Privacy policy

Who is responsible for your data

• Controller: David Quintero Reina
• Tax ID (NIF): 74850305W
• Address: Calle La Toma, 29400 Ronda (Málaga)
• Email: dquinteroreina@icloud.com

What data we collect, and why

We only process personal data in four situations:

• When you submit an event through the form: the event details and, only if you choose to give it, your name or your association's name. We do not ask for your email or phone number. Purpose: to review the event and publish it on the listings. Legal basis: your consent (art. 6.1.a GDPR), which you give by ticking the box and can withdraw at any time.
• When you take part in "Local tips": to post, vote or report you need an account. We keep your email, your mobile number or your Google account identifier (depending on how you sign in), your password if you have one (managed by Firebase Authentication), the alias you choose and, if you give it, your village. Only the alias and the village are published, next to your tips; your email or phone number is never shown. We also record which tips you voted for or reported, so that each person counts only once. Purpose: to run the community tips and keep them free of spam and abuse. Legal basis: the performance of the terms you accept when you sign up (art. 6.1.b GDPR). You must be at least 14 years old (art. 7 LOPDGDD).
• When you write to us on WhatsApp: your phone number, your WhatsApp profile name, the messages and posters you send and our replies. An automated assistant (artificial intelligence) answers what is on and helps you submit an event; a person on our team can read the conversation and take over. Purpose: to answer you and, if you send an event, to review it. Legal basis: your request when you write to us (art. 6.1.b GDPR). We only send you notices on our own initiative if you ask for them by writing ALTA AVISOS; BAJA stops them and BORRAR MIS DATOS deletes your number and the conversation at once. We do not listen to or keep voice messages.
• When you visit the website: the hosting provider keeps technical logs (IP address, browser, time of the request) to serve the site and protect it against abuse. Legal basis: legitimate interest in keeping the service secure (art. 6.1.f GDPR). We also count visits to know how many people use the site and which pages are looked at, without cookies or any third-party service: each page view sends our own server the page address, the page you came from and, only for a moment, your IP address and browser. From those it computes an identifier that is valid for that day only (it is made with a secret that is deleted afterwards, so it cannot be traced back to you) and adds one to some daily totals. Your IP address and browser are not stored and no one can see what you read. Legal basis: legitimate interest in knowing how the service is used (art. 6.1.f GDPR). If your browser sends "Do Not Track" or Global Privacy Control, we do not count you.

We do not use third-party analytics, advertising or profiling of any kind.

How long we keep it

The daily identifier used to count visits is deleted two days after it is created. Only the daily totals remain (number of views per page, town, device and origin), which contain no personal data.

Submissions are deleted automatically 365 days after they are sent. If an event is published, only the event details stay on the listings; your name is never published unless you ask for it as the organiser.

Your account and profile are kept until you delete them. You can do it yourself at any time from any fiesta page ("Delete my account"): your account, alias and profile are erased immediately, and your tips remain signed as "Cuenta borrada" (deleted account), with no link to you, because they are information about a fiesta that is useful to others. If you want them removed too, write to us. Reports and votes are kept without any data that identifies you.

WhatsApp conversations are deleted automatically 90 days after the last message, and your number 365 days after you last wrote to us. An event you send by WhatsApp is kept like any other submission, linked only to a coded identifier, never to your number.

Who processes it for us

The website, the accounts (Firebase Authentication) and the database run on Google Firebase (Google Ireland Ltd.), acting as data processor. The database is stored in the European Union (Belgium, region europe-west1). Google may process technical data in the United States under the EU-US Data Privacy Framework. If you sign in with your mobile, Google sends the code by SMS through its messaging providers. WhatsApp messages go through the WhatsApp Business Platform of Meta Platforms Ireland Ltd., and the assistant's replies are generated with Google's Vertex AI in the European Union, which does not use your messages to train its models. We do not sell or share your data with anyone else.

Your rights

You can request access, rectification, erasure, restriction, portability or objection, and withdraw your consent, by writing to dquinteroreina@icloud.com. If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).