ESTANCOSABIERTOS

Privacy policy

Last updated: 14 September 2026

This policy explains what personal data EstancosAbiertos.com processes, why, on what legal basis, for how long, and how you can exercise your rights, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This is a translation; if there is any discrepancy, the Spanish version prevails.

Summary

  • Controller: estancosabiertos.com.
  • Purposes: showing you nearby tobacco shops, handling requests from shop owners, protecting the site against abuse, and publishing the directory.
  • No sign-up, no profiling: you don’t have to give us any data to use the site. We don’t sell data or build profiles.
  • Location: only if you allow it in your browser, and we don’t store it.
  • Your rights: access, rectification, erasure, objection, restriction and portability, by writing to estancosabiertos.com.

1. Controller

  • Owner: estancosabiertos.com
  • Tax ID (NIF): estancosabiertos.com
  • Address: estancosabiertos.com
  • Email: estancosabiertos.com

This activity is not required to appoint a data protection officer. For any privacy question, write to the email above.

2. What data we process and why

2.1. Searching for nearby shops

  • Data: your device’s approximate location, only if you ask to search near you and allow it in your browser, or the postcode you type.
  • Purpose: working out which shops are near you and which are open.
  • Legal basis: providing the service you request (Art. 6(1)(b) GDPR). You can withdraw location permission at any time in your browser settings and still search by postcode or city.
  • Retention: coordinates and postcodes are used to answer that search and are not stored in our database. They may briefly appear in the hosting provider’s technical logs (section 2.3).

2.2. “Is this your shop? Claim it” form

  • Data: name, email, phone (optional), message (optional), the shop the request is about, the date, and a pseudonymised identifier of your IP address.
  • Purpose: verifying that you own or represent the shop, contacting you, and correcting, updating or activating the listing.
  • Legal basis: handling the request you make (Art. 6(1)(b) GDPR). The IP identifier is processed under our legitimate interest in preventing spam and abuse (Art. 6(1)(f) GDPR).
  • Required data: name and email. Without them we can’t handle the request.
  • Retention: while we handle the request. Once closed, it is deleted 12 months after it was sent.

2.3. Security and technical operation

  • Data: your IP address, transformed with a keyed hash function before it is stored, together with the section requested and the time. The hosting provider’s technical logs also include the IP, browser, page requested and date.
  • Purpose: limiting abusive requests, protecting the directory against bulk extraction, keeping the site secure and diagnosing errors.
  • Legal basis: legitimate interest in network and information security (Art. 6(1)(f) and Recital 49 GDPR).
  • Retention: rate-limit records are periodically deleted once they are 24 hours old. Hosting logs are kept for the short period set by the provider.

2.4. Emails you send us

  • Data: your email address and whatever you include in the message.
  • Purpose: replying to you and, if you exercise a data protection right, handling it.
  • Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, for rights requests, compliance with a legal obligation (Art. 6(1)(c) GDPR).
  • Retention: as long as needed to reply. Rights requests are kept for up to 3 years so we can show they were handled.

2.5. Shop data published in the directory

Many Spanish tobacco shops are held by an individual, so some shop data may be personal data of the holder. Informing the holders of every shop in Spain individually would involve a disproportionate effort, so this information is made publicly available here (Art. 14(5)(b) GDPR).

  • Data: shop data only: address, postcode, town, shop licence number, coordinates, trading name, shop phone number, opening hours and services. We don’t publish the holder’s name or personal contact details. We also keep, without publishing it, the shop’s public average rating, for internal data-quality checks.
  • Source: official public registers and lists of tobacco shops; open data from public transport authorities (Consorcio Regional de Transportes de Madrid and Red de Consorcios de Transporte de Andalucía); and public business information available online, such as business listings on map services.
  • Purpose: telling the public where each shop is, when it opens and what services it offers. Listing descriptions are written with AI assistance from this same data.
  • Legal basis: legitimate interest (Art. 6(1)(f) GDPR) of this site and its users in knowing the details of businesses open to the public. The data relates only to the business activity, most of it is already public, and publishing it has a low impact on the holder’s privacy (in line with Art. 19 LOPDGDD).
  • Recipients: anyone visiting the site, and the providers listed in section 3.
  • Retention: while the shop remains active, or until the holder objects and the objection is upheld.
  • Your rights as a holder: you can ask us to correct any data or, on grounds relating to your particular situation, object to its publication (Art. 21 GDPR), using the form on the listing or by writing to estancosabiertos.com.

3. Recipients and processors

We don’t sell or share personal data with third parties unless required by law. To run the service we rely on providers that process data on our behalf as processors, under a contract that meets Art. 28 GDPR:

  • Vercel Inc. (United States): site hosting and technical logs.
  • Supabase, Inc. (United States): database storing requests and rate-limit records.
  • Anthropic PBC (United States): AI-assisted writing of listing descriptions. It only receives shop data, never visitor or request data.

Where these providers process data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework adequacy decision, if the provider is certified, or on the European Commission’s standard contractual clauses (Art. 46 GDPR).

4. Analytics and advertising

The site currently uses no third-party analytics or advertising tools. If we add them, they will only run with your prior consent, and we will update this policy and the cookie policy first.

5. Your rights

You can exercise, at any time and free of charge, your rights of:

  • Access: finding out whether we process your data and getting a copy.
  • Rectification: correcting inaccurate or incomplete data.
  • Erasure: asking us to delete your data.
  • Objection: objecting to processing based on legitimate interest.
  • Restriction: asking us to pause processing in certain cases.
  • Portability: receiving the data you gave us in a structured format.

Write to estancosabiertos.com saying which right you want to exercise. If we have reasonable doubts about your identity, we may ask for more information. We reply within one month, extendable by two further months for complex requests (Art. 12(3) GDPR).

If you believe we haven’t handled your request properly, you can complain to the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es).

6. Minors

This site is intended for adults. We don’t knowingly collect data from minors. If we find that a minor has sent us data, we will delete it.

7. Automated decisions

We don’t make automated decisions or build profiles about the people who use the site. The “Open”, “Closed” and “Hours not available” labels are calculated from the shop’s opening hours, not from your data.

8. Security

We apply technical and organisational measures proportionate to the risk: encrypted connections (HTTPS), pseudonymised IP addresses, restricted and authenticated access to the admin panel, and least-privilege database permissions.

9. Changes to this policy

If the way we process data changes, we will update this page and its last-updated date.