Privacy Policy

Effective Date: 08/24/2026

Introduction

We, at IRT Attractions Consulting, S.L.U., are dedicated to serving our customers and contacts to the best of our abilities. Part of our commitment involves the responsible management of personal information collected through our website ridetraining.com, and any related only presence and application. Below, we would like to provide the visitors of our website and/or one of our other digital presences as well as users of our digital services with transparent and detailed information about how we process their personal data.

It is our policy to process personal information with the utmost respect for privacy and security. We adhere to all relevant regulations and guidelines to ensure that the data we handle is protected against unauthorized access, disclosure, alteration, and destruction. Our practices are designed to safeguard the confidentiality and integrity of your personal information, while enabling us to deliver the services you trust us with. Your privacy is our priority. We are committed to processing your personal information transparently and with your safety in mind. This commitment extends to our collaboration with third-party services that may process personal information on our behalf, such as our newsletter tool provider, our event management platform provider and our website and training platform hosting providers. All activities are conducted in strict compliance with applicable privacy laws.

In the next section, you will find basic information regarding responsibilities and our main objectives when processing your personal data. In the second section, you will find a summary of what data we process from you, for what purposes, and how we do so. If you would like further information, the third section provides full details on individual processing activities, including the technologies and service providers used, as well as the relevant legal basis. In the final section, we explain your rights and how you can exercise them.

Part 1: Organizational info and processing purposes overview

Controller/responsible entity

The entity which alone or jointly with others determines the purposes and means of the processing of personal data is:

IRT ATTRACTIONS CONSULTING, S.L.U., a Spanish company, with N.I.F. B88876271, with offices in Plaza de las Cortes 5, 2nd floor, 28014, Madrid

Designated DPO

We do have a designated Data Protection Officer (DPO).

Jasmin Sieger, M.A.
Erich-Sailer-Str. 50
74206 Bad Wimpfen, Germany

Should you have any questions or require further information about how we manage personal information, please feel free to contact us at irtprivacy@ridetraining.com. If you want to contact our DPO directly, please write to sieger@grcon.de

Main purposes of the processing

Our primary goals in processing your personal information are:

  • Presentation of our company and our services, which automatically involves the processing of personal data in connection with website hosting and our social media presences.
  • Providing timely support, staying in touch and responding to inquiries or service requests by offering a contact form, a newsletter, social media presences and the possibility to contact us via phone and email.
  • Enhancing the user experience on our platform by understanding customer needs and preferences by using analytics/tracking (only if you consent to) and a consent management.
  • Ensuring the security of our website by collecting server log files and using secure connections.

Part 2: Key information on our data processing practices

Scope and application

Our privacy policy is designed to protect the personal information of all our stakeholders, including website visitors, registered users, and customers. Whether you are just browsing our website ridetraining.com, using our services as a registered user, or engaging with us as a valued customer, we ensure that your personal data is processed with the highest standards of privacy and security. This policy outlines our practices and your rights related to personal information.

Data collection and processing

Our commitment to transparency and data protection extends to how we collect and use your personal information. We gather personal data through various interactions, including but not limited to, when you utilize our services or products such as Safety Consulting, Training, Auditing, Certification for the Attractions Industry, or directly provide information to us.

The following list details the types of personal information we may process via our website or related services:

  • Personal/contact information, such as first and last name, contact details, address, job title, company
  • Log file data, such as IP address, browser type
  • Communication data, such as messages, comments
  • Analytics/tracking data, such as interaction and usage behavior, approximate location

Please note, that we only process information that is essential for delivering our services, complying with legal obligations, or enhancing your user experience. Your privacy is paramount, and we are dedicated to handling your personal information responsibly and in accordance with all applicable laws.

At IRT Attractions Consulting, S.L.U., we believe in using personal information responsibly and ethically. The data we collect serves multiple purposes, all aimed at enhancing the services we offer and ensuring the highest level of satisfaction among our users, customers, and employees. Here are the key ways in which we use the personal information collected:

  • Content delivery
  • Communication efforts
  • Analytics and performance tracking
  • Compliance with legal obligations
  • Customer support
  • User engagement and retention
  • Fraud prevention and risk management

Your privacy is our priority. We process your personal information transparently and in accordance with your preferences and applicable privacy laws. We are committed to ensuring that your data is used solely for the purposes for which it was collected and in ways that you have authorized.

Retention period

We delete personal data when it is no longer needed for the purpose for which it was collected and there are no legal requirements preventing its deletion. In addition, we may continue to retain personal data if required by law or if we still need the personal data in connection with maintaining records or asserting, exercising, or defending legal claims.

Data storage and protection

Data storage

  • Personal information is stored in secure servers located in the following locations: USA, Canada, Denmark, Switzerland. Due to subprocessors of our service providers your personal data might also be stored in other locations outside of the EU/EAA (for more details see Part 3 of this privacy policy). For services that require international data transfer, we ensure that such transfers comply with all applicable laws and maintain data protection standards equivalent to those in our primary location.
  • Data hosting partners: We partner with reputable data hosting providers committed to using state-of-the-art security measures. These partners are selected based on their adherence to stringent data protection standards.

Data protection measures

  • Encryption: To protect data during transfer and at rest, we employ robust encryption technologies. When you enter personal data on our website or connected services, SSL/TLS encryption is used. SSL/TLS encryption ensures that personal data collected via a website is not visible in plain text and therefore cannot be intercepted or read by unauthorized third parties. Moreover, offsite backups of our website server are encrypted in transit and at rest.
  • Access protection: Logins on our website are protected by state-of-the-art security measures, namely multi-factor authentication.
  • Access control: Access to personal information is strictly limited to authorized personnel who have a legitimate business need to access the data. We enforce strict access controls and regularly review permissions.
  • Security audits and monitoring: Regular security audits are conducted to identify and remediate potential vulnerabilities. We also monitor our systems for unusual activities to prevent unauthorized access.

Data sharing and disclosure, Transfer to Third Countries

At IRT Attractions Consulting, S.L.U., we are committed to safeguarding your personal information and ensuring it is treated with the utmost respect. This commitment extends to how we handle the sharing and disclosure of your data.

Third-party service providers: We may share your information with third-party service providers who perform services on our behalf. Such trusted parties may have access to personally identifiable information on a need-to-know basis and will be contractually obliged to keep your information confidential. These partners are prohibited from using your personal information for any purpose other than to provide these services to IRT Attractions Consulting, S.L.U., and they are required to maintain the confidentiality of your information.

Data processing agreements

When we share your data with third-party service providers, we do so under the protection of Data Processing Agreements (DPAs) that ensure your information is managed in accordance with GDPR and other relevant data protection laws. These agreements mandate that third parties implement adequate technical and organizational measures to ensure the security of your data.

International data transfers

At IRT Attractions Consulting, S.L.U., we may transfer your personal information to locations outside of your country of residence, including to countries that may have different data protection laws than those in your jurisdiction. We want to assure you that any such transfers are conducted with the utmost care and in compliance with applicable data protection regulations, including the General Data Protection Regulation (GDPR). When data is transferred to third countries that do not meet data protection standards, an adequate level of data protection is ensured, for example through the use of standard contractual clauses (Art. 46 (2) (c) GDPR) or an adequacy decision by the European Commission (Art. 45 GDPR).

Cookies and tracking technologies

At IRT Attractions Consulting, S.L.U., we value your privacy and are committed to being transparent about our use of cookies and other tracking technologies on our website ridetraining.com. These technologies play a crucial role in ensuring the smooth operation of our digital platforms, enhancing your user experience, and providing insights that help us improve.

Understanding cookies and tracking technologies

Cookies are small data files placed on your device that enable us to remember your preferences and collect information about your website usage. Tracking technologies, such as web beacons and pixel tags, help us understand how you interact with our site and which pages you visit.

Possible types of cookies

  • Essential cookies: Necessary for the website’s functionality, such as authentication and security. They do not require consent.
  • Performance and analytics cookies: These collect information about how visitors use our website, which pages are visited most frequently, and if error messages are received from web pages. These cookies help us improve our website.
  • Functional cookies: Enable the website to provide enhanced functionality and personalization, like remembering your preferences.
  • Advertising and targeting cookies: Used to deliver advertisements more relevant to you and your interests. They are also used to limit the number of times you see an advertisement and help measure the effectiveness of the advertising campaign.

Your choices and consent

Upon your first visit, our website will present you with a cookie consent banner, where you can:

  • Accept all cookies: Consent to the use of all cookies and tracking technologies.
  • Reject non-essential cookies: Only essential cookies will be used to provide you with necessary website functions.
  • Customize your preferences: Choose which categories of cookies you wish to allow.

We currently use the following cookies:

Cookies Currently Used

CookieConsent

Type of cookie: Essential

Name: CookieConsent

Service: Cookiebot Usercentrics Consent Tool

Storage Duration: 1 year

_ga

Type of cookie: Performance and analytics

Name: _ga

Service: Google Analytics

Storage Duration: 2 years

_ga_#

Type of cookie: Performance and analytics

Name: _ga_#

Service: Google Analytics

Storage Duration: 2 years

Direct marketing and communications

At IRT Attractions Consulting, S.L.U., we may use your personal information to send you direct marketing communications about our products, services, promotions, and other relevant information that we believe may be of interest to you. We are committed to ensuring that our direct marketing practices are transparent, lawful, and in compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the ePrivacy Directive.

Obtaining consent for direct marketing

  • Opt-in consent: We will obtain your explicit opt-in consent before sending you direct marketing communications, where required by law. This means that you will have the opportunity to actively consent to receiving marketing messages from us before we send them to you.
  • Unsubscribe option: Every direct marketing communication we send will include clear instructions on how to unsubscribe or opt-out from receiving future marketing communications. You can exercise your right to opt-out at any time, and we will promptly honor your request to stop sending you marketing messages.

Types of direct marketing communications

We may use your personal information to send you direct marketing communications via email. These emails also contain tracking technology and show us, for example, which links you click on in our promotional emails. Learn more about this in Part 3.

Managing your preferences

You have control over the direct marketing communications you receive from us. You can manage your communication preferences by using the unsubscribe link provided in our marketing emails or text messages.

Part 3: Detailed information on specific processes

Below, you can find details about each individual processing operation. These include:

  • Collected Personal Data Types
  • Legal basis
  • Retention period
  • Participating Service Providers/Recipient
  • Privacy Policy Link of the Service Provider
  • Third Country Transfer and transfer mechanism applied

Website Hosting

Description: Our website is hosted on an external server and when you visit our website log files of your visit will be recorded.

Purpose(s):

  • Make the website available
  • Website safety, detection and prevention of attacks, monitoring of unusual activity

Collected Personal Data Type(s): Server logfiles: IP address, URL accessed, date and time of access, amount of data transmitted, previously visited URL, device type, browser used

Legal Basis: Art. 6 (1) (f), legitimate Interest

Retention period: 7 days

Participating Service Providers/Recipient: Greenlight Websites | 9 Dale Lane, Steep Falls, ME

Privacy Policy Link of the Service Provider: https://greenlightwebsites.com/privacy-policy/

Third Country Transfer Transfer Mechanism applied:

  • USA, Switzerland (through subprocessor)
  • Transfer mechanism:
    • Standard Contractual Clauses by the EU commission
    • Switzerland: Adequacy decision by the EU commission

Consent Management

Description: You can choose if you want to accept cookies and technologies that are not technically necessary for the website. You can choose which of the technically unnecessary cookies you want to accept. You can set your preferences and change them at any time.

Purpose(s):

  • Efficient management of consent for cookies, tracking, and related data transfers to service providers
  • Fulfill legal obligations
  • Proofing consent

Collected Personal Data Type(s):

  • IP address
  • Consent ID
  • Date and time of consent
  • chosen consent configuration (categories accepted/rejected, opt-in-status, changes/revocation)
  • Technical browser/device data (such as user agent, referrer URL, accessed URL).

Legal Basis:

  • Art. 6 (1) (c) GDPR, legal obligations
  • In conjunction with Art. 6 (1) (f) GDPR, legitimate interest

Retention period: 12 months

Participating Service Providers/Recipient:

  • Cookiebot
  • Usercentrics A/S
  • Havnegade 39
  • 1058 Copenhagen
  • Denmark

Privacy Policy Link of the Service Provider: https://www.cookiebot.com/en/privacy-policy/

Third Country Transfer Transfer Mechanism applied:

  • Possible transfer to USA through subprocessors
  • Transfer mechanism:
    • EU-US-Privacy Framework and Standard Contractual Clauses by the EU commission.

Contact form

Description: You can use our contact form or contact us via phone and mail.

Purpose(s):

  • Enable responsiveness
  • Enable and process requests and inquiries

Collected Personal Data Type(s):

  • Company
  • First and last name
  • Email address
  • Message
  • Optional:
  • Phone number

Legal Basis:

  • Art. 6 (1) (f) GDPR, legitimate interest
  • If you are one of our clients, your message may also fall under Art. 6 (1) (b) GDPR, performance of a contract.

Retention period:

  • Contact form content: 7 days on our webserver
  • Forwarded mail with contact form content: 6 years

Participating Service Providers/Recipient:

  • Greenlight Websites | 9 Dale Lane, Steep Falls, ME
  • One Microsoft Place
  • South County Business Park
  • Leopardstown
  • Dublin 18, D18 P521
  • Ireland

Privacy Policy Link of the Service Provider:

Third Country Transfer Transfer Mechanism applied:

  • USA
  • Microsoft Exchange Online (cloud); data location set to EU, but worldwide transfers cannot be fully excluded
  • Transfer mechanism:
    • Standard Contractual Clauses by the EU commission
    • Additional in the case of Microsoft: EU-US-Privacy Framework

Newsletter and information mails

Description: You can subscribe to our newsletter on the website. We will track user behavior when you open and interact with the newsletter.

Purpose(s):

  • Content delivery
  • Communication efforts
  • Marketing and advertising
  • Providing access to exclusive content
  • User engagement and retention

Collected Personal Data Type(s):

  • First and last name
  • Email address
  • Optional: job title
  • Optional Company
  • Tracking in newsletters and info mails:
  • Email opens (via tracking pixel)
  • Links clicked
  • Which links were clicked
  • Time of open
  • Device used
  • Bounce status
  • Unsubscribes
  • Spam complaints

Legal Basis: Art. 6 (1) (a) GDPR, consent

Retention period: Until revocation or 30 days after the end of a contract with a customer

Participating Service Providers/Recipient: Constant Contact, Inc. 890 Winter Street, Suite 300, Waltham, Massachusetts 02451, USA.

Privacy Policy Link of the Service Provider: https://www.constantcontact.com/legal/customer-contact-data-notice

Third Country Transfer Transfer Mechanism applied:

  • USA, India, Mexiko, UK
  • Transfer mechanism:
    • EU-US-Privacy Framework, Standard Contractual Clauses by the EU commission

Google Analytics

Description: If you give us your consent we will collect and analyze your personal data in order to improve our website (e.g. technically, content wise).

Purpose(s):

  • Marketing and advertising
  • Analytics and performance tracking
  • Analysis of website visitor behavior and technical performance of our website
  • Website and content optimization

Collected Personal Data Type(s):

  • Traffic source (what brought the users to the site)
  • Device/operating system
  • Language setting
  • Type of browser
  • Location (approximate geo location)
  • User behavior (selected user journeys)
  • Events (key interactions)
  • Session duration (how long a user stays on the site)
  • Scroll tracking (how far on the page the user scrolls)
  • Referral Data (which sites linked to our site)

Legal Basis:

Retention period:

  • 2 months for User and Event Data
  • The cookies themselves remain on your device for up to 2 years if you don’t delete them earlier.

Participating Service Providers/Recipient:

  • Google Ireland Limited
  • Gordon House, Barrow Street
  • Dublin 4
  • Ireland

Privacy Policy Link of the Service Provider:

Third Country Transfer Transfer Mechanism applied:

  • USA
  • Transfer Mechanism:
    • EU-US-Privacy Framework, Standard Contractual Clauses by the EU commission

Privacy-friendly configurations of tools (Wordfence, Gravity Forms, Divi theme)

We use the Wordfence tool, Gravity Forms, and the Divi theme from WordPress on our website. When using these tools, personal data may be transmitted to third-party providers. However, we have made specific configurations and designed the integration on our website in such a way that the transfer of personal data is prevented and will not occur.

Sharing and transmitting personal data within a group

We have a partner company in the U.S. with which we share personal data.

This is:

International Ride Training LLC
228 Cumberland Circle
Nashville, TN, 37214 USA

Our partner company in the U.S. receives your personal data when necessary to fulfill a contract with you or to provide a service you have requested. We also have a legitimate interest in optimizing our processes and sharing personal data with our partner company for internal administrative purposes.

From a data protection perspective, the U.S. is considered a third country. According to the GDPR, an adequate level of data protection must be ensured through additional mechanisms. We have therefore entered into standard contractual clauses with our partner company as approved by the European Commission.

Social media profiles

We have a company page on Facebook and Instagram, both belonging to Meta, and a company page on LinkedIn where we share news and information, interact with our followers and promote our services and events.

Our website contains links to our social media profiles. When you visit our social media profiles, Meta and LinkedIn automatically collect personal data from you, such as your IP address. When you have an account with Meta and/or LinkedIn and you are logged in to your account, your visit to our social media profiles will be connected to your profile by the platform providers. For more information on what data Meta and LinkedIn collect, please consult the current privacy policies of the platform operators.

We receive personal data in connection with our social media pages when you visit our profile, post a comment, react to one of our posts, or send us a private message via our social media pages. We use the information provided to us to respond to your comments, inquiries or questions. The processing of the aforementioned personal data is carried out to safeguard our legitimate interests (Art. 6(1)(f) GDPR).

We automatically receive so-called “Insights” data from the social media platform operators. This data consists of statistics regarding the usage and reach of a page and is only made available to us in an aggregated and anonymized form. We do not analyze these insights or use them for our own purposes. You can limit the tracking performed through the platform by selecting privacy-friendly settings in your browser, rejecting cookies, and using opt-out options. The platform operators provide further information on how to limit the tracking data they collect about you:

We are joint controllers pursuant to Art. 26 GDPR with Meta and LinkedIn. Corresponding data protection agreements regarding joint controllership have been concluded. You can also access the agreements here:

Comments and reactions you leave on our social media profiles will be retained in the history for as long as our company pages exist there. They will be deleted earlier if you remove the comments/reactions yourself or request that we delete them. Private messages you send us via our social media profiles will be deleted from our profile no later than one month after we respond. We do not export the insights provided to us by social media platform operators; these remain available in our account for as long as the platform operators stipulate in their standards. For more information on this, please refer to the privacy policies of the platform operators.

Meta and LinkedIn are internationally operating corporations. Personal data collected via social media platforms may therefore also be transferred to third countries subject to data protection laws. In the case of Meta and LinkedIn, the United States is particularly noteworthy. Other possible countries include, for example, Singapore, India, and Brazil. The mechanisms used for the transfer to ensure an adequate level of data protection are, for both Meta and LinkedIn, the EU-US Data Privacy Framework (DPF) in the case of the United States and, for all other third countries without an adequacy decision by the European Commission, the Standard Contractual Clauses (SCCs). The countries in which the platform operators and their subcontractors may operate can be found via the following links:

Part 4: Transparency, control by the data subject, and your rights

We believe in transparency and providing you with control over your personal information. You will always be informed about any significant changes to our sharing practices, and where applicable, you will have the option to consent to such changes.

Your trust is important to us, and we strive to ensure that your personal information is disclosed only in accordance with this policy and when there is a justified reason to do so. For any queries or concerns about how we share and disclose personal information, please reach out to us at irtprivacy@ridetraining.com.

User rights and choices

At IRT Attractions Consulting, S.L.U., we recognize and respect your rights regarding your personal information, in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We are committed to ensuring you can exercise your rights effectively. Below is an overview of your rights and how you can exercise them:

Your rights

  • Right of access (Art. 15 GDPR): You have the right to request access to the personal information we hold about you and to obtain information about how we process it.
  • Right to rectification (Art. 16 GDPR): If you believe that any personal information we hold about you is incorrect or incomplete, you have the right to request its correction or completion.
  • Right to erasure (‘right to be forgotten’) (Art. 17 GDPR): You have the right to request the deletion of your personal information when it is no longer necessary for the purposes for which it was collected, among other circumstances.
  • Right to restriction of processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your personal information under certain conditions.
  • Right to data portability (Art. 20 GDPR): You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit those data to another controller.
  • Right to object (Art. 21 GDPR): You have the right to object to the processing of your personal information, under certain conditions, including processing for direct marketing.
  • Right to withdraw consent (Art. 7(3) GDPR): Where the processing of your personal information is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable data protection laws. If you would like to contact the relevant authority for IRT Attractions Consulting, S.L.U., please see the following details:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain
Website: https://www.aepd.es

  • We do not process your data for automated individual decision-making and profiling. (Art. 22 GDPR).

Exercising your rights

To exercise any of these rights, please contact us at irtprivacy@ridetraining.com. We will respond to your request in accordance with applicable data protection laws and within the timeframes stipulated by those laws. Please note, in some cases, we may need to verify your identity as part of the process to ensure the security of your personal information.

We are committed to facilitating the exercise of your rights and to ensuring you have full control over your personal information. If you have any questions or concerns about how your personal information is handled, please do not hesitate to get in touch with us.