Privacy policy

In short

• You can read Costa y Golf without signing up and without giving us any data.
• We use no advertising or analytics cookies, and nothing that follows you from one website to another.
• We do not sell or pass on personal data to anyone.
• Today only the members of the team who prepare the course pages have an account. Before sign-up opens to the public, this page will explain what changes.

Data controller

The controller of the personal data processed on Costa y Golf is its owner:

When you visit the site

To serve you its pages, your browser sends us, as it does to any website, your IP address, the page you ask for, the date and time and the type of browser. The web server keeps no access logs: it only records errors, which may include the IP address of the request that failed, and we use them to keep the site secure and to fix faults. Legal basis: our legitimate interest in the site working and being protected (article 6(1)(f) GDPR).

To stop anyone trying to guess passwords, when you sign in we count the attempts from each IP address for 15 minutes, only in the server's memory: the count is not stored anywhere and disappears on its own.

We use no analytics or advertising tools, and our pages load no fonts, scripts or images from other companies.

Cookies

We only use strictly necessary cookies, the ones needed for what you ask for, and none from other companies. That is why we do not ask for your consent or show a cookie banner: the law does not require it for these (article 22.2 LSSI-CE).

__Host-cyg_session

Keeps you signed in when you sign in to your account. It only exists if you sign in.

Duration: Until you close your browser or, if you tick «Keep me signed in on this device», up to 30 days after you last use it. Signing out deletes it.

cyg_lang

Remembers the language you choose with the flags, so the home page opens in that language next time. It only exists if you press a flag.

Duration: One year.

Some course pages have videos from YouTube and Vimeo. Until you press play, the page does not connect to those platforms: the picture and the button are ours. Pressing it loads their player, in the mode they offer for not using tracking cookies, although they may still store some technical cookies of their own; from then on the platform receives your IP address and your browser's technical details, and processes them under its own privacy policy.

If you have an account

Today only the members of the team who prepare and review the course pages have an account: sign-up is not open to the public. For each account we keep:

• the email address, the name shown, the language and the role in the team;
• the password, never as it is, but transformed with a one-way algorithm (Argon2id) that does not allow it to be recovered;
• for two-step verification, a random seed from which the codes are calculated, and the recovery codes, also transformed;
• for each open session, when it was opened, when it was last used and from which browser (its user agent), so you can recognise it; never the IP address;
• the single-use links to set the password, which expire after 24 hours;
• the date you last signed in.

We use them to give you access, to protect the account and to know who makes each change to the site. Legal basis: your relationship with us as a member of the team (article 6(1)(b) GDPR) and our legitimate interest in protecting the site (article 6(1)(f)).

Club details

Course pages show the contact details each club publishes on its website: telephone numbers, email addresses and postal addresses, usually for reception, bookings or other departments. If one of them belongs to a particular person, we process it on the same basis as the rest of the page: the legitimate interest, ours and that of whoever reads it, in a guide with useful and accurate information (article 6(1)(f) GDPR), and always from what the club itself makes public.

The pages our crawler reads are kept as working material to prepare and update the course pages, and are not published. They may include details of people who appear on those websites, which we do not use for anything else.

If a detail of yours appears on a course page and you do not want it there, write to us and we will remove it.

Who else processes the data

We do not pass personal data on to anyone, unless the law requires it. We do work with providers who process it on our behalf, under contract and only to provide their service to us:

• OVHcloud, which hosts the server and the database in the European Union and keeps the photos and the crawled pages in its storage service in Gravelines (France);
• OpenAI, whose artificial intelligence helps us to sort out the details from the clubs' websites, describe their photos and suggest the text of the course pages. It receives that content from the clubs' websites, never data about the people who visit the site or have an account. It may process it in the United States, an international transfer covered by the European Commission's standard contractual clauses in its data processing agreement.

The emails we send go out from our own mail server.

How long we keep it

• Account data, for as long as the account exists. Deleting it also deletes its sessions, its pending links and its two-step verification.
• Each session, until you sign out or it expires: 30 days after it was last used with «Keep me signed in on this device», or after 12 hours unused if you did not tick it. Expired sessions are deleted every hour, like expired single-use links.
• The web server's error logs, 52 days.
• A club's details and the crawled pages of its website, for as long as the club is in the guide.
• Database backups, made with each update of the site: the five most recent are kept, and anything deleted disappears from them as they are replaced.

Your rights

You can ask us at any time to:

• access your data and receive a copy;
• correct it if it is inaccurate;
• erase it: if you ask us to delete your account, we delete it with all its data;
• object to our processing it, or ask us to restrict its processing;
• receive it in a structured format to take it to another service (portability).

Write to the controller's email address, from your account's address if you have one, and tell us which right you want to exercise. If we cannot tell that it is you, we will ask for the minimum needed to check. It is free, and we will reply within one month at the latest.

Complaining to the authority

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD). We would be grateful if you wrote to us first, in case we can sort it out.

Spanish Data Protection Agency (AEPD)

Children

Costa y Golf is not aimed at children under 14 and we do not knowingly process their data. If you believe we hold data about a child under 14, write to us and we will delete it.

Security

The whole site runs over an encrypted connection (HTTPS). Passwords and recovery codes are stored transformed, never as they are; the session cookie cannot be read by the page's code, and we only store a fingerprint of it; and signing in to the administration area requires two-step verification.

Changes to this policy

We will update this page when what we do with data changes, for example when sign-up opens to the public. The date of the last update is at the top of the page.