Privacy Policy

1. Data controller

The controller responsible for personal data associated with the Guía Torrevieja service is:

• Controller: KHUPULA DESARROLLOS E INVERSIONES, COOP. V.
• Trading name: GRUPO TORREVIEJA
• Service and application: Guía Torrevieja
• Tax identification number: F70759055
• Registered address: Calle Lagunas de Ruidera, C.C. Vía Park V, local 17, 03189 Orihuela (Alicante), España.
• Legal and data-subject rights email: hola@guiatorrevieja.es
• Website: https://www.guiatorrevieja.es

In this policy, “Guía Torrevieja”, “the service” or “the platform” includes the website and the Android and iOS mobile applications. KHUPULA DESARROLLOS E INVERSIONES, COOP. V. is the controller of the processing carried out by Guía Torrevieja and described in this document.

2. Scope of this policy

This policy explains the processing associated with browsing the website, using the Android and iOS apps, sending enquiries to Guía Torrevieja, sending requests to businesses, adding and managing business listings, technical administration, and any business relationship that may be initiated voluntarily.

Guía Torrevieja is a public general directory of businesses, establishments, services, activities, events and places of interest. No account is required to browse the directory or use the public app features. Some actions open a third-party app or service selected by the user.

This policy does not replace the terms and policies of Google, Apple, WhatsApp, telephone operators, email providers, browsers, map applications or other external destinations that a person chooses to open.

3. Processing principles

Data is handled in accordance with lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. Only data reasonably necessary for each purpose is requested or retained.

Special-category data and unnecessary information about other people should not be sent. Anyone providing another person's data must have an appropriate lawful basis and ensure that the information is accurate.

4. Data that may be processed

Depending on the feature used, the following categories may be processed:

• Enquiry data: name, email, telephone number, message content and any information voluntarily included by the sender.
• Requests sent to businesses through the website: name, telephone number and/or email, message, date, recipient business, operational status, version of the privacy notice shown, date of acceptance or confirmation, and context of the request.
• Business enquiries: identity and professional details of owners, self-employed professionals, representatives or contact persons, business information and communication content.
• Public or supplied listing data: trading name, activity, professional address, professional telephone number, website, images and other business information lawfully made public.
• Administration data: login email, protected credentials, access status and time, and records needed to secure the private panel. Passwords are not stored in clear text.
• Technical network information: IP address, date and time, requested URL, technical headers, response and diagnostics that infrastructure may process to deliver the service, detect misuse and resolve errors.
• First-party website and app events described in section 9, without advertising cookies or individual browsing profiles.

The app does not require a name, email, telephone number or account to browse the catalogue. An HTTPS request to our public endpoints may involve ordinary technical processing of the connection by our infrastructure, including the IP address needed to return the response, even though the app does not add that information to profiles, favourites or searches.

5. Local mobile-app features

The app may request location permission only when a distance or nearby feature is used. Device coordinates are used locally to calculate distances with the Haversine formula. Guía Torrevieja does not send that location to its backend or Analytics, does not retain it on its servers and does not access background location. Refusing permission does not prevent use of the directory without nearby features.

Language, favourites, appearance and some preferences are stored locally on the device. Favourites are not synchronised with servers. Searches and filters remain local and are not sent to Guía Torrevieja as a history. Local data remains until the person changes it, clears the app data or uninstalls the app, subject to the operating system and its backup behaviour.

There are no public user accounts or sign-in. The app contains no advertising SDK, does not use an advertising identifier and includes no external Analytics or crash-reporting SDK. Location is not used for advertising.

6. Enquiries, email and “Add your business”

General and business contact links open the email client selected by the user. The “Add your business” feature holds the fields temporarily in memory and prepares an email draft; the app does not send it automatically. Guía Torrevieja receives the data only if the person reviews and voluntarily sends the message from their email client. Until then, the content is not transmitted to the controller.

When an email is received, the sender address, name, contact details, content, attachments and communication metadata may be processed. The purposes are to reply, check or add a listing where appropriate, handle a requested business communication or take pre-contractual steps. The sender's email provider and the controller's email provider may also process data under their own terms.

7. Website forms and requests to businesses

When a listing has a form enabled, the submitted data is recorded to manage the request and make it available to the specific business selected. Not every business offers this feature. The form requires the minimum fields and confirmation of the applicable privacy notice; the version shown, date of acceptance or confirmation, and context of the request are retained. This confirmation records that privacy information was provided, but does not by itself constitute consent for processing that requires specific authorisation.

The recipient business will process the received data to answer the request and is responsible for any later use under the law applicable to it. Guía Torrevieja does not guarantee that a request will result in a call, contract or sale.

Validation, idempotency and anti-abuse controls apply. The request row does not persist IP address, user-agent, fingerprint, location, tracking cookies or advertising identifiers. Infrastructure may still process technical information temporarily for security and delivery as described in sections 4 and 11.

8. Businesses, professionals and administration

Professional information obtained from a business, its representative or legitimate public sources may be processed to maintain the directory. The purposes are to publish and update useful information, respond to corrections, distinguish editorial content from commercial presence and manage relationships with businesses. A person may request correction of professional personal data where applicable.

Private panel accounts are protected with authentication and necessary technical cookies. Access and operation records may be retained for security, continuity, legal-version traceability and service administration. This processing does not turn public browsing into authenticated browsing.

9. First-party Analytics, cookies and advertising

The website uses first-party measurement to understand aggregatable views and interactions with listings, activities, events, places and contact channels. It may record the entity, action, source section and server date. It is designed without Google Analytics, Meta Pixel, an advertising SDK, analytics cookies, advertising identifiers, fingerprints or individual profiles. Neither an IP address nor an IP digest is stored in Analytics rows.

Mobile Analytics is active to measure views and interactions involving businesses, activities, events and places, including contact, navigation, sharing, favourites, booking and calendar actions where applicable. The preference starts enabled and is stored locally on the device; the person can turn it off in settings, after which the app stops sending events.

Each event transmits the type and identifier of the public entity, the action, the iOS or Android platform, selected language, a random ephemeral session identifier called sessionId and, when available, the app version. The server assigns the date and validates that the entity is public and that the entity/action combination belongs to the closed allowed set. PostgreSQL stores the entity reference, event type, server date, iOS or Android channel, language and optional app version.

The session identifier makes it possible to distinguish interactions from the same app run for a short time so duplicates can be discarded. It remains in app memory for that run, and the backend uses it only in memory for five seconds for views and two seconds for other actions. It is not stored in PostgreSQL. Analytics does not transmit or store device location, searches, messages, contact numbers, advertising identifiers or permanent device identifiers. The endpoint does not read or retain IP addresses or user-agents in Analytics rows; Vercel may process technical connection metadata to deliver and protect the service.

The public website currently uses no first-party analytics or advertising cookies. The private panel uses strictly necessary authentication cookies. Guía Torrevieja does not display advertising through an SDK in the app, does not carry out behavioural advertising and does not currently use non-essential technologies that require consent.

10. Maps, external actions, calendar and weather

Embedded maps on Android use Google Maps SDK for Android. Google may directly process request metadata, IP address, device and system data, diagnostics, an SDK-specific pseudonymous identifier and interactions where applicable, as explained in its SDK data disclosure and Privacy Policy. Google processes this information directly; Guía Torrevieja does not receive it as data in its own systems. On iOS, Apple MapKit or Apple Maps is used. Apple directly processes the necessary technical and interaction information under its Privacy Policy, separately from data collected directly by Guía Torrevieja.

The website uses MapLibre as its display library and OpenFreeMap, from tiles.openfreemap.org, to deliver map resources. The cartographic data comes from OpenStreetMap and is provided with its attribution and licence. When a map loads, the browser requests those resources directly and the server needs to receive the IP address and technical connection data in order to respond. According to the OpenFreeMap Privacy Policy, the service does not use accounts, cookies or tracking technologies and does not store IP addresses in its regular logs; it may temporarily enable IP logging to investigate security incidents.

Call, WhatsApp, website, directions, sharing and booking buttons open a destination only after the user acts. From that point, the selected operator or app may process information under its own rules. Guía Torrevieja does not assume that a normal telephone number supports WhatsApp and does not send messages automatically.

The calendar feature opens the native editor with prepared event data. The app does not request calendar permissions, read calendars or reminders, or directly create, change or delete events. The person decides in the system editor whether to save or cancel; Guía Torrevieja does not know the outcome of that decision.

Current weather is supplied by MET Norway through a backend proxy using fixed Torrevieja coordinates. The user's location is not sent to MET Norway; the provider receives a server request containing the fixed location and an identifying service User-Agent.

11. Purposes

Data may be processed to:

• provide the website and app, deliver the catalogue and maintain their features;
• answer voluntary enquiries and communications;
• manage a request addressed to a business and enable its response;
• verify, publish, update or remove business listings;
• handle inclusion and visibility requests and pre-contractual or contractual relationships;
• provide local nearby features requested by the user;
• enable maps and external destinations chosen by the user;
• protect systems and prevent misuse, spam, fraud and unauthorised access;
• measure website and application operation proportionately through first-party Analytics;
• maintain continuity, diagnose incidents and comply with legal obligations.

Data is not used to sell profiles, deliver behavioural advertising or make solely automated decisions producing legal or similarly significant effects.

12. Legal bases

The legal bases apply to each form of processing as follows:

• enquiries initiated by a person are handled through pre-contractual steps requested by that person where they concern a possible contract and, in other cases, through the legitimate interest in responding to communications about the service;
• requests addressed to a business are transmitted to that recipient as a direct consequence of the person's request, based on the pre-contractual steps requested or, depending on their content, the legitimate interest in routing and answering the communication;
• listing applications and relationships with businesses are managed through pre-contractual steps, performance of a contract and compliance with legal obligations, according to the stage and purpose;
• maintaining the directory and relevant professional data is based on the legitimate interest in providing useful, up-to-date business information, balanced against the rights of affected individuals;
• security, abuse prevention, continuity and technical maintenance are based on the legitimate interest in protecting the platform and its users;
• first-party website and app measurement is based on the legitimate interest in understanding and improving service operation while it remains free of analytics cookies, persistent identifiers, fingerprinting and individual profiles; in the app, the right to object can be exercised by turning Analytics off in settings or through the rights in section 16;
• compliance with tax, commercial, data-protection and other applicable duties is based on the relevant legal obligation;
• consent is used only for optional processing that requires it and may be withdrawn without affecting previous lawful processing.

Accepting or confirming that a privacy notice was shown does not automatically constitute consent. Opening maps, calls, email, WhatsApp, websites, sharing options or the calendar is an action initiated by the person, but is not a standalone legal basis under Article 6 GDPR; the selected third party applies its own bases to the processing it carries out.

The operating-system location permission controls local app access. Because Guía Torrevieja does not receive those coordinates, granting permission does not by itself mean that the controller stores location data.

13. Recipients and providers

Data is not sold. To the extent necessary, it may be accessed by:

• Vercel, engaged to provide hosting, deployment, execution and HTTPS delivery; the project's main functions are configured in Frankfurt, Germany (fra1), while its CDN operates over a global network;
• Neon, engaged to provide the PostgreSQL database holding content, requests and operational backend data in AWS Europe Central 1, Frankfurt, Germany (eu-central-1), a region supported by Neon;
• OpenFreeMap, an external provider used by the website to deliver cartography based on OpenStreetMap;
• email and technical-support providers needed to handle communications;
• the selected business when a request is expressly addressed to it;
• Google and Apple when the person uses their maps or other destinations managed by them;
• other external destinations selected by the person;
• public authorities and courts when disclosure is legally required.

Vercel and Neon provide technology services to KHUPULA for the functions described and process the necessary data under the terms applicable to those services. By contrast, Google, Apple, OpenFreeMap, recipient businesses and other services a person uses or opens may process data directly for their own purposes and under their own terms. Further information is available in the official Vercel and Neon policies.

14. International transfers

The regional configuration places the main processing by Vercel Functions and the Neon database in Frankfurt, Germany. This does not mean that all processing remains exclusively in the European Union: Vercel's CDN is global, and Vercel, Neon and their subprocessors may use entities or infrastructure inside and outside the European Economic Area in accordance with their services and terms.

Where processing under KHUPULA's responsibility involves an international transfer, the safeguard required by the GDPR for the relevant service and destination will be applied.

Google, Apple and other external providers may also process information directly under their own policies when their SDKs, maps, stores or apps are used. Information or a copy of the applicable safeguards may be requested by writing to hola@guiatorrevieja.es.

15. Retention

Data is kept only for as long as necessary for the purpose for which it was collected and, afterwards, for periods required to meet legal obligations or to establish, exercise or defend legal claims. The following objective criteria apply:

• enquiries and email: until the requested response or handling is complete and, afterwards, while needed for legal obligations or claims arising from that communication;
• requests to businesses: until delivery and handling are complete and, afterwards, while needed for legal obligations or claims connected with the request;
• listing applications and business relationships: during pre-contractual handling, throughout the relationship and, after it ends, for applicable tax, commercial or legal duties and the establishment, exercise or defence of claims;
• listings and professional contacts: while relevant to the directory or until an applicable correction or removal, subject to legal retention duties;
• administration data: while the account or function exists and, after closure, while records are needed for security, action traceability or the defence of claims;
• website Analytics events: until the measurement and reporting cycles for which they were collected are complete and, afterwards, only while needed for related legal obligations or claims;
• Mobile Analytics events: until the app-use measurement and reporting cycles are complete and, afterwards, only while needed for related legal obligations or claims; the ephemeral session identifier is not added to those records;
• technical and security logs: while there is a documented need to detect, investigate or demonstrate incidents, misuse or unauthorised access;
• backups: until replaced or deleted within the provider's configured rotation and recovery cycle, with restricted access;
• local app data: until the person changes a preference, clears data or uninstalls, subject to the operating system.

Where consent is the legal basis, data is retained until withdrawal unless another basis or duty requires retention. When no longer needed, data will be deleted, anonymised or restricted as appropriate.

16. Rights and complaints

Data subjects may request access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent at any time. Requests can be sent to hola@guiatorrevieja.es, identifying the right concerned and supplying the information needed to locate the data.

Proportionate additional information may be requested to verify identity and prevent unauthorised access to another person's information. Exercising rights is free except where the law provides otherwise. Withdrawal does not affect processing lawfully carried out before it.

Anyone who believes that processing breaches data-protection law may complain to the Spanish Data Protection Agency or another competent supervisory authority, without prejudice to other remedies.

17. Security and children

Technical and organisational measures are used to reduce unauthorised access, loss, alteration, disclosure and destruction. Measures include encryption in transit, access controls, panel authentication, validation, minimisation, separation of public and internal data, and backup and recovery procedures. No Internet-connected system can guarantee zero risk.

The service is a general directory and is not directed at collecting children's personal data. Minors should not send data or requests without the involvement of a parent or guardian where required. If processing contrary to these rules is identified, a review or erasure request may be sent to the rights email.

18. External links, third parties and automated decisions

Listings may contain links and actions to businesses, maps, operators, WhatsApp, websites, booking services, social networks, email or other third parties. Guía Torrevieja does not control their policies or processing after a person leaves the platform. Their notices should be reviewed before submitting information.

No solely automated decision producing legal or similarly significant effects is made about users. Editorial or commercial positions in the directory are not based on personal browsing profiles.

19. Changes to this policy

The policy may be updated when the website, applications, processing, providers or legal requirements change. Any material change to Mobile Analytics, addition of a non-essential SDK, change in location use or material map change will require prior review of this policy and the store disclosures.

The current version will be the one published on Guía Torrevieja's legal routes. The date and version number displayed by the page will correspond to the versioned publication performed through Admin.