1. Who we are
CaminoRoutes.org is operated by the International Camino Wayfinding Secretariat, acting as data controller for the personal data described in this policy. You can reach us at [email protected].
2. What data we collect
Contact and submissions: when you email us or send a property listing, we receive the data you include — typically your name, email address, phone number, property details and the content of your message.
Purchases: if you buy a digital guide, our payment provider processes your payment details. We never see or store your full card data; we receive only the confirmation and the email address needed to deliver your download.
Cookies and similar technologies: essential cookies that make the site work, plus — only with your consent — analytics and marketing cookies.
Analytics: aggregated, largely anonymous information such as pages viewed, approximate region, device type and referring site, collected only if you accept analytics cookies.
Server logs: technical data such as IP address, browser and timestamps, kept briefly for security and troubleshooting.
3. Why we process it, and on what legal basis
To answer your messages and provide pilgrim support — legitimate interest, or performance of a contract where your request concerns a purchase.
To deliver and update the digital guides you bought — performance of a contract.
To publish accommodation listings you submit — your consent, given when you send them.
To measure and improve the website through analytics and marketing cookies — your consent, which you can withdraw at any time.
To keep the site secure and comply with accounting and legal obligations — legitimate interest and legal obligation.
4. How long we keep it
Email correspondence is kept for up to 24 months. Purchase and invoicing records are kept for the period required by tax law (usually up to 10 years). Cookie consent choices are stored for up to 12 months. Published listings remain until you ask us to remove them.
5. Who we share it with
We share data only with service providers acting on our behalf: website hosting, email delivery, payment processing and analytics. These providers process data under contract and only on our instructions.
We do not sell your personal data. Where a provider processes data outside the European Economic Area, we rely on the European Commission's standard contractual clauses or an adequacy decision.
6. Your rights under the GDPR
You have the right to access the personal data we hold about you and to receive a copy of it.
You have the right to rectification of inaccurate or incomplete data.
You have the right to erasure ("right to be forgotten") where we have no overriding legal reason to keep the data.
You have the right to restriction of processing and the right to object to processing based on legitimate interests.
You have the right to data portability — to receive your data in a structured, commonly used, machine-readable format.
You have the right to withdraw consent at any time, without affecting processing carried out before withdrawal.
You have the right to lodge a complaint with your national data protection supervisory authority.
7. How to exercise your rights
Send your request to [email protected] with the subject line "GDPR request". We respond to all privacy requests within one month, and in most cases within 24 working hours of receipt for a first acknowledgement.
8. Cookies and your choices
When you first visit the site, a banner lets you Accept All, Reject Non-Essential, or Manage Preferences by cookie category. Essential cookies cannot be switched off because the site cannot function without them.
You can change your decision at any time by clearing this site's data in your browser and choosing again on the banner, or by writing to us.
9. Children
The website is not directed at children under 16. We do not knowingly collect their personal data; if you believe we have, please contact us and we will delete it.