Legal information

Privacy policy

Last updated:

1. Data controller

The controller of the personal data collected through this portal is the Instituto de Turismo de la Región de Murcia (ITREM):

  • Tax ID (CIF): Q3000763G
  • Address: Avda. Juana Jugón, 2 — Edificio CCT, 30006 Murcia (Spain)
  • Telephone: +34 968 357 761
  • Data Protection Officer (DPO): dpd@carm.es

2. Purpose

The personal data collected through the portal are processed for the following purposes:

  • To handle enquiries, requests and communications submitted through the contact form.
  • To manage subscription to the destination newsletter and to send tourist information about the Costa Cálida.
  • To measure and improve the portal usage experience by means of analytics tools (Google Analytics 4), with prior consent.
  • To comply with the legal obligations applicable to ITREM.

3. Legal basis

Data processing is based on one or more of the following legal bases, in accordance with Article 6 of Regulation (EU) 2016/679 (GDPR):

  • Consent of the data subject (art. 6.1.a), given by submitting the contact form, subscribing to the newsletter or accepting the cookie banner.
  • Public interest (art. 6.1.e), in fulfilment of ITREM's powers in the field of tourism promotion.
  • Compliance with a legal obligation (art. 6.1.c) applicable to the data controller.

4. Recipients

Data are not disclosed to third parties except where legally required. They may be processed by ITREM's data processors, bound by contract in accordance with Article 28 of the GDPR:

  • SMTP email provider for sending contact form notifications.
  • Newsletter service provider.
  • Google Ireland Ltd. (Google Analytics 4 and Google Tag Manager), with prior consent and IP anonymisation.

No international data transfers outside the European Economic Area are foreseen, except those carried out under the safeguards provided for in Chapter V of the GDPR.

5. Retention period

Data will be kept for the time strictly necessary to fulfil the purposes for which they were collected:

  • Contact form: 1 year from the last communication, unless a longer legal obligation applies.
  • Newsletter: until the user requests to unsubscribe.
  • Analytical cookies: 13 months (Google Analytics 4 by default).

6. User rights

In accordance with Articles 15 to 22 of the GDPR, the data subject may exercise the following rights at any time:

  • Access to their personal data.
  • Rectification of inaccurate or incomplete data.
  • Erasure (right to be forgotten) when the data are no longer necessary.
  • Restriction of processing in the cases provided for.
  • Portability of the data in a structured format.
  • Objection to processing.
  • Withdrawal of consent at any time.

To exercise these rights, send a written request to ITREM, enclosing a copy of an identity document, by any of the following means:

7. Security measures

ITREM applies the technical and organisational measures necessary to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 of the GDPR. The portal uses HTTPS encryption, secure authentication in the administration panel (where applicable) and regular database backups.

8. Supervisory authority

If you consider that the processing of your personal data infringes data protection legislation, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD):

  • Electronic office: sedeagpd.gob.es
  • Address: C/ Jorge Juan, 6 — 28001 Madrid