Privacy
Data controller
Owner: Eduard Manzano
Trading name: Berguedà Romànic (projecte de Krònia Tours)
Email: hola@kronia.cat
Website: https://romanic.aprop.app
What data we process
1. If you create an account (optional). The name you provide, your email address, your password — always stored hashed (scrypt), never in clear text and never recoverable — and the list of stops you have scanned, together with the date the account was created.
2. If you don't create an account. We send no personal data to our servers. Your progress, your chosen language and your answer to the cookie banner are stored only on your own device and never leave it.
3. Usage data. If you accept analytics cookies, we collect aggregated statistics through Google Analytics: pages viewed, stops scanned, language, visit duration and technical device data. This does not identify you personally and is not combined with your account.
What we use it for, and on what legal basis
- Keeping your account and progress across devices. Legal basis: your consent, given when you create the account (Art. 6(1)(a) GDPR).
- Answering enquiries you send us by email. Legal basis: your consent.
- Understanding how the guide is used in order to improve it. Legal basis: your consent, given by accepting analytics cookies, which you can withdraw at any time.
Your data is never sold or transferred to third parties for commercial purposes, and is never used to advertise to you.
How long we keep it
Account data is kept for as long as the account exists. If you ask us to delete it, it is removed together with all its progress and no recoverable copy remains.
Google Analytics statistics are retained according to that service's settings, for a maximum of 14 months.
Who else has access
To operate, the service is hosted and delivered through the following providers, acting as data processors:
- Hetzner Online GmbH (Germany) — hosting of the website and of account data.
- Google Ireland Ltd. — usage statistics (Google Analytics 4), only if you accept analytics cookies.
- Bunny.net — delivery of the guide's videos and audio.
The site also embeds a chat assistant that opens inside the app. Anything you type there is processed by the provider of that service; please do not enter personal data you would rather not share.
International transfers
Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on European Commission adequacy decisions or on the standard contractual clauses approved by it.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to hola@kronia.cat, stating clearly what you are requesting and writing from the same address you registered with.
You may also withdraw your consent to analytics cookies at any time by clearing this site's data in your browser.
If you believe we have not handled your request properly, you may lodge a complaint with the Catalan Data Protection Authority (APDCAT) or the Spanish Data Protection Agency (AEPD).
Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), passwords always stored hashed and salted, rate limiting on login forms, and restricted access to the administration panel.
No system is infallible: should a breach ever affect your rights, we would inform you and notify the supervisory authority within the legal deadlines.
Children
This site is not aimed at children under 14 and does not knowingly request personal data from them. If we find an account created by a child under 14 without the consent of their guardian, we will delete it.
Changes to this policy
This policy may be updated if our services or the applicable rules change. The version in force is always the one published on this page.