Privacy | Spa Atlas Europe

Who is responsible for your data

The controller for the processing described in this notice is:

Mažoji bendrija Renginių komanda
Lūšių g. 21
LT-30202 Palūšės k., Ignalinos r., Lithuania
renginiukomanda@gmail.com

Full operator details are on the imprint page.

Browsing the website

The public website does not require a visitor account. Hosting and security providers necessarily process technical request data such as an IP address, browser or device information, the requested page, referral information and the time of the request in order to deliver the site, protect it and diagnose faults.

This essential processing is based on the controller’s legitimate interests under Article 6(1)(f) GDPR: operating a reliable and secure website, investigating faults and preventing abuse. These technical logs are not used to build advertising profiles.

Using the Spa Finder

Finder selections are processed in your browser against the published spa dataset. Selected filters can appear in the page URL so the view can be refreshed or shared. The finder does not ask for a name, email address or payment details.

External and affiliate links

When you follow a link to a spa, booking platform or activity provider, you leave Spa Atlas Europe. The destination receives the technical request information normally sent when opening a link and handles data under its own privacy notice. Affiliate links can also include referral information needed to attribute an eligible booking or purchase.

Google AdSense runs only on selected editorial pages and also delivers Google’s certified Privacy & messaging consent platform. Google and the advertising partners named in that message may receive the page URL, IP address, referrer, browser, device and network information, approximate location, ad-slot information, privacy signals, permitted pseudonymous identifiers, and information about ad views or interactions. They use this information to request, select, deliver and measure advertising, limit repetition, prevent fraud and maintain the advertising service.

For visitors in the EEA, United Kingdom and Switzerland, the consent platform communicates choices using IAB Europe TCF v2.3. Personalised advertising requires the relevant consent. Without it, Google may show non-personalised or limited ads, or no ads, depending on the available permissions and settings. The consent message shows the current purposes, legal bases and participating vendors before a choice is made.

Optional measurement

Google Analytics 4 is optional and is downloaded only on an AdSense-enabled editorial page after Google’s consent platform reports that Analytics is allowed. If allowed, Google can set a first-party pseudonymous client identifier and receive the page path and title, referrer, approximate location, browser and device details, session information, listing views and clicks on official or affiliate links. Analytics does not load on AdSense-excluded pages. We do not send names, email addresses, free text or payment details, and we disable Google Signals and use of Analytics data for advertising personalisation.

When an AI assistant supplies an identifiable referral hostname, optional measurement can classify that visit using a short allowlisted source label. It does not send the full referring URL or query, and it cannot identify Google AI features that arrive as ordinary Google organic traffic.

If the optional feedback card appears, a response of “Yes”, “Partly” or “Not yet” and the current page path are sent as a Google Analytics event. Optional measurement and feedback are based on consent under Article 6(1)(a) GDPR.

Consent choice and withdrawal

Google’s consent platform stores and communicates the consent information needed to remember advertising and Analytics choices. After the optional feedback card is answered or dismissed, “sae.feedback.v1” stores only that state and its date for up to 180 days so the card is not repeated. “sae.consent.v4” applies only to separately offered services such as affiliate attribution. These local-storage records are not used to identify you.

“Privacy settings” in the footer reopens Google’s choices at any time; from an AdSense-excluded page it first opens an eligible site page. Changing or withdrawing consent updates future AdSense and Analytics behaviour. Where the browser permits, the site removes its first-party Analytics cookies after Analytics consent is withdrawn. Withdrawal does not affect the lawfulness of processing that occurred before it.

Data retention and service providers

Hostinger supplies hosting and processes request and security data on the controller’s behalf. Technical logs are kept only for as long as they remain necessary and available for site delivery, security, fault investigation or a legal obligation.

After consent, Google supplies Analytics processing. The site’s first-party “sae” Analytics cookies have a non-refreshing maximum age of 180 days. Google Analytics Standard controls retain user- and event-level data for no more than 14 months; aggregated reports may remain longer.

Google supplies AdSense and the Privacy & messaging consent platform. Google and participating advertising partners process advertising data under the purposes and legal bases shown in that platform.

These providers can use subprocessors and process data outside the European Economic Area. Their terms describe applicable safeguards, which can include an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses.

Spa Atlas Europe does not receive payment-card details for bookings completed on third-party websites.

Your choices

You can reset Finder filters at any time. You can avoid external links and use a spa’s official contact channels directly. Advertising and optional measurement follow the choices made in Google’s consent platform, which you can reopen through the footer privacy settings.

Your rights

Where the GDPR applies, you can ask the controller for access to personal data held about you and for its correction, erasure or restriction. You can object to processing based on legitimate interests and ask for data you provided in a portable format. Requests can be sent to renginiukomanda@gmail.com.

You also have the right to complain to the data protection supervisory authority in your country of residence, work or of the alleged infringement. The operator’s lead authority is Lithuania’s State Data Protection Inspectorate. Open the authority website.

Changes to this notice

This notice may be updated when the website’s services or data practices change. The revision date on this page identifies the current version.

Privacy questions

For a privacy question or data request, contact renginiukomanda@gmail.com. Please do not include payment-card or medical information.