Privacy Policy

Last updated:7 October 2026

This Privacy Policy explains how the official tourism app of San Lorenzo de El Escorial and the website sanlorenzoturismo.es (hereinafter, "the app") collect, use, store and protect your personal data, including your location, and what rights you have over them. It applies to the app versions for Android (Google Play) and iOS (App Store).

1. Data Controller

• Responsible:San Lorenzo de El Escorial Town Hall
• Address:Plaza de la Constitución, 3, 28200 San Lorenzo de El Escorial (Madrid), Spain
• Data Protection Officer:dpd@aytosanlorenzo.es

2. What data we collect

We only collect the necessary data for the app to function. Many of these depend on permissions that you decide to grant:

• Location:precise (GPS) and approximate location of the device, in foreground and, only if you enable it on Android, also in background. Detailed in section 3.
• Bluetooth:the app searches for City Council beacons installed next to monuments and points of interest. It only reads the beacon's identifier and the approximate distance; it does not connect to other devices nor collect data from them.
• Account details (optional):if you register, your username, your email and your password (which is stored encrypted). You can use the app without registering.
• Content you generate:favourite places and routes that you create or save.
• Camera:only for scanning QR codes of monuments and routes. The image is processed on the device; we do not store or send photos.
• Push notifications:if you accept them, a device notification identifier and the app language.
• Usage data (only if you agree):screens visited and actions within the app, with pseudonym identifiers. See section 4.
• Technical data and bug reports:device model, operating system, app version and technical failure information.

We do not collect special categories of data (health, ideology, etc.), nor contacts, photos, messages or payment data. We do not use the device advertising identifier.

3. Use of your location

The app requests access to your device's location (precise and approximate location). Only access it after you accept the operating system permission. If you refuse, the app continues to work, but without location-based features.}

While using the app (foreground)

• Show your position on the interactive map and nearby monuments, restaurants, accommodation and other points of interest.
• Calculate how to get to a place or a route: we send your starting point to our server, which obtains the route via the Google Maps service.
• Generate a custom route from your location, only if you check that option when creating the route.
• Detect nearby Bluetooth beacons to show you information about the monument next to where you are.

With the app closed or in the background (Android only, optional)

On Android, you can voluntarily activate the feature"Background points of interest detection"from the app's settings. If you activate it, the app will ask you for permission tolocation "Allow all the time"and the notification permission, and it will continue searching for the City Council's Bluetooth beacons even if the app is closed or you are not using it, to alert you with a notification when you pass by a monument.

• While this feature is active, Android shows a permanent notification to indicate this.
• Detection is done on your device: we do not send your location to any background server nor do we record your movements.
• You can disable it at any time from the app settings or by removing the background location permission in the Android settings.
• This feature is not available on iOS: on iPhone, the app only uses location while it is open.

How we treat and store your location

• We do not store your location or a history of your movements, and we do not associate it with your account. The coordinates sent to calculate a journey or generate a route are used only for that request and are not stored.
• We do not sell your location or use it for advertising or profiling purposes.
• We only share it with Google (maps and route calculation service) to the extent strictly necessary to provide the function you request.

How to withdraw the permit

You can disable location access at any time from your device settings: on Android,Settings > Applications > San Lorenzo Tourism > Permissions > Location; on iOS,Settings > Privacy & security > Location > San Lorenzo Turismo.

4. Usage analytics, errors and notifications

• Usage analytics (Google Firebase Analytics):isdisabled by defaultand it is only activated if you accept it; you can change it whenever you want from the app settings. It allows us to know which sections are used most to improve the app. It records screens visited and actions (for example, opening a monument's page or which beacon has been detected), with a pseudonymised identifier. It does not send your GPS location, your email or your name.
• Error reports (Sentry):when the app fails, a technical report (error type, device, operating system and app version) is sent so that it can be corrected. Before sending it, we remove sensitive data.
• Push notifications (OneSignal):if you agree to receive notifications, we use your device's notification identifier, the app's language, and, if you are logged in, your internal user identifier, to send you alerts about events and tourist news. You can disable them in your device settings.

5. Why we use your data and legal basis

• Provide the app service(map, routes, place profiles, favourites, account): performance of the service you request (Art. 6.1.b GDPR).
• Location, Bluetooth, camera, notifications and usage analytics:your consent, which you give when granting each permission or activating each option, and which you can withdraw at any time (art. 6(1)(a) GDPR).
• Keeping the app secure and fixing bugs:performance of a task carried out in the public interest, the tourism promotion of the municipality (Art. 6.1.e GDPR).

We do not make automated decisions that produce legal effects on you.

6. Who we share your data with

We do not sell or transfer your personal data. Only the providers that provide the necessary technical services, acting on behalf of the City Council and under a data processing agreement, have access to them:

• Google LLC / Google Ireland:maps and route calculation (Google Maps) and usage analytics, if you accept them (Firebase Analytics).
• Functional Software, Inc. (Sentry):error reports.
• OneSignal, Inc.:sending push notifications.
• App hosting and maintenance providers, and for its servers.

Some of these providers may process data in the United States. These transfers are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We may also disclose data to authorities when required by law.

7. How long do we keep your data

• Account data, favorites and routes: as long as you keep your account active. They will be deleted upon deletion, unless law requires their retention.
• Location: not preserved.
• Usage analytics data: a maximum of 14 months.
• Bug reports: the time required to resolve the incident, up to a maximum of 90 days.
• Notification identifier: until you uninstall the app or disable notifications.

8. Delete your account and your data

You can delete your account and associated data at any time directly from the app, in the User Profile section. You will find the steps inDelete your account. You can also request it by writing todpd@aytosanlorenzo.es.

9. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent at any time, by writing todpd@aytosanlorenzo.esvia the Electronic Register of the Town Hall's Electronic Office or in person at the General Registry (Plaza de la Constitución, 3). More information atPersonal data protection.

If you consider that we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Security

We apply appropriate technical and organisational measures to protect your data, in accordance with the National Security Framework (Esquema Nacional de Seguridad): communications between the app and our servers are encrypted (HTTPS/TLS), passwords are saved encrypted, and session credentials are stored in the device's secure storage.

11. Minors

The app is intended for a general audience. We do not consciously collect data from children under 14 years of age. If you are under that age, you need the consent of your mother, father, or guardian to create an account.

12. Changes to this policy

We may update this Privacy Policy. We will post any changes on this page with the updated date and, if relevant, we will notify you in the app.

For any questions regarding this policy, write todpd@aytosanlorenzo.es.

PRIVACY AND DATA PROTECTION POLICY

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR) and Organic Law 3/2018 (LOPDGDD), users are informed about the processing of personal data that is provided through this website.

DATA CONTROLLER

• Entity: Ayuntamiento de San Lorenzo de El Escorial
• Address: Plaza de la Constitución, 3, 28200 San Lorenzo de El Escorial (Madrid)
• Data Protection Officer (DPO): dpd@aytosanlorenzo.es

PURPOSE OF DATA PROCESSING

Personal data collected through the various web forms (contact, registration for cultural and sporting activities, libraries, suggestions, newsletters, or citizen participation) will be processed for the specific purpose of managing the request submitted by the interested party, providing the required municipal services, and keeping users informed about the municipality's activities and calls for applications when they have so authorised.

LEGITIMATION

The processing of your data is carried out in compliance with legal obligations, the exercise of public powers conferred on the City Council, or on the basis of the explicit consent provided by the data subject when completing and submitting the corresponding forms.

RECORD OF PROCESSING ACTIVITIES

You can consult the detailed information regarding the purposes, legal bases, and possible transfers corresponding to each municipal area (Culture, Sports, Library, Local Development, etc.) in our specific Personal Data Protection section of the municipal website.

DATA PRESERVATION

The data provided will be kept for the period necessary to fulfil the purpose for which they were collected and to determine any possible liabilities that may derive from said purpose and from the periods required by the archives and public administration regulations.

EXERCISE OF RIGHTS

The General Data Protection Regulation grants data subjects the rights of access, rectification, erasure, restriction of processing, objection and portability.

How to complete the process?

Online: Through the Electronic Registry available on the Electronic Office of the San Lorenzo de El Escorial City Council (electronic certificate or signature required).

In person: By completing the application and submitting it at the General Registry Office of the City Council (Plaza de la Constitución, 3) or through the means provided for in Article 16.4 of Law 39/2015.

SECURITY MEASURES

The City Council of San Lorenzo de El Escorial has adopted the legally required data protection security levels, installing the technical and organisational means available to it to prevent the loss, misuse, alteration, unauthorised access and theft of the personal data provided.