Privacy policy
Last updated: July 31, 2026
In accordance with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), this policy explains what personal data Hey Lanzarote processes, for what purpose, and what rights you have over it.
1. Data controller
Cristian González Romero, Tax ID (NIF) 787662863T, address at Calle Salazones nº 7, 2º, 35500 Arrecife, Las Palmas (Lanzarote).
Privacy contact: [email protected].
2. What data we process and why
Data you provide when contacting us by email or when claiming a business listing: name, email, phone number and business details (name, address, opening hours, photos). We use this to respond to your query and to publish or correct the relevant listing.
Aggregated, anonymous browsing data measured with Umami, an analytics tool we host on our own servers: pages viewed, approximate country, device and the number of clicks that leave the site towards a business (map, phone or website). It uses no cookies, creates no persistent visitor identifier and cannot reconstruct one person’s browsing; it only tells us which pages are read and how many customers each business is sent.
Technical error data: if something breaks in your browser while you use the site, the error message and the page address are logged in GlitchTip, which we also host on our own servers and which is configured to discard the IP address. It cannot identify you; it only serves to spot and fix faults.
We do not collect special categories of data (health, origin, beliefs, etc.), nor do we request them in any form on the site.
3. Legal basis
Consent: when you send us a form or email accepting this policy.
Performance of a pre-contractual or contractual relationship: when handling the creation or correction of a business listing.
Legitimate interest: to keep the published information accurate and up to date.
4. Retention
Enquiry data is kept for as long as the request is being handled and, at most, 12 months without further activity.
Data associated with an active business listing is kept for as long as the business exists and the listing is published, or until its owner requests removal.
5. Recipients
Personal data is not sold or shared with third parties for commercial purposes.
Technical providers necessary to operate the website — server hosting (Hetzner Online GmbH, data centre in Germany), the network that serves and protects the traffic (Cloudflare, Inc.), email and, if activated in the future, excursion-booking tools — may access minimal data under a data-processing agreement (GDPR art. 28). Audience analytics and error logging are not shared with any third party: we host them ourselves on that same server.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to [email protected].
If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
Reasonable technical and organisational measures are applied to protect data against unauthorised access, loss or destruction, including encrypted communications via HTTPS.
8. Updates
This policy may be updated to reflect legislative changes or changes to how the website works. The date of the last update appears at the top of this page.