Privacy policy

This policy explains what personal data we process when you use MundiGuía, for what purposes, on what legal basis, for how long and how you can exercise your rights. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Yaiza Inversiones, S.L., with tax ID B35970888, and registered address at Calle Arena, 3, 2.º, 35002 Las Palmas de Gran Canaria (Las Palmas), España. Contact: no-responder@mundiguia.online.

We are not required to appoint a data protection officer. For any question about your data, write to us at no-responder@mundiguia.online.

2. What data we process, why and on what legal basis

Your account. Name, email address, password (stored encrypted, never in plain text) and, if it is a town hall account, the town, the contact person and their telephone number. These are used to create and manage your account and what you publish. Legal basis: performance of the contract you accept when you register (Art. 6(1)(b) GDPR).

What you publish. Reviews, business listings, adverts, news, wall posts, obituaries and memorials, with their photos, are published under your account name and can be read by anyone, including search engines. Legal basis: performance of the contract. To publish data or photos of other people you need their permission.

Deceased persons. Obituaries and memorials contain data about deceased persons, to whom the GDPR does not apply; even so, they may only be published by their relatives or by someone with their authorisation, and relatives may ask for them to be corrected or removed by writing to no-responder@mundiguia.online (Art. 3 LOPDGDD). The email addresses that a family provides to receive the anniversary reminder for a memorial are used only for that purpose, and each recipient may ask us to stop writing to them.

Payments. When you pay for a membership, a pack or a memorial, we keep the description, the amount, the date and the order reference. You enter your card or PayPal account details in the bank's payment gateway (Redsys) or in PayPal's: we neither see nor store them. Legal basis: performance of the contract and the legal obligation to keep invoices and accounting records (Art. 6(1)(c) GDPR).

Newsletter and alerts. If you sign up for the newsletter, we keep your email address and the area you choose, and we only write to you after you have confirmed it from the email itself. You switch on festival alerts yourself in your account. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw using the unsubscribe link included in every email.

Messages and requests. What you write to us through the contact form or when requesting a pack (name, email address, telephone number and message) is used to reply to you and, if you ask, to prepare an offer for you. Legal basis: your consent and the pre-contractual measures you ask us to take (Art. 6(1)(a) and 6(1)(b) GDPR).

Town hall registration. We use the data of the person requesting the account for a town to verify that they speak on behalf of the town hall before activating it. If the request is rejected, the data is deleted.

Our own statistics and security. To count visits we store the page, the language and a daily identifier encrypted with a secret key, which does not reveal your IP address, and we delete it after 30 days. What is typed into the search box is stored without any data about the person searching. Your IP address is used at the time to curb abuse, such as repeated attempts to log in to an account, and is not stored with your session. Legal basis: our legitimate interest in keeping the service secure and knowing how it is used (Art. 6(1)(f) GDPR).

Analytics: only if you accept analytics cookies is Google Analytics 4 used, with IP anonymisation.

Content from other websites: photos of towns are served by Wikimedia, and those of a business or a listing by whichever website the person who posted it links them from; the map on each page by OpenStreetMap, and a town hall's video by YouTube without cookies. When loading them, your browser requests them directly from those sites, which receive your IP address like any website you visit.

Professional contacts. To make the guide known, we may write to town halls, funeral homes and businesses at the professional address they themselves publish. Legal basis: our legitimate interest. Every email includes a link to stop receiving them, and we always respect it.

The data that a form marks as mandatory are needed to provide you with the service: without them we cannot create your account, publish what you ask for or answer your message. We do not take automated decisions or carry out profiling that produces legal effects concerning you or similarly affects you.

3. How long we keep it

Your account data, for as long as the account exists; if you delete it, the data is deleted with it, except what we are required by law to keep. Obituaries are removed after 48 hours, and memorials at the end of the paid period and its grace days. Payment data is kept for six years, as required by commercial and tax law. Newsletter data, until you unsubscribe. Contact messages, for as long as needed to deal with them and for two years at most. Once those periods have passed, the data is deleted or blocked as required by law.

4. Who we share it with

We do not sell or transfer your data. Only the following providers have access to it, to the extent necessary to provide their service to us, and we have the contracts required by the GDPR with them:

• Hostinger International Ltd. (Cyprus, EU): hosting of the website and its database.
• Redsys Servicios de Procesamiento, S.L. and the merchant's bank: card payments.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payments with PayPal and by card through PayPal.
• Google Ireland Ltd.: analytics, only if you accept it.
• The email delivery service we use to send the newsletter and professional emails.

VideoChat Global (videochatglobal.com) and ciudadesypueblos.es also belong to Yaiza Inversiones, S.L., the same controller as this website, so they are not third parties. If you are a town hall with the pack and you join the video call, we use your name, your email address and your town there to give you access. And the public content about towns in Spain is also published on ciudadesypueblos.es, the guide to Spain with which this website shares listings and posts.

In addition, we will disclose data to judges, courts and public authorities when required to do so by law.

5. Transfers outside the European Union

Data is hosted in the European Union. Google and PayPal may process some data in the United States; they do so under the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to no-responder@mundiguia.online.

You may also withdraw any consent you have given us at any time, without this affecting anything done before. We will reply within one month and, if we need to check that it is you, we may ask you to prove your identity.

You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority of your country of residence.

7. Minors

The guide is not aimed at children under 14, who may not register without the consent of their parents or guardians (Art. 7 LOPDGDD). If we become aware that an account belongs to a child under that age without such consent, we will delete it.

8. Security

We apply technical and organisational measures to protect your data: encrypted connection (HTTPS), encrypted passwords, restricted access to the administration panel and backups. If there were a breach that put your data at risk, we would tell you and notify the supervisory authority.

9. Changes to this policy

If we change this policy, we will publish the new version on this page with its date and, if the change is significant, we will notify you by email or when you log in to your account.