🔒 Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

If you have any questions about this privacy policy or how we handle your data, please contact us using the information above.

2. Data We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

• Contact us: Name, email address, message content
• Report spots: Contact information, spot details, photos
• Use search features: Search queries and filter preferences

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

Data Type	Purpose	Legal Basis
IP Address (anonymized)	Security, analytics, geolocation	Legitimate interest
Browser information	Technical optimization	Legitimate interest
Device type	Responsive design	Legitimate interest
Usage patterns	Website improvement	Consent (analytics cookies)
Page views	Performance monitoring	Legitimate interest

3. How We Use Your Data

3.1 Essential Purposes

We use your data for essential website functions:

• Providing search and directory services
• Responding to your contact requests
• Processing spot reports and updates
• Ensuring website security and preventing abuse
• Complying with legal obligations

3.2 Analytics & Improvement (with consent)

With your consent, we use data for:

• Understanding how visitors use our website
• Improving user experience and functionality
• Analyzing popular spots and search trends
• Technical performance optimization

4. Cookies & Tracking Technologies

4.1 Cookie Categories

Category	Purpose	Duration	Consent Required
Essential	Basic website functionality, security	Session / 1 year	❌ No
Analytics	Usage statistics, performance monitoring	1 year	✅ Yes
Marketing	Personalized content (if implemented)	1 year	✅ Yes

4.2 Managing Your Cookie Preferences

You can control cookies through:

• Our cookie banner (first visit)
• Browser settings (delete/block cookies)
• Contacting us to update preferences

Note: Disabling essential cookies may affect website functionality.

5. Data Sharing & Third Parties

5.1 We Do NOT Sell Your Data

We never sell, rent, or trade your personal information to third parties for commercial purposes.

5.2 Limited Data Sharing

We may share data only in these specific cases:

• Service providers: Hosting, analytics (with data processing agreements)
• Legal requirements: When required by law or legal process
• Safety: To protect our users or prevent illegal activities
• Business transfer: In case of merger or acquisition (with notice)

5.3 International Transfers

Your data is primarily processed within the EU. Any transfers outside the EU are protected by appropriate safeguards such as Standard Contractual Clauses.

6. Data Retention

Data Type	Retention Period	Reason
Contact form submissions	3 years	Customer service, follow-up
Website analytics	2 years	Performance analysis
Security logs	1 year	Security monitoring
Cookie preferences	1 year	Remember your choices
Spot reports	Indefinitely	Public directory service

We regularly review and delete data that is no longer necessary for our stated purposes.

7. Your Privacy Rights (GDPR)

Under EU data protection law, you have the following rights:

7.1 Access & Information

• Right to know: What data we have about you
• Right of access: Get a copy of your personal data
• Right to portability: Receive your data in a structured format

7.2 Control & Correction

• Right to rectification: Correct inaccurate data
• Right to erasure: Delete your data ("right to be forgotten")
• Right to restriction: Limit how we process your data

7.3 Consent & Objection

• Right to withdraw consent: For analytics and marketing
• Right to object: To processing based on legitimate interest

7.4 Complaint Rights

If you're not satisfied with how we handle your data, you can file a complaint with your local data protection authority.

8. Data Security

8.1 Technical Measures

• Encryption: HTTPS for all data transmission
• Access controls: Limited access to personal data
• Regular updates: Security patches and monitoring
• Backup protection: Secure data storage and backups

8.2 Organizational Measures

• Staff training: Data protection awareness
• Privacy by design: Built-in data protection
• Regular reviews: Security and privacy assessments
• Incident response: Procedures for data breaches

8.3 Data Breach Notification

In case of a data breach affecting your personal data, we will:

• Notify supervisory authorities within 72 hours
• Inform affected users without undue delay
• Provide clear information about the incident
• Take immediate steps to prevent further breaches

9. Contact & Updates

9.1 Privacy Questions

9.2 Policy Updates

We may update this privacy policy to reflect:

• Changes in our data practices
• Legal or regulatory requirements
• New features or services

Notification: Significant changes will be announced on our website and via email if you've provided contact information.

9.3 Effective Date

This privacy policy is effective as of January 25, 2025.