrived from and when. They stay until you delete them.

This list covers what we have checked on the live site, and none of it is set unless you accept. What each provider then keeps in its own systems is up to them; section 5 tells you who they are.

The contact page has a Google Maps embed that only loads if you accept cookies. If you reject them, or while you have not yet chosen, you will see the address instead and a link that opens the map in Google Maps in a new window: until you click it, nothing is sent to Google. When the map does load, Google receives your IP address and basic information about your browser.

Cookie preferences

5. Who else receives your data

We do not sell your data, and we do not hand it to anyone so they can market their own products to you. We do work with providers who process it on our behalf or, in some cases, on their own account.

Google Ireland Limited handles analytics (Google Analytics 4), advertising (Google Ads) and business email (Google Workspace), which is how form messages reach us.

Meta Platforms Ireland Limited is involved in measurement and advertising through the Meta pixel, and is an independent controller for the data it receives that way.

Microsoft Ireland Operations Limited provides Microsoft Clarity, which is what we use to view heatmaps and replays of visits. It is a processor when it analyzes site usage on our behalf, and an independent controller when it uses that same data to maintain and improve its own services.

Cloudflare, Inc. runs the anti-spam check on the form with Turnstile. It is a processor when it checks on our behalf that a real person is submitting the form, and an independent controller when it uses that same data to improve its own bot detection, relying on its legitimate interest.

Nominalia Internet S.L. hosts the website and the outgoing mail server.

The post-stay email is sent on our behalf by the software we use to manage bookings.

witbooking is the booking engine. Clicking any booking button takes you off our site to engine.witbooking.com, where witbooking acts as an independent controller. Section 9 covers this.

WhatsApp Ireland Limited, part of the Meta group, is an independent controller for the conversation if you message us on WhatsApp.

We may also disclose data to courts, tribunals and public authorities where we are legally required to.

6. International transfers

Google, Meta, Microsoft and Cloudflare belong to groups headquartered in the United States and may process data outside the European Economic Area.

Those transfers are covered by the EU-US Data Privacy Framework and, additionally, by the standard contractual clauses approved by the European Commission.

The site serves its fonts from our own server, so opening a page does not send your IP address to any font provider.

7. How long we keep your data

Form inquiries, 36 months from the last contact. That period is what it is because an inquiry can turn into a booking a season or two later, and because we need to be able to evidence the relationship if a claim is ever made.

Analytics and advertising data, as long as each cookie lasts per section 4 and, at most, Google’s and Meta’s own retention periods.

The IP-derived code used by the anti-spam control is deleted automatically once an hour passes with no submission from that IP address, as soon as someone uses the form again.

Once those periods are up, data is deleted or anonymized.

8. Your rights

You can exercise, at any time, your rights of access (find out what data we hold about you), rectification (have it corrected if it is inaccurate), erasure (ask us to delete it), objection (object to processing based on our legitimate interest), restriction (ask us to keep it but not use it) and portability (receive it in a structured, commonly used format). You can also withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

Email us at info@novaforest.es saying which right you want to exercise. We reply within one month at the latest. If we cannot verify who you are another way, we may ask you to confirm your identity.

And if you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

9. Bookings through witbooking

The booking buttons take you to engine.witbooking.com, a platform operated by a third party.

From that point on, the data you enter to complete your booking is handled under witbooking’s own privacy policy, and witbooking acts as an independent controller. We receive the information we need to manage your stay. Your cookie choice on this site does not carry over to that platform: it is a different domain, with its own settings and its own notice.

10. Changes to this policy

We will update this policy when the services we use change, or when the applicable rules do. The date of the most recent update appears at the top.

If a change affects processing that relies on your consent, we will ask you again before applying it.

11. Language version

This policy is available in Spanish, Catalan and English. The Spanish version is the original and prevailing version: in the event of any discrepancy between versions, the Spanish text applies.