Privacy policy

Last updated: 13 August 2026

Data controller

The controller of your personal data is ALGORENTA, S.L., the company that owns the Nalucam service. Its registered office, commercial registry details and contact email address are published in the legal notice on this same website, and that address is also the channel for anything related to this policy.

ALGORENTA, S.L. has not appointed a data protection officer, because it carries out no large-scale processing, no systematic monitoring and no processing of special categories of data. This is stated here because an absence is information too.

What data we collect and where from

All the personal data we process is given to us directly by you when you join the early access list. We do not buy it, we do not obtain it from third parties and we do not combine it with any other source.

• Email address, required: this is where we send the confirmation message and the launch notice.
• Town, required: this is the piece of information that decides which beaches get the first cameras.
• First name and surname, optional: they let us address you by name.
• Activities and comments, optional: they tell us what you expect from the service.

The email address and the town are required: without the first we cannot confirm your sign-up, and without the second your sign-up does not carry the very information the list exists for, so without them there is no sign-up. You may leave every other field blank and your sign-up remains valid.

If you accept audience measurement, we also process technical data about your browsing of the site: pages viewed, where the visit came from and approximate device details. If you do not accept it, none of that is collected.

Purpose and legal basis

The early access list data is processed to let you know when the service opens in your town and to decide the order in which cameras are installed. The legal basis is your consent under article 6.1.a of the Regulation, which you give by confirming your sign-up from the message we send you by email.

Audience measurement data is processed to understand which parts of the site are used and to improve it. Its legal basis is also your consent, the one you give in the cookie notice: until you give it, no measurement tool is loaded.

Accepting this privacy policy and accepting the cookie notice are separate decisions and are asked for separately: accepting one does not accept the other. You can withdraw either of them whenever you want, and withdrawing is as easy as giving it was. Withdrawing consent does not affect the lawfulness of processing carried out before.

No automated decisions producing legal effects on you or similarly significantly affecting you are taken, and no profiling is carried out with your data.

Data processors

To run the service we rely on providers who access the data on our behalf and only under our instructions, under the processing agreement required by article 28 of the Regulation. None of them processes your data for their own purposes.

Server hosting is provided by Hetzner Online GmbH, in data centres located in Germany. The early-access list confirmation message is sent by Scaleway SAS, in data centres located in France.

Audience measurement runs on software installed on our own server, so no third party is involved in it. No international data transfers take place: all processing happens within the European Economic Area.

Retention periods

Early access list data is kept until the service opens in your town or until you ask to be removed, and in any case for a maximum of 25 months from your last interaction with us. Once that period is over, it is deleted.

Audience measurement data is kept for a maximum of 25 months, and the identifier that measurement stores in your browser expires after 13 months. These are the periods set by the Spanish Data Protection Agency in its audience measurement guidance, and we apply them even though our processing does not rely on the exemption that guidance covers.

The record of your cookie decision is stored in your own browser for 24 months. Once that period is over you are asked again, because an expired decision is neither acceptance nor refusal: it is the absence of a decision.

ARSULIPO rights and how to exercise them

The Regulation grants you six rights over your personal data, usually summarised in Spain with the initials ARSULIPO:

• Access: find out whether we process data about you, what it is, and obtain a copy.
• Rectification: correct inaccurate data and complete anything that is incomplete.
• Erasure: ask us to delete it once it is no longer needed or you withdraw consent.
• Restriction of processing: ask us to keep the data without using it while a challenge is resolved.
• Portability: receive the data you gave us in a commonly used, machine-readable format, or ask for it to be sent to another controller.
• Objection: object to the processing on grounds relating to your particular situation.

To exercise any of them, write to the email address given in the legal notice, saying which right you are exercising. We will reply within one month of receiving your request. Exercising them is free of charge.

To leave the early access list you do not even need that: every message we send you includes an unsubscribe link that does it in a single step.

Complaints to the AEPD

If you believe that the processing of your data does not comply with the rules, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), the supervisory authority with jurisdiction in Spain, through its electronic office at www.aepd.es.

Before going that far you can write to us: we would rather sort it out directly, and we answer any request within one month.

Changes to this policy

This policy may change if the processing, the providers or the applicable rules change. The date of the last update appears at the top of the document, and that is what lets you check at a glance which version you are reading.

Where a change affects the purposes of the processing we will ask you again rather than assume your consent. Changes do not apply retroactively: processing already carried out is governed by the policy published at that time.