Privacy notice

1. Who is responsible

The controller is [legal entity], tax ID [NIF or CIF], [address], email [privacy contact email]. [Data protection officer contact, if one is appointed, or: We have not appointed a data protection officer.] Privacy requests go to [privacy contact email].

2. The short version

• Browsing the information pages needs no account. We do not use analytics, advertising cookies or tracking pixels.
• Your position for the Near me button is used only in your browser. It is not sent to us.
• If you create an account or subscribe, we use your email and the details you give for the purposes below, and nothing else without your separate consent.
• You can export and delete your data yourself in the account page.

3. When you visit the site

Our hosting provider receives technical data with every request, such as your IP address, the page requested, the time, your browser type and the referring page. We use it to deliver the site, keep it secure and find faults. Legal basis: our legitimate interest in running and protecting the service (GDPR Article 6(1)(f)). Server logs are kept by the provider for a short period, [retention period to be confirmed with the provider].

The site stores your choices on your own device, such as theme, language, the shopping list ticks and passport stamps. This stays on your device and is not sent to us. See the Cookies notice.

4. Content loaded from other services

When you open a map, your browser asks OpenFreeMap for map tiles, and that service receives your IP address and the area you look at. If you switch on an optional layer, your browser asks the Spanish national mapping service (IGN, IDEE), the Ministry for the Ecological Transition (MITECO) or the European Forest Fire Information System (EFFIS, Copernicus) for it, and they receive your IP address and the area.

The fonts and the map software are served from our own site, not from a third party.

Links to other sites, such as AEMET, Wikimedia Commons or Amazon, take you to services with their own privacy notices.

5. Near me

If you press Near me, your browser asks you for permission to share your position. We use it only inside your browser to sort routes by distance. It is not sent to our servers and is not stored. You can refuse or withdraw the permission in your browser settings.

6. Partner links and product photos

Links to Amazon.es carry our partner tag. When you click, you leave Pikapoko and Amazon handles your data under its own notice and may set its own cookies. We receive from Amazon reports about purchases made through our links, which do not identify you.

Product photos in the gear sections and shopping lists are loaded directly from Amazon's image servers when you view them. Amazon therefore receives your IP address and the usual technical data of a web request. As far as we can tell, these image requests do not set cookies. Legal basis: our legitimate interest in showing you the products we link to (Article 6(1)(f) GDPR). You can prevent this by blocking images from Amazon domains in your browser or with a content blocker.

7. Accounts

Data: email address, display name, home province if you give it, the terms and age confirmations with their version and time, saved routes, and a sign in session. Purpose: to create and run your account and keep your saved routes. Legal basis: performing the contract with you (Article 6(1)(b)) and, for the confirmations, our obligation to keep proof (Article 6(1)(c) and (f)).

Sign in uses a one time link sent to your email. A session cookie keeps you signed in for up to 30 days. Data is kept while the account exists. When you delete the account we delete this data, except records we must or may keep, described in section 12.

8. Guide listings, messages and reviews

Guide listings: if you list yourself, we publish the details you enter, which are name, description, provinces, languages, activities, qualifications you state, whether you declare insurance, and whether you act as a trader or as a private person. A listing is public after it is approved, and we keep a record of the moderation decision. Legal basis: the contract with you and our legitimate interest in a safe marketplace.

Messages: when you write to a guide, we send your message by email to the guide, with your email address as the reply address, so the guide can answer you. We keep a record of the message so that we can handle reports. Legal basis: performing the contract with you and our legitimate interest in handling abuse.

Reviews: your review, rating, date and display name are published. Legal basis: the contract with you and our legitimate interest in giving other users useful and fair information. A review stays until you delete it or the account, or we remove it under the content rules.

9. Newsletter

If you subscribe to the weekly walk email, we use your email address and chosen language to send it. We first send one confirmation email and add you only after you confirm. Each email contains a link to leave. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time with one click, without affecting the earlier sending. We keep your data until you leave.

10. Reports, moderation and security

If you report something, or if your content is reported, we process the report, the reason, the identities involved and our decision, to apply the content rules and the Digital Services Act. Three reports hide a listing or review until a person has looked at it. This is the only automated step, and a person always makes the final decision. We keep a log of moderation actions and security events. Legal basis: our legal obligations and our legitimate interest in keeping the service safe (Article 6(1)(c) and (f)).

11. Who receives data

We use service providers who process data on our instructions:

• [hosting provider], for hosting and delivery of the site and the service functions;
• [database provider], for the member database, in the [EU region];
• [email provider], for sending sign in links, messages and newsletters.

Guides receive messages you send them. Authorities may receive data where the law requires it. We do not sell personal data. Some providers may process data outside the European Economic Area. Where they do, we rely on an adequacy decision or on the European Commission's standard contractual clauses, [mechanism to be confirmed with each provider].

12. How long we keep data

• Account data: while the account exists; deleted on request or when you delete the account.
• Sign in sessions: up to 30 days.
• Newsletter data: until you leave.
• Messages and reports: [12 months] after they are closed, unless a dispute needs them longer.
• Moderation and security logs: [12 months]. They contain the action taken and technical references, not the content.
• Records we must keep by law, for example tax records: as long as the law requires.

When a retention period ends we delete or anonymise the data.

13. Your rights

You have the right to access your data, correct it, delete it, restrict its use, receive it in a portable format and object to processing based on our legitimate interests. Where processing rests on consent, you can withdraw it at any time. You can export and delete your data yourself in the account page, or write to [privacy contact email]. We answer within one month.

You can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority in the country where you live, for example Datatilsynet in Norway or IMY in Sweden.

14. Age

Accounts, listings and reviews are for people aged 18 or over. We do not knowingly collect data from children for these features. If you think a child has given us data, write to us and we will delete it.

15. Security

We use encrypted connections, one time sign in links, hashed session identifiers, rate limits and access controls. No service is perfectly secure. If a breach puts your rights at risk, we will notify you and the authority as the law requires.

16. Changes

We will update this notice when our practice or the law changes, and tell registered users by email before a material change. The date at the top shows the latest version.