This policy describes what personal data this site collects, why it is collected, how it is used, and the rights you hold under EU and Spanish data protection law. This site is operated as a personal, non-commercial service — not by a company — and data handling reflects that: minimal collection, no third-party advertising, and no selling of data under any circumstances.
The data controller for all personal data collected via this site is CannaTenerife, contactable at apolo-one@cannatenerife.com and Tenerife. The data controller is the person responsible for deciding how your data is used — they determine the purposes and means of processing your personal information and are accountable for doing so lawfully.
We collect only what is necessary to respond to your introduction request. Nothing more.
| Data Type | What It Is | How Collected |
|---|---|---|
| Full name | Your first and last name | Introduction request form |
| Email address | Your personal email address | Introduction request form |
| Country of origin | The country you are from | Introduction request form |
| Personal introduction | Free-text description of yourself and your reasons for visiting Tenerife | Introduction request form |
| Photograph | A selfie or personal photo provided voluntarily | Introduction request form |
| Technical data | IP address, browser type, device type, pages visited | Automatically, via web server logs |
Photographs submitted via the introduction request form are personal data under GDPR and are handled with particular care. Where a photograph may be used to identify a specific individual, it may constitute sensitive data under Article 9 of the GDPR — however, on this site the photograph is used solely for the author's personal reference when considering an introduction request, and is not processed by any automated system, algorithm, or facial recognition technology. The photograph is never shared with any third party without your explicit prior consent and is deleted once your introduction request has been resolved.
Under GDPR, every piece of personal data must have a lawful basis for processing. Here is the basis for each type collected on this site.
Your data is used for one purpose only: to assess and respond to your introduction request. The specific uses are as follows.
Your data is never used for automated decision-making, profiling, or advertising purposes of any kind.
Third-party form processors
Introduction request submissions are processed via [PLACEHOLDER — CONFIRM WITH ORG], which acts as a data processor on our behalf under GDPR. This means [PLACEHOLDER — CONFIRM WITH ORG] handles the technical transmission of form data on our behalf but is contractually prohibited from using that data for any other purpose. A data processing agreement is in place between this site and [PLACEHOLDER — CONFIRM WITH ORG] in accordance with Article 28 of the GDPR.
No advertising or analytics
This site does not use Google Analytics, Meta Pixel, or any third-party advertising or tracking technology. No personal data is sold, rented, licensed, or otherwise shared with advertisers, data brokers, or marketing platforms of any kind.
Legal requirements
Personal data may be disclosed to law enforcement authorities or other regulatory bodies if required by applicable law or a binding legal obligation. Where we are legally permitted to do so, we would notify you of any such disclosure.
Under GDPR and the Spanish Organic Law on Data Protection (LOPDGDD), you have the following rights regarding your personal data.
Right of Access (Article 15)
You may request a copy of all personal data held about you. We will provide this free of charge within one calendar month.
Right to Rectification (Article 16)
You may request correction of any inaccurate or incomplete data held about you.
Right to Erasure (Article 17)
You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis for processing exists.
Right to Restriction (Article 18)
You may request that processing of your data be restricted in certain circumstances — for example, whilst the accuracy of data is being contested, or whilst an objection is being considered.
Right to Data Portability (Article 20)
Where processing is based on your consent, you may request that your data be provided to you in a structured, commonly used, machine-readable format so that it may be transferred to another controller.
Right to Object (Article 21)
You may object to processing of your personal data where that processing is based on legitimate interests. Processing will cease unless compelling legitimate grounds can be demonstrated that override your interests, rights, and freedoms.
Right to Withdraw Consent (Article 7(3))
Where processing is based on your consent, you may withdraw that consent at any time by contacting us at support@cannatenerife.com. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.
Right to Lodge a Complaint
You have the right to complain to the Spanish data protection supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain. Website: www.aepd.es
To exercise any of the rights listed above, please write to support@cannatenerife.com. We will respond within one calendar month of receiving your request, as required by GDPR Article 12(3).
This site does not use tracking cookies, advertising cookies, or analytics cookies of any kind. The only cookies that may be set are strictly necessary functional cookies required for the form submission mechanism operated by [PLACEHOLDER — CONFIRM WITH ORG] — these contain no personal identifiers and expire at the end of your browser session. No cookie consent banner is displayed on this site because no consent-requiring cookies are used.
This policy may be updated from time to time — the date at the top of the page reflects the most recent revision and should be checked periodically. Where changes are material to the way your data is handled, a notice will be placed on the main pages of this site for a period of 30 days following the update.
For any data protection enquiries, to exercise your rights, or to raise a concern about how your data has been handled, please write to:
We aim to respond to all data protection enquiries within 5 working days. For formal rights requests under GDPR, the statutory response period is one calendar month from receipt.