Last updated: May 13, 2026
This Privacy Policy explains how personal data is processed in connection with the website indrets.es (the "Website"). It is written to comply with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) — and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
The Data Controller of personal data processed through the Website is:
The Website is a non-commercial personal project. It carries no advertising, no affiliate links, no paid placements, and offers no goods or services. Because the Operator is a natural person who does not carry out commercial activity through the Website, no postal address or company registration number is published; the contact email above is the official channel for exercising data protection rights and for any other formal communication.
The Website is purely informational. It does not have contact forms, user accounts, comment sections, newsletters, or any other feature that requires you to enter personal data.
The only personal data processed through the Website is the data collected automatically through web analytics (see below), and only if you give your consent through the cookie banner.
If — and only if — you give your consent through the cookie banner, the Website uses Google Analytics 4 ("GA4"), a service provided by Google Ireland Limited, to understand how visitors use the Website (which pages they read, in which languages, from which countries, etc.).
In that case, the following categories of data may be processed:
These data are processed by Google on behalf of the Data Controller in aggregated, statistical form. The Data Controller does not combine this analytics data with any other dataset and does not use it to identify individual visitors.
Some pages of the Website display interactive maps provided by MapTiler AG (Höfnerstrasse 98, 6314 Unterägeri, Switzerland). To display a map, your browser sends a request to MapTiler's servers, which technically requires the transmission of your IP address, the referring URL, and standard browser information (user agent, language).
According to MapTiler's documentation, IP addresses are stored only for a maximum of 20 minutes, exclusively for security and abuse-prevention purposes, and are then automatically deleted. MapTiler does not place tracking cookies through the map tiles, does not record how visitors interact with the map, and does not use the data for advertising or profiling.
Switzerland is recognised by the European Commission as a country providing an adequate level of data protection (adequacy decision under Article 45 GDPR), so transfers of personal data to MapTiler do not require additional safeguards such as Standard Contractual Clauses.
MapTiler's privacy policy is available at: https://www.maptiler.com/privacy-policy/
Like every website, the hosting server may keep technical logs (IP address, date and time of request, requested URL, HTTP status, user agent) for the limited purpose of operating the Website securely, detecting abuse, and resolving technical problems. These logs are kept only for as long as needed for these technical purposes and are not used for analytics or profiling.
We process personal data only for the following purposes, and on the following legal bases under Article 6(1) GDPR:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Producing aggregated statistics on how the Website is used, in order to improve content | GA4 analytics data | Consent — Article 6(1)(a) GDPR. You can withdraw your consent at any time (see Section 8). |
| Displaying interactive maps so you can locate cultural sites and points of interest | IP address and basic request data transmitted to MapTiler | Legitimate interest — Article 6(1)(f) GDPR: enabling the visual display of geographic information, which is core to the editorial purpose of the Website, and which cannot technically be provided without transmitting the user's IP address to the map service. |
| Operating the Website securely and resolving technical problems | Server logs | Legitimate interest — Article 6(1)(f) GDPR: the Operator's interest in keeping the Website available and protected against abuse. |
| Complying with legal obligations (e.g. responding to lawful requests from authorities) | Any of the above, where applicable | Legal obligation — Article 6(1)(c) GDPR. |
We do not process any special categories of personal data (Article 9 GDPR). We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
Personal data is not sold, rented, or shared with third parties for marketing purposes. It may be processed by:
United States (Google Analytics 4). Use of Google Analytics 4 involves transferring data to the United States, where Google LLC processes data on Google Ireland's behalf. These transfers take place under one of the following safeguards recognised by the European Commission:
Switzerland (MapTiler). Map tiles are served by MapTiler AG in Switzerland. The European Commission has issued an adequacy decision for Switzerland under Article 45 GDPR, which means that transfers of personal data from the EU to Switzerland are treated as transfers within the EU and do not require additional safeguards.
You can find more information here:
Under the GDPR and LOPDGDD, you have the following rights regarding your personal data:
To exercise any of these rights, please write to datarequest@indrets.es. We may ask you for information to verify your identity before responding, and we will reply within the time limits set by the GDPR (normally one month).
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Spanish supervisory authority:
Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan, 6, 28001 Madrid, Spain https://www.aepd.es
You may also lodge a complaint with the data protection authority of the EU Member State of your residence or place of work.
You can withdraw your consent to analytics cookies at any time by:
After withdrawal, no further analytics data about your visits will be collected. Data collected before the withdrawal remains subject to the retention periods described above.
The Website is not directed at children. We do not knowingly collect personal data from children under the age of 14 (the age threshold for valid consent under Spanish law, LOPDGDD Article 7). If you believe that a child has provided personal data through the Website, please contact datarequest@indrets.es so we can take appropriate action.
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. However, no transmission of data over the Internet can be guaranteed to be completely secure.
This Privacy Policy may be updated to reflect changes in the Website, in the services we use, or in applicable law. The current version is always published on this page, with the date of the last update at the top.
For any question regarding this Privacy Policy or the processing of your personal data, please contact: datarequest@indrets.es