Skip to main content
Skip to main content
Sóller

Privacy Policy

[pendiente Ajuntament] — General introduction paragraph to be provided by the Sóller Townhall DPO.

Data controller

Controller: Sóller Townhall (Ajuntament de Sóller). Tax ID (NIF): [pendiente Ajuntament]. Address: [pendiente Ajuntament]. Email: [pendiente Ajuntament].

Data Protection Officer (DPO)

Data Protection Officer: [pendiente Ajuntament]. Contact: [pendiente Ajuntament].

Purposes of processing and legal basis

The personal data collected through this website are processed for the following purposes and on the following legal bases:

  • Publication of public-works moderated comments — legal basis: consent of the data subject (GDPR art. 6.1.a).
  • Administration of editorial-staff accounts — legal basis: performance of a task carried out in the public interest (GDPR art. 6.1.e).
  • Security, fraud prevention, and operational integrity of the service — legal basis: legitimate interest of the data controller (GDPR art. 6.1.f).
  • Registration and management of participant accounts — legal basis: consent of the data subject (GDPR art. 6.1.a) and, where applicable, performance of a task in the public interest (GDPR art. 6.1.e).

Categories of personal data

The following personal data are collected and processed: (a) email address — used for account authentication, email verification, password reset, and reply notifications; (b) password, stored as a bcrypt hash only — the plaintext password is never retained; (c) display name chosen at registration — used to identify the account holder; (d) language preference; (e) age-gate confirmation (timestamp of the 16+ affirmation); (f) privacy-notice version accepted at registration. No national identity number (DNI/NIE/NIF), telephone number, postal address, financial data, health data, biometric data, or any other special-category personal data are collected or processed.

Retention periods

The personal data processed are retained for the following periods:

  • Approved public comments — indefinite, pending townhall policy decision.
  • Rejected or spam-flagged comments — 30 days from the moderation decision.
  • Hashed IP addresses associated with comment submissions — 24 hours.
  • Administrative sessions — 8 hours from the last activity.
  • Activity log — indefinite, for audit-trail purposes.
  • Participant accounts (email-verified) — retained until account deletion request or [pendiente Ajuntament] inactivity policy.
  • Unverified participant registrations — purged after 7 days if email verification is not completed (ENS-06 retention control).
  • Participant privacy-notice consent records — retained for the lifetime of the account and [pendiente Ajuntament] years post-deletion for legal accountability.

Recipients of the data

[pendiente Ajuntament] — Recipients paragraph to be approved by the Sóller Townhall DPO. Engineering note: the only known sub-processor is Resend (transactional email), subject to Resend's DPA.

Rights of data subjects

Data subjects may exercise the following rights:

Rights

  • Right of access (GDPR art. 15).
  • Right to rectification (GDPR art. 16).
  • Right to erasure (GDPR art. 17).
  • Right to restriction of processing (GDPR art. 18).
  • Right to data portability (GDPR art. 20).
  • Right to object (GDPR art. 21).
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

How to exercise these rights

[pendiente Ajuntament] — Instructions for exercising data-subject rights to be provided by the Sóller Townhall DPO (postal and/or email contact).

Right to lodge a complaint with the supervisory authority

Data subjects have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if they consider that the processing of their personal data infringes data-protection regulations.

Visit the AEPD website (opens in a new window)

This site is not an electronic office

This site is not an electronic office (sede electrónica) of the Sóller Townhall. For administrative procedures and official communications, please visit the Townhall's official electronic office at [pendiente Ajuntament].

Cookies

This site uses only strictly-necessary and functional cookies: an authentication session cookie (authenticated admin and participant account areas) and a theme-preference cookie (local-storage only, not a cookie). No advertising, tracking, or third-party analytics cookies are set. [pendiente Ajuntament] — Cookie policy to be reviewed and approved by the Sóller Townhall DPO before production launch.

Automated decision-making and profiling

No automated decision-making or profiling with legal or similarly significant effect on data subjects takes place on this site (GDPR art. 22). [pendiente Ajuntament] — to be confirmed by the Sóller Townhall DPO.

Legal framework

Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (GDPR), and Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

Last updated: 2026-06-03