Privacy Policy

The Mancomunidad de Municipios del Valle del Jerte, in compliance with EU Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD), informs you about how your personal data is processed through this website.

1. Data controller

• Name: Mancomunidad de Municipios del Valle del Jerte
• Tax ID (NIF): P1000027A
• Registered address: Paraje Virgen de Peñas Albas s/n, 10610 Cabezuela del Valle, Spain
• Email: gerente@mvj.es
• Phone: +34 927 47 21 34
• Privacy Policy URL: https://mvj.es/politica-de-privacidad/
• Legal Notice URL: https://mvj.es/aviso-legal/

2. Data Protection Officer (DPO)

In accordance with Article 37 of the GDPR and Article 34 of the LOPDGDD, public sector entities are required to appoint a Data Protection Officer.

• Name or entity: GRUPOAYA FORMACIÓN Y PROTECCIÓN DE DATOS, S.L.
• Address: Calle Arias Montano 2, ground floor, 10600 Plasencia (Cáceres), Spain
• Contact: dpo@mancomunidadvalledeljerte.es

3. Personal data we process

3.1 Authorised staff accounts (technicians and administrators)

Access to the administration panel requires authentication via email and password. The data processed is:

• Email address
• Password (stored hashed; never in plain text)
• Assigned panel role (permissions management)
• Session tokens (technical session cookies managed by Supabase)

This website has no open user registration: people browsing the public site cannot create an account or provide credentials. Panel accounts are created and managed internally by the entity's authorised technical staff, who register each user and assign their role. This processing is exclusively for that staff in the performance of their duties.

3.2 Suggestions, complaints and incidents mailbox

The Website includes a participation mailbox through which anyone may send a suggestion, compliment, complaint or incident report. Using this form processes the following data:

• Title and message of the communication (free text provided by the person)
• Type and category of the communication and the language it was sent in
• Related municipality or tourist resource, where applicable (not personal data)
• Optional contact details: name, email and/or phone, only if the person wishes to receive a reply and provides them voluntarily

Contact details are only requested and stored if the person ticks the consent checkbox and chooses to provide them in order to receive a reply. If not provided, the communication is handled without being linked to an identified person. We recommend not including unnecessary personal data in the free-text message.

3.3 «Bosque de la Sabiduría» cultural programme

Through the internal administration panel, the Mancomunidad manages the data of people taking part in the «Bosque de la Sabiduría» cultural and community-outreach programme. This data is not collected through public website forms; it is entered and managed by authorised technical staff based on the information provided by participants (for example, on in-person enrolment sheets). It may include:

• First name, surname, date of birth and town of residence
• Postal address and contact phone number
• Gender, length of residence, availability and areas of interest
• Session attendance, visits, evaluations and observations linked to programme follow-up

Important (legal review): this processing may involve minors (date of birth is recorded) and follow-up evaluations could contain special category data (Art. 9 GDPR). The applicable legal basis, the information provided to participants at enrolment, and the possible need for a data protection impact assessment (DPIA) must be reviewed with legal counsel and the Data Protection Officer.

3.4 Civic participation surveys

The Website includes anonymous civic participation surveys. No identifying data such as name, surname, email or phone number is requested or stored.

To prevent duplicate submissions, a pseudonymised identifier is stored, generated via a SHA-256 hash combining the survey ID, the browser user agent and a local device identifier (stored in localStorage under the key participacion-device-id). This hash cannot identify the user or recover the original IP address.

Data stored per survey response:

• Pseudonymised hash (non-reversible)
• Answers to questions (free text, single choice, multiple choice or scale)
• Submission date and time

3.5 Travel planner and communications

The travel planner lets people generate suggestions without creating an account. To improve the service, we may optionally record the declared postal code, sex, group size, language, selected filters and the number of suggestions shown.

An email address is stored only when the person expressly ticks the checkbox to receive news, activities and other communications from the Mancomunidad. This acceptance is voluntary and can be withdrawn at any time by contacting the Mancomunidad or the DPO. An email entered only to receive the PDF is used to deliver that message and is not added to the statistical capture unless the checkbox is selected.

3.6 Server logs

The hosting provider may temporarily log the following information for operational and security purposes:

• User IP address
• Browser type and version
• Operating system
• Pages visited and time of access
• Referring URL

This Website does not store this information in its own database. Processing falls under the hosting provider Vercel Inc.'s own privacy policy.

4. Purposes and legal basis for processing

5. Recipients and data processors

The Mancomunidad does not sell or share personal data with third parties for commercial purposes. The following providers act as data processors:

6. International data transfers

Data stored in Supabase is hosted on servers in the European Union (eu-west-1 region, Ireland), so no international transfers occur for this service.

Website hosting is provided through Vercel Inc. (United States), which may process access logs outside the European Economic Area. Likewise, the Google Maps integration may involve transferring data to Google LLC servers in the United States. Both providers rely on Standard Contractual Clauses approved by the European Commission as an adequate safeguard.

7. Retention periods

8. Your rights

Under Articles 15–22 of the GDPR and the LOPDGDD, you have the right to:

• Access: find out what personal data is being processed about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data.
• Restriction: limit how your data is processed in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest or public interest task.
• Withdrawal of consent: where processing is based on consent, withdraw it at any time.

To exercise these rights, contact the data controller at the address in section 1. You will receive a response within one month (extendable to three in complex cases).

If you believe your data is not being processed in accordance with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

9. Security measures

The Mancomunidad applies the following technical and organisational measures:

• Encryption in transit via HTTPS (TLS).
• Passwords stored with cryptographic hashing (managed by Supabase).
• Role-based access control (Row-Level Security) in the database.
• IP addresses are never stored in plain text; replaced by a non-reversible SHA-256 hash.

10. Minors

Surveys and the suggestions mailbox do not require identifying personal data. However, if you are under 14 years of age and choose to provide contact details, we recommend obtaining your parents' or guardians' consent.

The «Bosque de la Sabiduría» cultural programme (section 3.3) may record data of minors. In that case, enrolment and consent are obtained from parents or legal guardians in accordance with Article 8 of the GDPR and Article 7 of the LOPDGDD.

11. Policy updates

This Privacy Policy may be updated to reflect legislative or technical changes. Periodic review is recommended.