Privacy policy

1. Data controller

• Controller: InfoMapa.cat
• Tax ID (NIF): —
• Address: Girona
• Data protection contact: —

We process data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. What data we process and why

We only ask for what each thing needs. Depending on how you use the site:

• If you just browse: your IP address and technical connection data stay in the server logs for a few days for security. The visit counter does not identify you. Your location, if you enable it on the map, is used only on your device and never reaches us.
• If you claim or manage a listing: your email, the business details you enter and, if you buy a plan, billing details and the payment (processed by Stripe: we never see your card).
• If you comment: your email (not published), the name you choose and the comment.
• If you leave a trace or advertise a ground logo: your email, your name if given, the content you upload, the payment and the invoice.
• If you are a seller, host or recruiter: your contact details, your sales activity, commissions, settlements and, if you order merchandise, the shipping address.
• If you write to the contact email: what you tell us, in order to reply.

3. Listings created from public sources

Many listings are created from open data (OpenStreetMap, Overture Maps, businesses’ public websites). These are usually company data, not personal data. If you are a self-employed professional and a listing includes your data, we process it on the basis of our legitimate interest in providing a useful local directory, using information you have made public yourself.

You can claim the listing to manage it, ask us to correct any detail or to remove it by writing to —. We handle these requests free of charge.

4. Legal basis

• Performance of a contract or steps you request (art. 6.1.b GDPR): managing your listing, your access, the services you buy, your commissions as a collaborator.
• Legal obligation (art. 6.1.c): issuing and keeping invoices and responding to authorities.
• Consent (art. 6.1.a): publishing comments and, if you accept it, Google advertising with cookies. You can withdraw it at any time.
• Legitimate interest (art. 6.1.f): site security, anonymous visit statistics and listings from public sources as described above.

5. Who we share data with

We do not sell data. To provide the service we use processors acting on our behalf under contract:

• Server and database hosting: IONOS (European Union).
• Images: Cloudinary (United States).
• Payments: Stripe (Ireland and United States).
• Email delivery: Resend (United States).
• Production and shipping of seller merchandise: Printful (European Union and United States), with the shipping address only.
• Base maps: CARTO and OpenStreetMap, which receive your IP when the map loads.
• AI help to complete listings: Anthropic (United States), with public business data only, never user data.
• Header advertising: Google AdSense, only if you accept it.

Where a provider is outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Hosts (partners who manage a comarca) see the data needed to manage the listings, logos and traces of their comarca, under the same duty of confidentiality.

6. How long we keep data

• While you keep your listing, access or relationship with us, and afterwards for as long as needed to deal with any liabilities.
• Invoices and payment data, for the period required by law (six years under the Spanish Commercial Code, plus tax periods).
• Comments, until you delete them or ask us to.
• Server technical logs, a few weeks.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to — stating your request. We will reply within one month at most.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Minors

Services that require personal data are not intended for children under 14. If you are younger, ask your parent or guardian to do it for you.

9. Security

We apply appropriate technical and organisational measures: encrypted connections, password-free access through single-use expiring links, sessions that close automatically, limited permissions for each collaborator, and backups.