Privacy Policy
Ver en españolLast updated: 2026-05-29
TOUR RADIUS ("we", "our", "us") respects your privacy and complies with the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD). This policy explains how we collect, use, and protect your information when you use our website.
1. Data controller
The data controller is Juan Carlos Rivera Domínguez. Identification details (including tax ID and address) are provided in the Legal Notice. You can contact us at the email address stated there for any request regarding your personal data.
2. Data we collect
We may collect: (a) Technical data required for operation and security (IP address, browser/device metadata, requested URLs, and error telemetry). The website and database are hosted on a VPS rented from OVH (EU data centres, typically France), deployed via Coolify; OVH and our server may process connection and application logs that can include IP addresses. Public traffic is proxied through Cloudflare (CDN, WAF, and DDoS protection); Cloudflare processes connection data as our perimeter provider. (b) Consent preference stored locally in your browser (localStorage key for cookie/analytics choice). (c) Aggregated usage measurement without analytics cookies: we count page views and certain interactions (for example outbound flight or hotel link clicks and selected in-app actions) as daily totals stored in our PostgreSQL database on OVH. These counters do not use analytics cookies or local storage, do not assign you a persistent identifier, and do not store your IP address in the statistics table. We filter obvious automated traffic where practicable. Legal basis: legitimate interest in understanding whether the service is used and which features work (GDPR Art. 6(1)(f)). We may also use Cloudflare Web Analytics on our domain for aggregated visit statistics without marketing cookies on our configuration. (d) After consent only: optional product analytics via PostHog (EU hosting at eu.i.posthog.com) — page views and non-sensitive events (for example result counts, selected mode, or region filters). We do not use Google Analytics or Plausible on this site. PostHog is limited to event and page-view analytics; we do not enable session replay. (e) Approximate origin suggestion when you request travel suggestions: primarily via a local database on our server (DB-IP Lite, licensed under CC BY 4.0 — IP Geolocation by DB-IP); if that is unavailable, we may use the CF-IPCountry header supplied by Cloudflare (ISO country code only). We do not send your IP to external geolocation APIs. We do not intentionally collect special-category data.
3. Legal basis and purposes (GDPR Art. 6)
We process data on the basis of: (a) Consent (Art. 6(1)(a)) for PostHog analytics (scripts, cookies, and local storage used by that provider) after you accept non-essential cookies. (b) Legitimate interest (Art. 6(1)(f)) for security, fraud prevention, and service reliability — including Cloudflare as perimeter protection (CDN/WAF), and short-lived anti-abuse rate-limit counters that use identifiers derived from IP (HMAC/hash) rather than storing IP in clear in the counter key. (c) Legitimate interest (Art. 6(1)(f)) for aggregated, non-identifying measurement of visits and key interactions (daily counters in our database and, where enabled, Cloudflare Web Analytics) to operate and improve the site; you may object to this processing on grounds relating to your particular situation by contacting us (see section 4). (d) Legitimate interest or your request (Art. 6(1)(f)/(b)) for approximate geolocation to prefill a travel origin suggestion (DB-IP local lookup or CF-IPCountry only), always editable manually. (e) Legal obligation where applicable.
4. Your rights (GDPR Arts. 15–22)
You have the right to: access your data, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, object to processing, and to withdraw consent at any time. You may also lodge a complaint with a supervisory authority (e.g. the Spanish AEPD: www.aepd.es). To exercise these rights, contact us at the email address in the Legal Notice, identifying yourself and stating which right you wish to exercise. We will respond within one month of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension and the reasons. We may request additional information to verify your identity where reasonably required.
5. Retention
We retain personal data only for as long as necessary. In this implementation, consent preference is stored locally in your browser until you clear site data or change your choice; PostHog analytics data retention is governed by our PostHog project settings (EU cloud); aggregated daily usage counters in PostgreSQL are kept as operational statistics (typically retained while the service runs and subject to database backup retention); IP-based location lookup is used to answer the request and is not persisted by default in this application database; anti-abuse rate-limit counters in the shared store are short-lived and opportunistically cleaned (target retention window around 24 hours).
6. Processors and recipients
We use the following categories of providers that may process personal data on our behalf or receive data from your browser when you use the site: (1) OVH — VPS hosting and PostgreSQL database (EU, typically France); role: processor; purpose: run the website, store concert catalogue data, and store aggregated usage counters. (2) Cloudflare — proxied CDN, WAF, and DDoS protection; role: processor; purpose: deliver and protect the site; may supply CF-IPCountry for approximate country; may provide Cloudflare Web Analytics (aggregated visit metrics on our configuration). (3) PostHog (PostHog Inc., EU cloud eu.i.posthog.com) — only after cookie consent; role: processor; purpose: optional product analytics (page views and non-sensitive events). (4) OpenFreeMap (tiles.openfreemap.org) — your browser requests map tiles directly; role: third party receiving connection data (including IP); purpose: display the map; no behavioural cookies on our configuration. We do not use Google Analytics, Plausible, or Sentry on this site. A current list of key providers is set out above; we may update providers with equivalent safeguards.
7. Minors
TOUR RADIUS is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have received such data, contact us using the details in the Legal Notice and we will delete it where required by law.
8. Automated decisions
We do not use your personal data to make automated decisions that produce legal effects on you or similarly significantly affect you (GDPR Art. 22). Product analytics, where enabled with your consent, are used for aggregated understanding of how the site is used, not for automated individual decisions.
9. Security
We implement technical and organisational measures appropriate to the risk, including HTTPS/TLS for connections, perimeter protection via Cloudflare (WAF/CDN), access controls on infrastructure, rate limiting and anti-abuse safeguards on APIs, and minimisation of stored personal data (for example IP-derived rate-limit keys using HMAC rather than storing IP in clear). No system is completely secure; please use strong credentials on your own devices and networks.
10. International transfers
Website hosting and the PostgreSQL database run on OVH infrastructure in the EU; we use OVH as a processor under its GDPR terms (DPA available from OVH). PostHog analytics data is processed in the EU (eu.i.posthog.com). Cloudflare, Inc. may process connection data on infrastructure located worldwide; we use Cloudflare as a processor under its data processing terms and, where required, standard contractual clauses for transfers outside the EEA. We do not use third-party IP geolocation APIs (such as ipapi.co or ipinfo.io).
11. Changes
We may update this Privacy Policy to reflect changes in law, our services, or our providers. The "Last updated" date at the top shows the current version. If we make material changes to how we process personal data, we will publish a clear notice on the website (and update this page) before or when the change takes effect. Where required by law — in particular if we introduce or change non-essential cookies or analytics — we will ask for your consent again via the cookie banner. Continued use of the site after notice does not by itself replace any consent required by law.