Privacy
What data you give us when you place an order or leave us an intention, what we use it for and when we delete it.
Provisional text pending review
It must be reviewed by the parish’s adviser before the campaigns open. Draft dated 1 November 2026.
Who processes your data
This English version is a courtesy translation. The Catalan and Spanish versions are the legally binding ones.
The Parish of Sant Mateu, in Barcelona (address: Via Favència, 80). For anything to do with your data, write to us: to be confirmed.
What data we ask for in an order
Your first name and surname(s), your mobile phone number and, if you wish, your email address. If the order is from a company, also the company name. If you ask us to deliver it, the address, the postcode and where and whom we should notify.
If you’d like the donation certificate or, as a company, an invoice, also your NIF, NIE or CIF (Spanish tax ID numbers), your full name or company name, and your tax address.
What we use it for
Only to manage your order: to prepare it, let you know about the collection or the delivery, find your payment and, if you’ve given us your email address, send you the confirmation. We don’t use it for anything else, we don’t sell it or pass it on to anyone, and we won’t send you advertising.
We need it to manage the order you place with us: the donation and the item you take home in return (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
Your tax details, only if you ask for the certificate or the invoice: the parish uses them to issue it to you and to report it to the Spanish Tax Agency (Hacienda), as the law requires (Article 6(1)(c) GDPR).
How long we keep it
While the campaign is open and for three months after it closes, in case there are any questions about the order. After that, we anonymise it: we delete the name, phone number, email address, postal address, company and tax details, and only what is needed for the accounts remains. The parish keeps a copy of the certificate and of the return filed with the Tax Agency for as long as the law requires.
The intentions in “Travel with us”
Leaving us an intention for us to take to Seoul is optional, and we only store it if you expressly tick that you agree: we do so with your explicit consent (Article 9(2)(a) GDPR). A prayer intention may reveal your beliefs and, sometimes, health data, which are specially protected categories of data (Article 9 GDPR).
In the website’s panel, only the group’s coordinators can see them, and they review them. Afterwards, the group going to Seoul reads them, takes them there and prays for them. Your first name will only appear in “Already travelling with us” if you’ve ticked that box, and the intention will only be published on the website, without your name, if you’ve ticked that too.
We delete all intentions on 30 September 2027, after the trip. You can withdraw your consent whenever you like, and we’ll delete it sooner.
Who has access
The people in the group who handle the orders, from a panel with a username and password. Those who only prepare or deliver hampers can’t see the intentions.
The data is stored with the technical services that make the website work (hosting, the database and email delivery), which process it on our behalf. Which services they are and where they store the data: to be confirmed.
If you accept visit measurement, Google Ireland Limited receives the Google Analytics browsing data on our behalf (we explain this under “Cookies”).
Your rights
You can ask us to see your data, correct it, delete it, restrict its use or object to it, take it with you, and withdraw your consent for the intention. Write to us: to be confirmed.
If you think we haven’t handled it properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Cookies
We use technical cookies, which are essential for the website to work, such as the basket cookie, which remembers which hampers you’ve added, or the panel session cookie, which only the team uses. And, only if you accept them in the cookie banner, Google Analytics cookies, to count visits in aggregate.
Visit measurement is based on your consent (Article 6(1)(a) GDPR and Article 22(2) of the LSSI, the Spanish law on information society services). Google Ireland Limited receives the browsing data as a data processor and may process it in the United States, under the EU–US Data Privacy Framework. You can withdraw your consent whenever you like from “Cookie settings”, at the foot of the page: we stop measuring and delete its cookies.
In addition, your browser stores on your device the last common fund figure you saw, so we can tell you how much it has gone up since your last visit. It never leaves your device and never reaches us.
On the WYD page there is a YouTube video that doesn’t load until you play it. When you play it, YouTube may store cookies in your browser: it does so under its own terms, not ours.