This policy describes how we process personal data on www.mercadillosemanal.com in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Data controller
Óscar Pacheco García, Spanish tax ID (NIF) 48497781G, Calle Estrada da Granxa 126, 27002 Lugo, Spain. Email: [email protected].
What data we process and why
This website works without user accounts: we do not ask for registration, a name or an email address to browse the directory or to take part. The processing activities are:
- Anonymous contributions (reviews, ratings, confirmations of details, questions and photos): we store the content submitted and a pseudonymised identifier derived from the IP address (an irreversible keyed hash), which we use only to prevent abuse (mass submissions, rating manipulation). We do not store the plain IP address with the contribution. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in maintaining the integrity of the service.
- Signing a review: when you rate a market you may write a name or a nickname. It is optional — if you leave it blank, your review is published unsigned — and, if you fill it in, it is published as written next to your rating and may appear in search engine results. We recommend a nickname or a first name, not your full name. We do not ask for any other contact details. Legal basis: consent (Art. 6(1)(a) GDPR), which you give by writing it. You can ask us to remove it at any time.
- Contact form: the message and, if you choose to provide it, an email address so we can reply. Legal basis: consent (Art. 6(1)(a) GDPR) and, where applicable, legitimate interest in handling the request.
- Technical server logs (IP, date, page requested), needed to serve the website and keep it secure. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Advertising and measurement: we use Google AdSense and Google Analytics, which only use cookies and process data for personalisation purposes if you accept this in the consent dialog. If you decline, non-personalised ads are shown and measurement is carried out without cookies. Details in the cookie policy. Legal basis: consent (Art. 6(1)(a) GDPR).
How long we keep the data
- The pseudonymised identifier linked to each contribution is kept for a short period (as long as needed for review and abuse control) and is then unlinked; the published contribution is left without any identifying data.
- Contact messages are kept while the enquiry is being handled and for one year at most.
- Technical server logs are kept for a maximum of 12 months.
Recipients and processors
We do not share personal data with third parties unless required by law. We use infrastructure providers as data processors: Supabase (database), Vercel (web hosting) and Google (advertising and analytics, subject to consent). Some of these providers may process data outside the European Economic Area; in that case the transfers are covered by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission.
Registered users of the previous site
The previous version of this website allowed users to create accounts. That system has been withdrawn and the old accounts are being deleted. If you had an account and wish to exercise your rights over that data, write to us at [email protected].
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [email protected] or to the postal address above, including information that allows us to identify the data concerned (for example, the URL of the page). You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Changes to this policy
This policy may be updated following changes in legislation or in the service; the version in force will always be the one published on this page.