Privacy Policy for WaypointSur
WaypointSur (operated by The Jar Group, owned by AJ Lawrence, hereinafter referred to as “WaypointSur,” “we,” “us,” or “our”) is committed to protecting the privacy of our subscribers and users. This Privacy Policy outlines how we collect, use, process, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Spanish data protection laws, as we operate from Spain and serve expats within Spain.
By accessing or using our website waypointsur.com, guides.waypointsur.com, subscribing to our newsletter, or participating in our surveys, you agree to the terms of this Privacy Policy. We may update this policy periodically, and we encourage you to review it regularly.
1. Who We Are (Data Controller)
The Data Controller responsible for your personal data under this Privacy Policy is:
The Jar Group
Owner: AJ Lawrence
Email: [email protected]
2. Information We Collect and the Legal Basis for Processing
We collect several types of information from and about users of our services. The legal basis for processing your data will depend on the context in which it is collected.
2.1. Information You Provide to Us Directly
- Newsletter Subscription Data: When you subscribe to our newsletter via beehiiv (our newsletter platform), we collect your email address. This is essential for delivering the newsletter to you.
- Purpose: To send you our WaypointSur newsletter, updates, and relevant communications.
- Legal Basis: Your explicit consent (Art. 6(1)(a) GDPR).
- Survey Responses: When you participate in surveys via Tally.so, you may provide various personal details depending on the survey questions (e.g., demographics, preferences, contact information if you choose to provide it).
- Purpose: To gather insights, improve our content and services, and understand our audience better.
- Legal Basis: Your explicit consent (Art. 6(1)(a) GDPR) for non-anonymous data, or legitimate interest (Art. 6(1)(f) GDPR) for aggregated, anonymized data.
- Communications: If you contact us directly via email or other means, we collect the content of your communication and your contact details.
- Purpose: To respond to your inquiries and provide support.
- Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) in responding to user communications, or performance of a contract/pre-contractual steps (Art. 6(1)(b) GDPR) if related to a service.
2.2. Information We Collect Automatically
As you navigate and interact with our websites (waypointsur.com, guides.waypointsur.com), we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns.
- Website Usage Data: This includes details of your visits to our sites, such as traffic data, location data, logs, referring/exit pages, date and time of your visit, error information, and other communication data.
- Purpose: To understand how our websites are used, improve content and user experience, and for technical administration.
- Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) in maintaining and improving our websites.
- IP Addresses and Device Information: We collect your IP address, operating system, and browser type.
- Purpose: For security, fraud prevention, and to provide aggregated analytics.
- Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR).
- Cookies and Tracking Technologies: We use cookies and similar technologies. For detailed information, please refer to our separate Cookie Policy.
- Google Analytics: We use Google Analytics on guides.waypointsur.com to collect information about how visitors use our site. We have activated IP anonymization (truncating IP addresses) to enhance your privacy. The data collected helps us analyze website traffic and user behavior.
- Purpose: Website performance analysis, content optimization.
- Legal Basis: Your consent (Art. 6(1)(a) GDPR) obtained via our cookie banner.
- Facebook Ads Pixel: This pixel is implemented on our newsletter signup pages to track conversions from Facebook ads and build custom audiences for future advertising campaigns. This involves the use of cookies.
- Purpose: To measure the effectiveness of our advertising campaigns and deliver relevant ads.
- Legal Basis: Your consent (Art. 6(1)(a) GDPR) obtained via our cookie banner.
- Beehiiv Tracking: As part of our newsletter service, beehiiv tracks email opens, clicks on links within emails, and approximate geolocation based on IP address. This data is used to provide analytics to WaypointSur.
- Purpose: To analyze newsletter engagement and improve content relevance.
- Legal Basis: Your consent (Art. 6(1)(a) GDPR) when you subscribe to the newsletter.
2.3. Information from Third Parties
- We may receive aggregated, anonymized data from our service providers (e.g., beehiiv, Google Analytics, Tally.so, Facebook) related to your interactions with our services.
- Purpose: To enhance our understanding of service usage and improve our offerings.
- Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR).
3. How We Use Your Information
We use the information we collect for the following purposes:
- To provide and maintain our newsletter service and guides website.
- To deliver the WaypointSur newsletter and other requested information to you.
- To respond to your comments, questions, and requests.
- To improve and personalize your experience on our websites and with our content.
- To analyze trends, usage, and activities in connection with our services.
- To measure the effectiveness of our advertising campaigns.
- To protect against, investigate, and deter fraudulent, unauthorized, or illegal activity.
- To comply with our legal obligations and enforce our agreements.
4. Disclosure of Your Information
We do not sell your personal data. We may disclose your personal data to the following categories of recipients:
- Service Providers: We engage third-party service providers to perform functions on our behalf, such as hosting, analytics, email delivery, survey management, and advertising. These providers only process data on our instructions and are bound by confidentiality agreements and data processing agreements (DPAs) to ensure GDPR compliance. Key service providers include:
- beehiiv (beehiiv Inc., USA): For newsletter delivery and subscriber management.
- Tally.so (Tally BV, The Netherlands/EU): For creating and managing online surveys (data may be stored in Google Sheets).
- Google Analytics (Google LLC, USA): For website analytics on guides.waypointsur.com.
- Facebook Pixel (Meta Platforms Inc., USA): For advertising measurement and audience targeting.
- WordPress (Automattic Inc., USA): For hosting and managing guides.waypointsur.com.
- Legal Compliance: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
- Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity.
5. International Data Transfers
As WaypointSur operates from Spain but utilizes service providers located outside the European Economic Area (EEA), specifically in the United States, your personal data may be transferred to and processed in these countries.
We ensure that such transfers comply with GDPR by implementing appropriate safeguards, such as reliance on Standard Contractual Clauses (SCCs) approved by the European Commission, and ensuring that our service providers adhere to robust data protection standards. We also monitor relevant legal developments (e.g., Schrems II implications) and adapt our practices accordingly.
6. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The specific retention periods will depend on the type of data and the purpose of processing.
- Newsletter Subscription Data: Retained until you unsubscribe or request deletion. If a subscriber is inactive for an extended period (e.g., 2 years), we may remove their data.
- Survey Responses: Retained for 5 years for analysis, or longer if required for legitimate business purposes or legal obligations, after which it will be anonymized or deleted.
- Google Analytics Data: Retained according to Google’s data retention settings (typically 26 months for user-level and event-level data, or as configured).
- Website Usage Logs: Retained for a limited period for security and troubleshooting (e.g., 3-6 months).
7. Your Data Protection Rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- Right to Access (Art. 15 GDPR): You have the right to request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16 GDPR): You have the right to request that we correct any inaccurate or incomplete personal data.
- Right to Erasure (Art. 17 GDPR – “Right to be Forgotten”): You have the right to request the deletion of your personal data under certain circumstances.
- Right to Restriction of Processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your personal data under certain circumstances.
- Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
- Right to Object (Art. 21 GDPR): You have the right to object to the processing of your personal data under certain circumstances, particularly where processing is based on legitimate interest or for direct marketing purposes.
- Right to Withdraw Consent (Art. 7(3) GDPR): Where we process your data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
- Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement. In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by GDPR.
8. Data Security
We have implemented appropriate technical and organizational measures to protect your personal data from accidental loss, unauthorized access, use, alteration, and disclosure. These measures include encryption, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
9. Third-Party Websites
Our websites and newsletters may contain links to third-party websites (e.g., YouTube channel, other expat resources). This Privacy Policy does not apply to the practices of these third parties. We encourage you to read the privacy policies of any third-party websites you visit.
10. Children’s Privacy
Our services are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information.
11. Changes to Our Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. The “Last Updated” date at the top of this policy indicates when it was last revised. We will notify you of any material changes by posting the new Privacy Policy on our website or by other appropriate means.
12. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
The Jar Group / WaypointSur
Email: [email protected]
Get the free daily briefing for Costa del Sol expats
Taxes, healthcare, bureaucracy — the stuff nobody tells you after you move. Free, daily.
Subscribe free →
Add WaypointSur as a preferred source in Google Search: