Data protection information
This page explains how the personal data you send through this town's complaints and suggestions box are processed (articles 13 and 14 of the General Data Protection Regulation, GDPR).
Controller
Vilarnau Town Council.
Data processor
En Antena Produccions SL (Tax ID B62608229), which provides the EnaInbox service to the town hall under a data processing agreement (art. 28 GDPR). It only processes the data on the town hall's instructions.
What data we process
The text of the request and the category and location you give; the optional photo (its metadata, such as EXIF geolocation, is removed automatically); your email and, if you give it, your name. If you send it anonymously we ask for no contact details. Your IP address is used only transiently to protect the service against abuse and is not stored with the request.
Purpose
Recording your complaint, incident or suggestion, getting it to the right department, answering it and emailing you at every status change. They are also used, aggregated and without identifying anyone, for response-time statistics.
Legal basis
Processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the town hall (art. 6(1)(e) GDPR), namely citizen service and the right to submit complaints and suggestions. This channel is not the official electronic registry.
Recipients
Only the town hall staff handling the request. As sub-processors, En Antena uses a hosting provider in the European Union, an email delivery service (Resend) and a backup service (Backblaze) that may process data in the United States under appropriate safeguards (standard contractual clauses). The form also uses Cloudflare Turnstile's anti-robot check (see below). No data is passed on to third parties or used for advertising.
Retention
While the request is open and for 24 months after it is closed. After that, the email, name, photos and copies of the emails sent are deleted automatically; the request text and its history are kept, without contact details, as an administrative record. Requests never confirmed by email are deleted after 30 days.
Rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability with the town hall (contact details above). If you think they were not handled properly, you can complain to the Catalan Data Protection Authority (apdcat.cat) or, outside Catalonia, the Spanish Data Protection Agency (aepd.es).
Anti-robot check (Cloudflare Turnstile)
To tell people from bots and prevent automated submissions and abuse, the request form uses Cloudflare Turnstile, a security service of Cloudflare, Inc. When you open the form, Cloudflare processes your IP address and technical data about your browser and device (such as the user agent and TLS fingerprint). It is a security measure necessary to provide the service (art. 32 GDPR). It sets no cookies on this domain. Cloudflare acts as a sub-processor and, when it uses these signals to improve its bot detection, as an independent controller; it may process the data outside the European Union under its data processing terms. Turnstile privacy addendum.
Cookies and browser storage
These pages use no cookies and no tracking identifier; Cloudflare Turnstile's anti-robot check does not set any on this domain either. Your browser may only store the language you choose (local storage) to show you the pages in that language. Visit statistics (Umami) are aggregated and store no identifier.