Privacy & cookies.

1. Who is responsible for your data

RIKO is a one-man academy. There is no data department: the person reading your email is the same person teaching the class. If you want to know what we hold on you, or want it deleted, write to the address above and you will hear back from Riccardo.

2. What we collect and why

Booking a class

Class bookings run through MAAT, a third-party booking platform. When you book, MAAT collects your name, email, phone number and booking history, and shows them to us so we know who is on the mat and how many spaces are left. The legal basis is performance of a contract — we cannot hold a place for you without knowing who you are. MAAT is the controller of its own user accounts and applies its own privacy terms; we see only the booking data.

Shop orders

Orders are taken through Stripe. Stripe collects your name, email, billing and shipping address and payment details, and passes us everything except the card data — we never see or store your card number. The legal basis is performance of a contract for the order itself, and legal obligation for the invoice, which Spanish tax law requires us to keep.

Email, WhatsApp and Instagram messages

If you write to us, we keep the message and your contact details for as long as it takes to answer you and to pick the thread back up if you write again. The legal basis is our legitimate interest in answering people who contact us. We do not add you to any mailing list off the back of a message, because we do not run one.

Kids classes

The kids sign-up form is a Google Form and collects the child's name and age, a parent or guardian's contact details, and anything you choose to tell us about injuries or medical conditions we should know about before the child trains. Only a parent or legal guardian may complete it, and the legal basis is their consent. Health information is handled under Article 9(2)(a) GDPR, is seen only by the instructor, and is used for nothing but keeping your child safe in class.

Measurement on our advertising page

The drop-in page — and only that page — can load the Meta pixel, which tells us whether people who click our Instagram and Facebook ads go on to book a class. Nothing loads until you press Accept on the cookie banner. The legal basis is consent, and you can take it back at any time in section 6. If you decline, the page works exactly the same and you can still book and train.

3. Who else sees it

We do not sell your data and we do not share it for anyone else's advertising. We use the following service providers, each of which processes data on our instructions:

• MAAT — class bookings and attendance.
• Stripe Payments Europe, Ltd. — shop payments and payment fraud checks.
• Google — the kids sign-up form, our email, and the web fonts on this site. Loading a page sends your IP address to Google's font servers.
• Meta Platforms Ireland Ltd. — advertising measurement, on the drop-in page only, and only with your consent.
• Our hosting provider — serves this website and keeps standard server logs, including IP addresses, for security and troubleshooting.
• Our accountants, Gestió J.M. Fàbrega, SLP — invoices only, as required for bookkeeping and tax.

We will also hand over data where the law obliges us to — for example to the tax authority or in response to a valid court order.

4. Data leaving the EU

Stripe, Google and Meta are European entities but form part of groups with infrastructure in the United States, so some data may be processed there. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where it does not apply, on the Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply to any specific transfer.

5. How long we keep it

• Booking and attendance records — while you are training with us, and for one year after your last class, so we can pick up where you left off if you come back.
• Invoices and accounting records — six years, as Spanish commercial law requires.
• Messages — up to two years after the conversation ends.
• Kids forms, including any health notes — while the child trains with us, then deleted within one year.
• Advertising measurement data — the cookie lasts up to three months; what Meta retains is governed by Meta's own policy.
• Server logs — 30 days.

6. Cookies, and how to say no

Most of this website uses no cookies at all. There is no analytics on the homepage, the shop, the FAQ or the Spanish pages. Only the drop-in page carries anything, and only after you agree to it.

Name	Set by	What it does	Lasts	Needs consent
riko_consent	RIKO	Remembers whether you accepted or declined, so the banner stops asking. Stored in your browser, never sent to us.	Until you clear it	No — it exists to record your choice
_fbp	Meta	Tells us whether an ad click turned into a booking. Drop-in page only.	3 months	Yes

7. Your rights

Under the GDPR you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, where we have no legal reason to keep it — invoices are the usual exception.
• Restrict or object to what we do with it.
• Move it to another provider in a portable format.
• Withdraw consent you have given, at any time, without having to explain why.

Write to hello@rikojiujitsu.com and we will answer within one month. It is free, and we may ask you to confirm your identity first so we do not hand your data to someone else.

If you are not happy with how we handle it, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos — C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would rather you came to us first, but it is your right either way.

8. Children

We do not knowingly collect data from anyone under 14 — the age of digital consent in Spain — except through the kids sign-up form, which must be completed by a parent or legal guardian. If you believe a child has given us data without that consent, tell us and we will delete it.

9. Security

This site is served over HTTPS. Payment data never touches our systems. Booking, order and student records sit in access-controlled accounts that only Riccardo can open. That said, no system is perfect: if a breach ever puts your rights at risk, we will tell you and the AEPD as the law requires.

10. Changes

If we add a tool that collects data, this page changes first and the date at the top moves with it. Where the change needs your consent, we will ask again rather than assume.