Privacy Policy

Who we are

Forum Costa is run by ForumHub SL, a Spanish company based in Estepona, Málaga. We are the data controller for everything you do on forumcosta.com and in the Forum Costa app. When this policy says "we", it means ForumHub SL, and in practice it means Filip.

What we collect

When you create an account: your name, email address and profile photo, either typed by you or passed to us by Apple, Google or Facebook when you choose one-tap sign in. When you use the site: your posts, replies, votes, reviews, bookmarks and business card details. Technical basics: IP address, browser type and pages visited, used for security and aggregate statistics only.

What we never collect

No passwords (social sign-in means there is nothing to leak), no payment details (the site is free), no precise GPS location (the map only uses the town you pick), and no data from your contacts, camera roll or anything else on your device.

Why we use it

To run your account, show your public contributions under your name, send the notifications you asked for, and keep the community safe from spam and abuse. Legal bases under GDPR: contract (running your account), legitimate interest (security, moderation), and consent (newsletter, push notifications), which you can withdraw anytime.

What signing up covers

Creating an account means you accept the Terms and this policy, and it subscribes you to the newsletter, which every email lets you leave in one click. This is stated on the signup screen itself, so consent is informed and documented, exactly as the AEPD expects. Creating an account means we have your real name and email address and can write to you about the platform: replies to your posts, security notices, changes that affect your account, and product updates. The editorial newsletter is separate and only arrives if you opt in.

Where it lives

One encrypted database hosted in the European Union. Emails are encrypted at rest. Access is restricted to the owner; moderators only ever see public display names, never emails or contact data.

Who we share it with

Mailchimp receives your email and first name if you are subscribed to the newsletter, nothing else. HubSpot receives contact-form enquiries only. Google Maps powers the map without receiving your identity. We never sell data, and no business listed on the site ever receives member data.

How long we keep things

Your account data stays for as long as you have an account. Delete your account and your email is erased within 30 days. Posts always carry the real name of the member who wrote them. Only if you delete your account are your posts anonymised to Former member rather than deleted, so other people's conversations still make sense. Backups age out on their normal cycle rather than being rewritten.

Where data can travel

The site is hosted in the EU. Some services we use for email may process data outside the EU; where that happens, it is covered by the standard contractual clauses the GDPR requires. We do not sell data to anyone, anywhere, ever.

Your rights

Access, correction, deletion, portability and objection, all under GDPR. The useful part: you do not need to email anyone. Profile → Account & privacy has a "Request my data" button that sends you everything, and a "Delete my account" button that works immediately. Deletion anonymizes your posts to "Former member" and erases your email within 30 days.

Cookies

Covered in the Cookies tab above. Short version: a login cookie, an anonymous analytics cookie, and nothing else unless you consent.

Children

Forum Costa is for people 16 and over. We do not knowingly hold data on anyone younger; if you believe we do, write to us and it is removed.

Complaints

You can complain to the Spanish data authority (AEPD, aepd.es) at any time. We would prefer you write to us first so we can fix it faster.