Privacy Policy

Last updated: July 12, 2026

This page explains how Enjoy Gran Canaria handles personal data collected through this website.

Important launch note: the newsletter subscription feature must remain disabled until the final controller identity, business address, sender address, and legal wording are approved for production use.

Controller

Enjoy Gran Canaria is operated by an individual business. The final legal name, business identifier where required, postal address, and monitored contact email must be published here before enabling newsletter subscriptions in production.

Data We Collect

We may process:

contact details you submit, such as your email address;
newsletter preferences, language, consent version, signup source, and signup timestamp;
technical request metadata needed for security and abuse prevention, such as browser information, referrer, origin, and IP-related forwarding headers;
content or details you submit through public forms, such as FlashPlan submissions;
usage data and cookies needed to operate and improve the website.

Newsletter signup uses double opt-in. After you submit the form, you must confirm the link sent to your email address before receiving newsletters.

The newsletter may include weekly agendas, events and community updates, articles and guides, Enjoy Gran Canaria news, services, shop content, and selected partner or promotional offers when you choose that preference.

The subscription flow is:

the static website sends your request to a server-side Napkin gateway;
Napkin validates the request, checks that newsletter signup is enabled, and forwards only normalized data to n8n;
n8n checks the shared secret, re-checks the feature flag, validates consent and preferences, and calls Brevo double opt-in;
Brevo stores the contact, preferences, double opt-in state, unsubscribe state, suppression state, and consent evidence.

Enjoy Gran Canaria does not store a public subscriber list in PocketBase for the first release. Brevo is the authoritative newsletter contact database.

Every campaign must include an unsubscribe link and, where available, a preference-management link. Unsubscribe, bounce, blocklist, and suppression states are handled by Brevo and must not be overwritten locally.

Processors

The newsletter provider is Brevo. Brevo processes newsletter contact data, double opt-in messages, unsubscribe and suppression state, and campaign delivery events.

Napkin and n8n process subscription requests as server-side gateway and workflow systems. PocketBase stores non-secret site settings such as whether the newsletter form is enabled.

Tracking

Open or click tracking for newsletter campaigns must not be enabled unless it is disclosed here and in email/footer copy before the first public send.

Retention

Newsletter contact and consent evidence is retained in Brevo while you remain subscribed and as long as needed to prove consent, respect unsubscribes and suppression, resolve disputes, or comply with legal obligations.

Operational gateway logs, if enabled, should avoid storing full email addresses or raw provider payloads unless required for security or legal reasons.

Your Rights

You may ask to access, correct, export, or delete personal data where applicable. You may withdraw newsletter consent at any time by using the unsubscribe link in an email.

Some records may need to be retained when required by law, for security, or to respect unsubscribe and suppression lists.

Security

No Brevo API key, n8n shared secret, Turnstile secret, or provider credential is exposed in the browser bundle. Public subscription requests go through server-side validation before reaching Brevo.

No method of online transmission or storage is completely secure, but the implementation is designed to minimize public exposure of secrets and personal data.

Contact

Use the contact page for privacy questions until the final monitored privacy contact address is published here.