Privacy Policy

Controller and contact details

GOGOCHAMELEON SL (the «Controller», pursuant to Art. 4(7) GDPR), with registered office at C. Mar Blanco, 6, 3ª planta - local 316, 35100 San Bartolomé de Tirajana, Las Palmas (Spain).

Contact email: management@oceanworking.com.

Purposes of processing, legal basis, data processed and retention period

The Controller processes personal data for the purposes set out below, which also indicate the legal basis and the duration of the processing.

Should the User prefer not to provide the data that is mandatory or necessary for certain purposes, the Controller reserves the right not to provide the relevant service. The User may request clarification on the legal basis of each processing operation at any time.

Processing is carried out using IT and/or manual tools, with security measures suitable to prevent unauthorised access, disclosure, loss and incorrect or unlawful use of the data.

Recipients of the data

Personal data may be shared with service providers acting on the Controller's behalf as tools for organisation, communication and security. These providers are appointed as Processors pursuant to Art. 28 GDPR. The main ones are:

• Hosting, database and server functions of the site (Supabase);
• Delivery of the emails generated by the contact forms (Resend);
• Anti-bot protection of the forms and the restricted area (hCaptcha);
• Interactive maps, loaded only after a click by the User (Google Maps);
• Reviews widget, loaded only after a click by the User (Elfsight);
• Booking of spaces and calls (Setmore).

Data is also processed by authorised internal staff pursuant to Art. 29 GDPR; the list of authorised staff is available on request by writing to management@oceanworking.com.

Place of processing and transfers outside the EU

Personal data is processed at the Controller's premises and on the servers hosting the oceanworking.com website, located in the European Union. Some of the providers indicated above (for example the email delivery service and the maps) may also process data in countries outside the European Economic Area.

In such cases, the transfer takes place in compliance with the GDPR, on the basis of European Commission adequacy decisions or standard contractual clauses (SCCs) or other appropriate safeguards provided for by law.

Data subject rights

The User may exercise at any time, free of charge and without unjustified restrictions, the rights set out in Arts. 15-21 GDPR by writing to management@oceanworking.com. Requests are handled within 30 days. In particular, the User may:

• obtain confirmation that processing is taking place (Art. 15);
• obtain rectification of inaccurate or incomplete data (Art. 16);
• obtain erasure of the data without undue delay (Art. 17);
• obtain restriction of processing (Art. 18);
• receive their data in a structured, commonly used and machine-readable format, and transmit it to another controller (Art. 20);
• object at any time to the processing of personal data (Art. 21).

Where processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Complaints

The User may lodge a complaint with the competent supervisory authority — in Spain, the Spanish Data Protection Agency (AEPD, www.aepd.es), or the authority of their country of residence — pursuant to Art. 77 GDPR, if they believe that the processing of their data infringes applicable law.

Changes

The Controller reserves the right to modify and update this Policy following any new national or European data protection legislation. Changes will be published on this page.