Privacy policy

1. Data controller

• Controller: Mouseo-a8 SL (trade name: Casita-Museo de Ratón Pérez).
• Tax ID (NIF): B87991287.
• Address: Calle Arenal, 8 - Local 14 - 1.ª planta, 28013 Madrid (Spain).
• Telephone: +34 91 522 69 68.
• Email: [email protected].

Data protection officer: we have not appointed a data protection officer.

We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and digital rights (LOPDGDD).

2. Buying tickets and products

When you buy tickets for the visit or for ‘El viaje de Pérez’, or products from the shop, we process:

• Your name and email address.
• Your telephone number, if you choose to give it, so we can tell you about any problem with your visit or order.
• Invoice details, if you ask for a full invoice: NIF or NIE, name or company name and address.
• Purchase details: tickets or products, day and time slot of the visit, amount, booking reference and payment status.
• For products delivered to your home, the delivery address.

Purpose: to process the purchase, issue and send your tickets, let you change or cancel them, prepare and ship orders, issue invoices and keep our accounts.

Legal basis: performance of the purchase contract (article 6(1)(b) GDPR) and compliance with tax and accounting obligations (article 6(1)(c) GDPR).

Payments are made by card through Stripe. The museum does not receive or store your full card number: Stripe handles it directly. For some purposes, such as fraud prevention, Stripe processes the data as an independent controller, under its own privacy policy.

We store this data in the website’s database and in Odoo, the museum’s own management system.

3. Customer area and booking look-up

You do not need a password to enter the customer area. You enter your email address and we send you a sign-in link that expires after 15 minutes. Once you sign in, we store a session cookie in your browser that lasts 30 days and is renewed while you use the area. From there you can see, change or cancel your bookings.

You can also look up a booking without signing in by giving the booking reference and the email address you used to buy. We use these two details to check that the booking is yours.

Legal basis: performance of the contract (article 6(1)(b) GDPR).

4. Emails about your visit or order

We send you by email:

• Your tickets, with their QR code.
• Confirmation of changes and cancellations.
• A reminder the day before your visit.
• Confirmation of refunds.
• After your visit, an email asking for your opinion, with a link to leave a Google review if you wish.

Legal basis: performance of the contract for emails about your purchase. For the email asking for your opinion, our legitimate interest in knowing how your visit went (article 6(1)(f) GDPR); you can ask us not to send it.

These emails are sent through Resend (Resend, Inc., USA). If you follow the link to Google and leave a review, Google processes your data under its own privacy policy; we do not share your data with Google.

5. Newsletter

We only send you the newsletter if you tick the box when you buy and then confirm your subscription from the email we send you (double opt-in).

Data: your email address and, where given, your name.

Legal basis: your consent (article 6(1)(a) GDPR).

You can unsubscribe at any time using the link in every newsletter or by writing to us. Unsubscribing does not affect your purchases.

6. School visit requests

The form at casamuseoratonperez.es/visitas-colegios must be submitted by a responsible adult from the school. We collect:

• Name of the school and of the contact person.
• Email address and telephone number.
• School year, number of pupils and accompanying adults.
• Preferred dates and transport.
• Specific needs of the group.

The specific needs field may include information about a pupil’s health or disability. Please give only what we need to organise the visit and do not include pupils’ names.

Purpose: to assess the request, propose a date and organise the visit.

Legal basis: steps taken at the request of the data subject before entering into a contract (article 6(1)(b) GDPR).

We store these requests in Odoo, the museum’s management system.

7. Enquiries by email or telephone

If you write to [email protected] or call us, we use your details to reply. Legal basis: our legitimate interest in answering your enquiries or, if they relate to a purchase, performance of the contract.

8. Website security and spam protection

To prevent abuse, we use IP addresses to limit repeated attempts (for example, too many sign-in link requests in a short time). We keep this information for a short time only.

On the school form we use Cloudflare Turnstile (Cloudflare, Inc., USA). This service processes your IP address and some browser signals solely to tell people apart from bots.

Legal basis: our legitimate interest in protecting the website and its users (article 6(1)(f) GDPR).

The museum does not make decisions based solely on automated processing that have legal effects on you. Stripe applies its own automated checks to prevent payment fraud.

9. Children

Purchases and the customer area are only for people aged 18 or over.

Children under 14 may not give us personal data. Under article 7 of the LOPDGDD, processing the data of children under 14 on the basis of consent requires the consent of their parents or guardians. If we find that we have received data from a child under 14 without that consent, we will delete it.

For school visit requests, the person submitting the form is the responsible adult from the school.

10. How long we keep data

• Purchase and invoice data: for the duration of the contract and then 6 years, as required by article 30 of the Spanish Commercial Code. Data relevant for tax purposes is kept for at least 4 years, the limitation period under the General Tax Law.
• Customer area sign-in links: expire after 15 minutes.
• Customer area session: 30 days from last use.
• Newsletter: until you unsubscribe.
• School visit requests: as long as needed to arrange the visit.
• IP addresses used to limit attempts: a short period.
• Email enquiries: as long as needed to answer them and, if linked to a purchase, for the same period as that purchase.

After these periods, we block the data while legal liabilities may arise and then delete it.

11. Who else processes your data

We do not sell or pass on your data to third parties, except where the law requires it (for example, to the tax authorities or the courts).

The following providers process data on our behalf (processors), under contract and only to provide their service to us:

• Stripe Payments Europe Ltd. (Ireland): card payments.
• Resend, Inc. (USA): sending emails about your purchase.
• Cloudflare, Inc. (USA): spam protection on the school form and, where applicable, content delivery network and DNS.
• OVH SAS (France): hosting of the website and Odoo.

Google only receives your data if you follow the link to leave a review. No Google content is embedded in the website.

12. International transfers

Some providers are based in the United States or may access data from there. We only allow this with the safeguards in Chapter V of the GDPR: the provider’s certification under the EU-US Data Privacy Framework or, failing that, the standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards.

13. Third-party content on the website

• Map on the ‘How to get here’ page: it loads from openstreetmap.org. When you view it, your browser sends your IP address to OpenStreetMap. It does not set cookies.
• Videos on the press page: nothing is loaded from YouTube until you press the play button. When you do, the video loads from youtube-nocookie.com and YouTube may store cookies or data in your browser’s local storage.

More details in the cookie policy.

14. Your rights

You can exercise these rights at any time:

• Access: find out what data about you we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to stop using your data for a time, for example while we look into a complaint.
• Portability: receive the data you gave us in a structured, commonly used format.
• Withdraw any consent you have given, without affecting what was done before.

To exercise them, write to [email protected] with the subject ‘Protección de datos’, or by post to our address. If we cannot confirm your identity from the email address you write from, we will ask you for proof of identity. We will reply within one month, which may be extended in the cases provided for in the GDPR.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency, AEPD (www.aepd.es).

15. Security

We apply technical and organisational measures to protect your data: encrypted connections (HTTPS), restricted access to our systems, one-time sign-in links that expire, and limits on repeated attempts.

16. Changes to this policy

We may update this policy if the law or the way we process data changes. The version in force will always be published on this page and, if the change is significant, we will point it out clearly.