Last updated: 22 September 2026

This policy explains what personal data we collect through this website and through the Rockstar Benidorm app, why, who else sees it and what you can do about it.

Who is responsible

Name: Varekai Gestión S.L., trading as Rockstar Benidorm
Tax ID: B54391719
Registered address: Calle Gerona 15, 03503 Benidorm (Alicante), Spain
Contact for data protection: hello@rockstarbenidorm.com
Data Protection Officer: none appointed. Our processing does not require one; write to the address above and a person will answer.

What we collect, and why

Contact form

Your name, email address and the message you write. We use it to answer you and nothing else.

Your email address. We use it to send you the newsletter you asked for. Signing up is confirmed by a double opt-in: you are not subscribed until you click the link in the confirmation email, and every email we send carries an unsubscribe link.

Quote builder and event enquiries

Your name, email address and phone number, plus the details of the event you are asking about — date, time, number of guests, the menu and bar options you selected, and any notes you add. We use it to prepare your quote and to contact you about it. We ask for a phone number because party enquiries are answered by calling.

Professional forms

The forms for artists, venue hire, agencies and careers collect the contact and professional details each one asks for. The careers form also accepts a CV. Attached files are sent straight to our inbox by email and are not stored in any database of ours.

Deposits

If you reserve a date, the card payment is taken by SumUp on SumUp’s own pages. We never see, handle or store your card number. What comes back to us is a reference and whether the payment succeeded.

The app and your members’ card

If you create an account in the Rockstar Benidorm app we collect your name, your email address and your date of birth, and we issue you a card number. Your password is handled by Google Firebase; we never see it.

While you hold a card we record what you spend with us — the totals of your own till tickets, from the moment the card is scanned — and which nights you came. Those two things are what your points, your level and your streak are calculated from. We also keep any credit we have put on your card and the short note that says what it was for. We do not record what you ordered.

Your date of birth is there for two reasons: so we can buy you a drink on your birthday, and because a members’ card for a licensed venue has to know you are over 18. It is never shown in the app and never leaves us.

If you allow notifications, we keep a code that lets us send them to your phone. Unless you ask for more, we use it for one thing: a reminder on your birthday. News of new concerts is a separate choice, off until you switch it on in the app, and you can switch it off there at any time; we keep the date you last changed it. Signing out removes your phone from your account.

Our legal basis

Answering your enquiry or preparing your quote — steps taken at your request before a contract, and our legitimate interest in responding to people who contact us.
Newsletter — your consent, which you can withdraw at any time.
New-concert notifications in the app — your consent, which you can withdraw in the app at any time.
Fraud prevention on our forms — our legitimate interest in keeping them usable. See the cookie policy for what reCAPTCHA involves.
Bookings, deposits and invoicing — performance of a contract and our legal obligations.
Your members’ card, your points and your credit — performance of the membership terms you accept when you create an account in the app. They are in our Legal Notice.
Counting visits — your consent, given in the cookie banner and withdrawable there at any time. Nothing is loaded until you give it.

How long we keep it

Enquiries and quotes: 90 days from the last time we heard from you, unless the enquiry becomes a booking.
Booking and payment records: six years. That is the minimum the Spanish Commercial Code sets for accounting records; tax law asks for four.
CVs and job applications: one year, after which we delete them unless you have asked us to keep you on file.
Newsletter: until you unsubscribe, which removes you from the list.
Your members’ card: for as long as you have an account. Deleting it in the app closes the account and stops the card immediately; write to us at the address above and we erase the membership record behind it as well. The venue’s own sales records are separate from it and are kept for the six years above.

Who else sees your data

We use the following service providers. Each one only receives what it needs to do its job, and none of them is permitted to use your data for their own purposes.

Cloudflare — hosting and content delivery for this website.
Sanity — the content management system behind the site’s text and images.
Google (reCAPTCHA) — spam and bot protection on our forms. United States. See the cookie policy.
Resend — delivers the emails our forms generate, and the newsletter. United States.
Google Sheets — event enquiries are recorded in a spreadsheet we control, so that nothing is lost between the enquiry and the reply. United States.
Google (Analytics and Tag Manager) — counts visits, but only for people who accept analytics in the cookie banner. United States. See the cookie policy.
Metricool — also counts visits, under the same analytics choice. Spain. See the cookie policy.
SumUp — takes deposit payments on its own pages. European Union.
Google (Firebase) — accounts, sign-in, notifications and the members’ database behind the app. United States.
Numier — the venue’s till system. It holds the sales your points are counted from, and the customer record we create for your card. Spain.

We do not sell your data, and we do not share it with anyone for advertising.

Transfers outside the EU

Some of the providers above are based in the United States, which means your data is transferred there. Each of them offers a data processing agreement incorporating the European Commission’s Standard Contractual Clauses, and those are the terms we are on with Google, Resend and SumUp.

Your rights

Under the GDPR you can ask us to:

give you a copy of the personal data we hold about you;
correct it if it is wrong;
delete it;
restrict or object to how we use it;
send it to you, or to someone else, in a portable format;
and withdraw any consent you have given, without that affecting what came before.

Write to us at the address above and we will answer. If you are not satisfied with how we handle it, you can complain to the Spanish Data Protection Agency at www.aepd.es.

Automated decisions

We do not profile you and we make no automated decisions that have any legal or similarly significant effect on you. Quote prices are calculated from the options you select and the venue’s published rates — the same inputs produce the same figure for everybody. Your points and your level in the app are counted the same way, from your own till tickets and the published thresholds, and nothing about you is inferred from them.

Age

This is a music venue with licensed bars. The site is not intended for children, and we do not knowingly collect data from anyone under 18.

Changes to this policy

If this policy changes, the date at the top of the page changes with it.