Privacy Policy and Cookie Policy

1. Data controller

In accordance with Article 13 of Regulation (EU) 2016/679 (GDPR) and Article 11 of Spanish Organic Law 3/2018 (LOPDGDD), the controller of your personal data is:

This policy covers the website caminoifa.com and all of its forms and services: the contact form, consultation booking and payment, the AI-powered virtual assistant and the technical visit log.

2. Applicable law and territorial scope

We process your data in accordance with whichever of the following applies to you:

European Union and European Economic Area

• Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
• Directive 2002/58/EC on privacy in electronic communications (ePrivacy), as regards cookies.

Spain

• Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
• Law 34/2002 on information society services and electronic commerce (LSSI-CE), in particular Article 22.2 on cookies and Article 10 on general information.
• The cookie guidance and other criteria issued by the Spanish Data Protection Agency (AEPD).

United States

• The CCPA (California Consumer Privacy Act) as amended by the CPRA, and its implementing regulations.
• Equivalent state laws in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland and Tennessee, among others.
• COPPA (Children's Online Privacy Protection Act), the CAN-SPAM Act and Nevada SB 220 on the sale of data.

Other countries

• United Kingdom: UK GDPR and the Data Protection Act 2018.
• Switzerland: Federal Act on Data Protection (FADP).
• Australia: Privacy Act 1988, with its Australian Privacy Principles (APPs), and the Spam Act 2003.
• Canada: PIPEDA (Personal Information Protection and Electronic Documents Act), substantially similar provincial laws, and CASL on commercial electronic messages.
• Brazil: Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018).
• Mexico: Federal Law on Protection of Personal Data Held by Private Parties.
• Other Latin American countries with their own legislation, such as Argentina (Law 25.326), Colombia (Law 1581 of 2012), Chile, Peru and Uruguay.

We take the GDPR, the most demanding standard, as our reference and apply its level of protection to all our customers, wherever they live. If you live in the European Union, the GDPR protects you regardless of where our servers are located. If you live in the United States or in another country, section 13 applies to you in addition to everything set out in this policy.

3. Principles we apply

In line with Article 5 GDPR, we process your data lawfully, fairly and transparently; we collect it for specified, explicit and legitimate purposes; we limit ourselves to the data that is strictly necessary (minimisation); we aim to keep it accurate and up to date; we retain it only for as long as required; and we apply technical and organisational measures that safeguard its integrity and confidentiality.

We also keep the documentation that evidences this compliance (accountability, Article 5.2 GDPR), including the record of processing activities required by Article 30 GDPR, which we review periodically to confirm that it matches the data we actually collect and the disclosures we actually make.

4. What data we process, for what purpose and on what legal basis

We only process the data you provide and the strictly technical data generated by your browsing. We do not buy databases and we do not obtain your data from third parties.

4.1. Booking and delivery of IFÁ consultations (customers)

About payment: payment is handled entirely by the Stripe gateway. Your card details are entered in Stripe's secure environment and never pass through or get stored on our servers. We only keep the payment session reference and its outcome (paid or not paid).

4.2. Contact form

4.3. AI-powered virtual assistant

4.4. Technical visit and interaction log

4.5. Cookies and browsing data

We use strictly necessary technical cookies and, only if you accept it in the cookie notice, a preference cookie that remembers your language. Full details are in the Cookie policy (section 14).

4.6. Suppliers

4.7. Staff and collaborators

4.8. Video surveillance on the premises

If you visit our premises in person and they are fitted with security cameras, you are informed by the notice displayed in a visible area. In that case the purpose is security and access control; the data subjects are the people who access or attempt to access the premises; the recipients are law enforcement authorities; and images are kept for a maximum of one month, except for those recording potentially unlawful acts, which are made available to the competent authority within 72 hours. Staff rest areas are not filmed, and public thoroughfares are avoided as far as possible. Monitors are located in restricted-access areas.

If no cameras are used on the premises, this section does not apply.

4.9. Student area

5. Sensitive data, beliefs and health

Our services relate to a spiritual tradition. Simply booking a consultation, or the content you write to us, may therefore reveal religious or philosophical beliefs and, occasionally, references to your health — data that Article 9 GDPR treats as special categories and that the CCPA/CPRA classes as sensitive personal information.

• This data is processed solely on the basis of your explicit consent (Art. 9.2.a GDPR), which you give when you book a consultation and voluntarily provide that information, and which you may withdraw at any time.
• That explicit consent covers the sensitive information relating to your consultation being sent and received by email, by call and through the WhatsApp Business App, which are the channels we use to communicate with you. No electronic channel guarantees absolute confidentiality: if you would rather we did not use one of them, tell us and we will stop.
• It is processed only to deliver the service you requested — never for advertising, profiling or disclosure to third parties.
• Access is limited to the babalawo handling your consultation and to the person responsible for administration, both bound by a duty of secrecy and confidentiality that remains in force even after the relationship ends.
• Please do not give us more sensitive data than necessary, nor personal data about other people without their knowledge and consent.
• We do not process genetic or biometric data, or data on sexual orientation, trade union membership, or racial or ethnic origin.

6. Recipients of the data and processors

We do not sell, rent or disclose your personal data to third parties for commercial or advertising purposes. It is accessed only by the providers strictly necessary to deliver the service, acting as processors under the contract required by Article 28 GDPR, and by the bodies to which we are legally required to disclose it.

6.1. Processors

6.2. Disclosures required by law

Where legally required, we may disclose data to the Spanish Tax Agency, the Social Security General Treasury, banks and financial institutions for the management of payments and collections, our tax, accounting and employment advisers, and courts, tribunals and law enforcement authorities when they so require.

7. International data transfers

Some of our providers are located in the United States, which means international transfers outside the European Economic Area take place. These transfers rely on one of the safeguards set out in Chapter V of the GDPR:

• The European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, where the provider is certified under that framework.
• The Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, supplemented where appropriate by additional measures: encryption in transit, minimisation of the data transferred and limited retention periods.

In addition, the professionals who carry out the consultations may be located outside the European Economic Area, in countries for which the European Commission has not adopted an adequacy decision. In that case, communicating the data needed to deal with your consultation relies on its being essential for the performance of the contract you enter into with us (Art. 49.1.b GDPR) and on your explicit consent (Art. 49.1.a GDPR), which you give when you accept the order clause.

You may ask us for more information about these transfers and for a copy of the safeguards applied by writing to contacto@dicra.io.

8. Retention periods

Once these periods expire, data is erased or anonymised using secure destruction measures.

9. Your rights and how to exercise them

The law grants you the following rights over your personal data. Exercising them is free of charge.

9.1. How to exercise your rights

9.2. Response times

• We will reply without undue delay and within one month at the latest from receipt of your request.
• That period may be extended by a further two months where the request is particularly complex or where we receive a large number of requests. In that case we will tell you about the extension and the reasons for it within the first month.
• If you submit your request electronically, we will reply by the same means unless you ask otherwise.
• If we do not act on your request, we will explain why, also within one month, and inform you of your right to complain to the Spanish Data Protection Agency and to seek a judicial remedy.
• We keep evidence that we have complied with our duty to answer the requests received.

9.3. Supervisory authority

On the right of access to video surveillance images: to verify your identity we will ask for a recent photograph and a copy of your identity document, as well as the date and time range concerned. Direct access will not be given to images showing third parties; in that case you will receive a document confirming or denying the existence of images of you.

10. Artificial intelligence and automated decisions

The site's virtual assistant generates its replies automatically using a language model. However:

• We do not take automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR.
• We do not build profiles — commercial, advertising or behavioural — from your conversations or your browsing.
• The assistant's answers are indicative and may contain inaccuracies. The actual consultation is always carried out by a person, the babalawo.
• The chat interface clearly tells you that you are interacting with an artificial intelligence system and not with a person.

11. Security measures and data breaches

We apply the appropriate technical and organisational measures required by Articles 5.1.f and 32 GDPR to guarantee the integrity and confidentiality of the data, including:

Organisational measures

• A duty of confidentiality and secrecy for all staff with access to personal data, which continues even after the employment or collaboration relationship ends.
• A prohibition on disclosing data to third parties, and particular care during telephone and email enquiries.
• Locking the screen when leaving the workstation, and keeping paper documents and electronic media in a secure, restricted-access place.
• Secure destruction of documents and media (CDs, USB drives, hard disks) before disposal.
• Informing and training staff on their data protection obligations.
• Periodic review of the security measures.

Technical measures

• Unambiguous identification of each user with their own username and password, and separation between administrator profiles and everyday user profiles.
• Strong passwords of at least 8 characters combining letters and numbers, never shared or written down in accessible places.
• Encryption in transit via HTTPS/TLS across the whole site, and assessment of encryption for data taken off the premises.
• Computers and devices kept up to date, with updated antivirus software and a properly configured firewall.
• Regular backups on a device other than the one used for day-to-day work, stored securely in a separate location.
• Access keys for external services are stored outside the server's public folder and are never exposed in the browser.
• The database and data folders are blocked from direct access over the internet.

Data breaches

Should a personal data breach occur, we will notify the Spanish Data Protection Agency within 72 hours of becoming aware of it, through sedeagpd.gob.es, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk, we will also inform you without undue delay (Articles 33 and 34 GDPR). If you live in the United States, the applicable state breach notification laws will also apply.

12. Children

• Our services are aimed exclusively at people aged 18 or over. We do not provide consultations or ceremonies to minors.
• Under Article 7 LOPDGDD, consent-based processing of the data of children under 14 is lawful only with the consent of the holder of parental responsibility or guardianship.
• In line with the US COPPA, we do not knowingly collect personal information from children under 13. We also do not sell or share the personal information of consumers under 16 within the meaning of the CCPA/CPRA.
• If we find that we have collected a child's data without the necessary authorisation, we will delete it immediately. If you are a parent or guardian and believe this has happened, please write to contacto@dicra.io.

13. Privacy notices for residents of the United States and other countries

This section supplements the information above and is addressed to consumers residing in California (CCPA/CPRA) and in other states with applicable privacy legislation. In it, the terms personal information, sale and sharing have the meaning given to them by the relevant law.

13.1. Information we collect (Notice at Collection)

13.2. Sources, purposes and recipients

• Sources: directly from you, through the forms and the chat, and automatically from your device as you browse.
• Business purpose: delivering and invoicing the service you requested, communicating with you, keeping the site secure, preventing fraud and complying with legal obligations.
• Recipients: only the service providers listed in section 6, bound by contract and not permitted to use the information for their own purposes.

13.3. We do not sell or share your personal information

We also do not use or disclose sensitive personal information for purposes other than those permitted by CCPA §1798.121 — that is, solely to provide the service you requested. Even so, you may ask us to limit its use if you prefer.

13.4. Your rights

• Right to know / access: learn the categories and specific pieces of personal information we have collected about you, their sources, the purpose and the recipients over the preceding 12 months.
• Right to delete: request deletion of the personal information we have collected, subject to the statutory exceptions.
• Right to correct: request correction of inaccurate information.
• Right to opt out of sale or sharing: not applicable, as we neither sell nor share personal information.
• Right to limit the use of sensitive information: you may request it, although we already restrict ourselves to permitted uses.
• Right to data portability: receive the information in a commonly used, machine-readable format.
• Right to non-discrimination: we will not deny you service, charge you different prices or provide a different level of quality because you exercised your rights. We do not offer financial incentives in exchange for personal information.
• Right to appeal: if we decline your request and you live in Virginia, Colorado, Connecticut, Texas, Oregon, Montana or another state that provides for it, you may ask us to review our decision by replying to our communication.

13.5. How to exercise these rights

Write to contacto@dicra.io with the subject line US Privacy Request, or by post to the address in section 1. To protect your information we will verify your identity by matching the details you give us against those already in our records; for requests for specific pieces of information we may require enhanced verification. We will respond within 45 days, extendable by a further 45 days with notice. There is no charge, except for manifestly unfounded or excessive requests.

Authorised agent: you may designate a person or entity to act on your behalf. We will ask them to provide written proof of your authorisation, and we may ask you to confirm both your identity and the authorisation directly.

13.6. Browser opt-out signals

We honour Global Privacy Control (GPC) and Do Not Track signals sent by your browser. Since we do not sell or share personal information and use no advertising or analytics cookies, there is no further processing to switch off when we receive them.

13.7. Other state notices

• California — Shine the Light (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.
• Nevada (SB 220): we do not sell personal information covered by that law; you may nevertheless send us an opt-out request at the email address above.
• Commercial communications (CAN-SPAM): we only send emails relating to the service you requested. Should we ever send commercial communications, they will always include a free and effective unsubscribe mechanism.
• Retention: we keep personal information for the periods set out in section 8 and do not use it for purposes incompatible with those for which it was collected.
• Sensitive data: in states whose law requires prior consent to process sensitive data, such as Virginia, Colorado, Connecticut or Texas, that consent is the one you expressly give when you accept the order clause. You may withdraw it at any time.

13.8. Equivalent protection for all customers

We apply the GDPR level of protection to all our customers, wherever they live, taking it as our reference because it is the most demanding. Where the law of your country gives you additional or broader rights, we respect those too. In every case you may exercise your rights by writing to contacto@dicra.io. We will reply within one month, or within any shorter period set by your law.

13.9. United Kingdom and Switzerland

• United Kingdom: the UK GDPR and the Data Protection Act 2018 apply and give you rights equivalent to those in section 9. You may complain to the Information Commissioner's Office (ICO).
• Switzerland: the Federal Act on Data Protection (FADP) applies. You may request access to your data, its rectification and its erasure, and contact the Federal Data Protection and Information Commissioner (FDPIC).

13.10. Australia

We handle your personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988, to the extent they apply:

• Sensitive information: religious or philosophical beliefs and health information are collected only with your consent, which you give when you accept the order clause, and only to deliver the service.
• Overseas recipients: your information is handled outside Australia: in the European Union, in the United States and in the countries where the professionals who carry out the consultation are located.
• Access and correction: you may ask us for access to your information and for its correction. We will respond within 30 days.
• Anonymity: you may use the virtual assistant without identifying yourself. To book a consultation we need to know your identity.
• Commercial messages: we do not send you commercial messages without your consent, in line with the Spam Act 2003.
• Complaints: please write to us first. If our response does not satisfy you, you may contact the Office of the Australian Information Commissioner (OAIC).

13.11. Canada

• We handle your data in line with PIPEDA and substantially similar provincial laws, on the basis of your consent and only for the purposes we tell you about.
• You may request access to your data and its correction, and withdraw your consent.
• Your data is handled outside Canada and may therefore be subject to the laws of the countries where it is handled.
• We do not send commercial electronic messages without your consent, in line with CASL.
• You may complain to the Office of the Privacy Commissioner of Canada or to the authority of your province.

13.12. Brazil

• The LGPD (Law 13.709/2018) applies. The processing of your sensitive data relies on your specific and prominent consent, which you give when you accept the order clause.
• You have the rights in Article 18 LGPD: confirmation that processing exists, access, correction, anonymisation, blocking or deletion, portability, information about the entities with which your data is shared, and withdrawal of consent.
• The contact channel for data protection matters is contacto@dicra.io. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

13.13. Mexico and other Latin American countries

• Mexico: under the Federal Law on Protection of Personal Data Held by Private Parties, this policy serves as the privacy notice. You may exercise your ARCO rights (access, rectification, cancellation and objection), withdraw your consent and limit the use or disclosure of your data. The processing of your sensitive data relies on your express consent.
• Argentina, Colombia, Chile, Peru, Uruguay and other countries: you keep the rights of access, rectification, updating, erasure and objection that your legislation gives you, as well as the right to withdraw your consent.
• In every case you may complain to the data protection authority of your country.

13.14. Other countries

If you live in a country not mentioned here, this policy and the level of protection described in section 13.8 apply, together with the rights your legislation gives you. You may complain to the data protection authority of your country.

14. Cookie policy

This section complies with Article 22.2 LSSI-CE, Directive 2002/58/EC and the AEPD cookie guidance.

14.1. What cookies are

A cookie is a small text file that a website stores in your browser to save and retrieve information about your visit: remembering your preferences, keeping your session open or protecting a form, for example. Alongside cookies there are similar technologies, such as browser local storage, which this site does not use.

14.2. Cookies used by this site

Camino IFÁ uses strictly necessary technical cookies so that the site works and, only if you accept it, a preference cookie that remembers the language you chose. We use no analytics, advertising, profiling or social media cookies.

On your first visit we show a cookie notice with two equivalent options: Accept, which also allows the preference cookie, and Necessary only, which limits the site to technical cookies. The notice does not block browsing and, until you choose, only technical cookies are used, which under Article 22.2 LSSI-CE do not require consent. You can change your choice at any time: Cookie settings.

14.3. Third-party services without cookies

The site's typefaces are loaded from Google Fonts. This service sets no cookies, but when downloading the files your browser communicates your IP address and basic technical data to Google. See Google's privacy policy.

14.4. How to manage or delete cookies

You can allow, block or delete the cookies stored on your device through your browser settings:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Safari
• Opera

You can also browse in private or incognito mode, where cookies are deleted when you close the window.

14.5. Updates to this cookie policy

We review this list of cookies periodically and whenever we add a new service. Should we ever use analytics, advertising or any other non-exempt cookies, we would first add them to the cookie notice as optional, so that they would not be set without your consent, in line with the AEPD guidance: with equivalent options to accept, reject and configure, and with the ability to withdraw consent at any time.

15. Links to third-party sites

This site may contain links to third-party pages, such as the Stripe payment gateway or AEPD resources. When you visit them you are subject to their own privacy and cookie policies, over which we have no control. We recommend reading them before providing your data. GLOBAL TORLA is not responsible for how those third parties process your information.

16. Changes to this policy

We may amend this policy to reflect legislative or case-law changes or new services on the site. The version in force is always the one published on this page, showing the date it was last updated. If the changes substantially affect how we process your data, we will tell you through a visible notice or by email where we have your address. We recommend checking this page from time to time.

17. Legal notice (Article 10 LSSI-CE)

Intellectual property. The contents of the site (texts, images, logos and design) belong to GLOBAL TORLA or are used with due authorisation, and are protected by intellectual and industrial property law. Reproduction, distribution or transformation without express authorisation is not permitted.

Terms of use. Access to the site is free, save for the cost of your connection. Users undertake to use it in accordance with the law and in good faith, and not to introduce unlawful or harmful content or content that could damage the systems.

Prices and payments. Consultation services are purchased online through Stripe. Prices are shown in the currency indicated for each product and include applicable taxes where relevant. You will receive a confirmation email once payment is complete.

Governing law and jurisdiction. This policy is governed by Spanish law. For any dispute, the parties submit to the courts of the consumer's domicile where consumer protection law so requires. The European Commission also provides an online dispute resolution platform.

The Spanish version of this policy is the official version. In the event of any discrepancy with this English translation, the Spanish text prevails.

18. Annex: information clause for forms

The following text must appear, in line with the AEPD documentation, on every form used to collect personal data, whether on paper or on the web:

Controller: GLOBAL TORLA — NIF: B10927689. Postal address: Paseo de la Castellana, 266, Madrid. Telephone: +34 690 840 690. Email: contacto@dicra.io

"At GLOBAL TORLA we process the information you provide us for the purpose of providing the service requested and processing billing. The data provided are retained for the duration of the commercial relationship or for the period necessary to comply with legal obligations and to attend to the possible responsibilities that may arise from compliance with the purpose for which the data were collected. Data shall not be assigned to third parties unless there is a legal obligation to do so. You have the right to obtain information as to whether at GLOBAL TORLA we are processing your personal data, and therefore you may exercise your rights of access, rectification, erasure and portability of data and limitation of or objection to processing, by contacting GLOBAL TORLA, Paseo de la Castellana, 266, Madrid, or by email to contacto@dicra.io, properly identifying yourself by electronic means or by means of a signed document. Furthermore, and especially where you consider that the exercise of your rights has not been fully satisfied, you may lodge a complaint with the national supervisory authority, contacting the Spanish Data Protection Agency, Calle Jorge Juan, 6 — 28001 Madrid."

We also request your authorisation to offer you products and services related to those you have requested and to build customer loyalty: ☐ YES    ☐ NO