Privacy policy

This policy explains how the Consell Insular de Formentera processes personal data on the Data Observatory of Formentera website (www.observatorideformentera.cat), in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.

Controller

Consell Insular de Formentera, plaça de la Constitució, 1, 07860 Sant Francesc Xavier (Formentera, Balearic Islands, Spain). Email: info@observatorideformentera.cat.

Data protection officer: info@observatorideformentera.cat.

In short

  • You do not need to register or provide any data to browse the site.
  • We do not use advertising or analytics cookies, nor third-party fonts or scripts: everything is served from our own domain. The only exception is Power BI reports, which load only if you ask for them.
  • We only process the data described below, for the purposes and periods stated.

What data we process and why

1. Website usage statistics

Every time you open a page, your browser sends our server a visit notice. We store the page visited and its type; the date and time; the browser's preferred language; the browser family and device type (for example "Firefox" and "mobile", never the full browser identification string); the truncated IP address (the last 8 bits are set to zero for IPv4 and the last 80 bits for IPv6, so it does not identify any particular connection) and, if Google Cloud's infrastructure provides it, the approximate country or region.

  • Purpose: to understand aggregate use of the site (most visited pages, languages, device types) in order to improve it.
  • Legal basis: performance of a task carried out in the public interest (article 6.1.e GDPR): the dissemination of public and statistical information.
  • Retention: 13 months, after which the records are deleted automatically.
  • Cookies: these statistics use no cookies and store no identifier in your browser.
  • Objection: you can object by writing to the contact address (article 21 GDPR).

2. Virtual assistant (chat)

The site's assistant is an automated artificial intelligence system: its replies are generated by the Google Gemini model from the Observatory's data catalogue. They may contain errors and do not replace official information or assistance from Consell staff. Do not type personal data into it.

  • Data: the text of your questions and of the replies, the language, a random conversation identifier (which does not reveal who you are) and the date. To prevent abuse, the number of messages per hour is counted using a keyed cryptographic digest of the IP address, which is deleted after one hour; the IP address is not stored with the conversations.
  • Purpose: to answer your queries and to review their quality in order to improve the service and detect misuse.
  • Legal basis: task carried out in the public interest (article 6.1.e GDPR).
  • Processor: Google, which processes the text of each query to generate the reply on behalf of the Consell. The Gemini service is contracted on Google's paid terms (a Google Cloud project with active billing): Google does not use queries or replies to improve its products and only keeps them for a limited time to detect prohibited use. It processes them under the Google Cloud Data Processing Addendum, as a processor; the contracting entity is Google Cloud EMEA Limited (Dublin, Ireland). Any transfer of data outside the European Economic Area is covered by the European Commission's standard contractual clauses and by the EU-U.S. Data Privacy Framework.
  • Retention: conversations are deleted automatically after 90 days.

3. Surveys

The public surveys on the site (for example, those of the astronomy activities) are anonymous: they collect answers such as nationality, type of visitor, age group, ratings and free-text comments, but not your name, email or IP address. To prevent mass submissions, the server temporarily counts submissions per IP address in memory, without storing it. Do not type personal data into the comments. Answers are used in aggregate form to evaluate the activities and for tourism statistics (article 6.1.e GDPR) and, as they identify no one, they are kept as statistical data.

Staff at the tourist information offices record on the site the enquiries they handle (type of enquiry, general origin —country, Spanish region or postcode— and group size), without any data that identifies the visitors.

4. Restricted access (Consell and office staff)

  • For internal users (administration panel and the offices' form) we process the username, email address and role, and a technical session cookie that expires after 24 hours.
  • To protect access against attacks, each staff sign-in attempt records a keyed cryptographic digest of the IP address and of the account name, and the account's internal identifier when it exists (never the text typed as username or the password), the number of attempts and the time of the last attempt and of the last successful access. Lockouts last 30 minutes and these records are deleted automatically after 30 days.
  • Legal basis: task carried out in the public interest and security of information systems (article 6.1.e GDPR and Royal Decree 311/2022 on the National Security Framework).

5. Email communications

If you write to the contact address, we will use your data only to reply to you and handle your request, and we will keep it for as long as needed to do so and to meet the Consell's record-keeping obligations.

Power BI reports (Microsoft)

Some older reports are embedded from Microsoft's Power BI service. They do not load until you press "Load the report". When you do, your browser connects directly to Microsoft servers, which receive your IP address and may store cookies and identifiers under the Microsoft privacy statement. The Consell does not receive that data. You can withdraw the remembered consent in the Cookie policy.

Hosting and recipients

The site runs on Google Cloud (Cloud Run and Firestore), which acts as a processor. The Firestore database and the service are hosted in Google Cloud's europe-west1 region (Belgium, European Union). No data is disclosed to third parties unless required by law.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@observatorideformentera.cat or by submitting a written request at the General Registry of the Consell Insular de Formentera. If you consider that your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Changes to this policy

Version 2, 23 September 2026.