Read the Cookie PolicyPRIVACY POLICY — bananatribe
Site: https://bananatribe.com
Included subdomains: https://my.bananatribe.com
Updated: 2026-11-07
This policy describes the processing of personal data relating to the indicated site, pursuant to Regulation (EU) 2016/679 (GDPR).
1. DATA CONTROLLER AND CONTACTS
Controller: bananatribe
Address: C. de la Platanera, 4 - 38400 Puerto de la Cruz - Tenerife
Country of establishment: España
Contact for data protection and exercise of rights: hello@bananatribe.com
The controller has not appointed a data protection officer (DPO).
The controller declares that the designation of a representative in the European Union is not envisaged.
For the processing described, the controller declares not to operate as joint controllers.
2. DATA, PURPOSES, AND LEGAL BASES
Account and restricted area
Data processed: Nickname, email, mobile phone, date of birth, preferences of channels to follow, preferences of neighborhoods to follow.
Purpose: Provide an account and restricted functions.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: always.
Recipients: none.
Provision: Optional. You cannot enter the Restricted Area but you can browse the app.
Statistics
Data processed: access analysis and web / app traffic measurement.
Purpose: Collection and processing of aggregate statistical information on the use of the website (bananatribe.com) and the web app (my.bananatribe.com) in order to measure traffic volumes, evaluate the technical performance of the infrastructure, analyze navigation flows, and improve the user experience, without behavioral or advertising profiling purposes.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: Device side (Browser): analytical cookies (_ga, _ga_<container-id>) remain for a maximum of 24 months (unless manual deletion of browsing data or early revocation of consent).
Server / platform side: data retention at the aggregate property level set to 14 months (or 2 months depending on the configuration chosen in the Google Analytics console).
Recipients: External technological supplier (Data Processor): Google Ireland Limited / Google LLC.
Authorized internal personnel: bananatribe system administrators and developers with dedicated access credentials to the telemetry console.
Provision: Optional. No consequences. The user freely browses and uses all features of the site and web application; the user's session and interactions will not be recorded or processed in statistical metrics.
Marketing, newsletter sending, and promotional communications.
Data processed: Email address, basic personal data (Nickname/Name to personalize the greeting), area of interest (to send emails relevant to your postal code), and usage data (delivery, open, and click statistics on emails).
Purpose: Sending commercial communications, periodic newsletters, updates on app features, invitations to local events, and sending discount codes or promotions related to neighborhood commercial activities partnered with bananatribe via email.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: Data is processed for this specific purpose until consent is revoked (opt-out) by the user via the unsubscribe link at the bottom of each email, or until the definitive deletion of the account.
Recipients: Email marketing and transactional sending service providers.
Provision: Necessary for the contract / service requested. It would not be possible to register on the platform.
Statistical analysis of accesses and web / app traffic measurement
Data processed: Consent.
Purpose: Collection of aggregated and anonymized statistical data (pages visited, duration of stay, navigation paths, device used) to evaluate site/app performance and improve the user experience.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: Persistent cookies in the browser up to 24 months; property-level data retention set on GA4 (defaulting to 2 or 14 months).
Recipients: Web analysis service provider: Google Ireland Limited (acting as Data Processor within the EU/EEA) and the parent company Google LLC (in the USA, as sub-processor for technical and cloud infrastructure).
Authorized internal personnel: bananatribe technical administrators and developers in charge of platform maintenance and traffic metric analysis (with access credentials to the Google Analytics panel).
Provision: Optional. Any refusal has no consequences: the user browses and uses all functions of the site and app without any limitation.
3. SOURCE OF DATA
Data is collected directly from the data subjects and during the use of the site, in the forms described for the individual purposes.
4. PROVIDERS AND TRANSFERS
Cloudflare, Inc.
Activity: Cloudflare, Cloudflare Bot Management. Role: data processor on behalf of the controller.
Processing and access countries: EU / EEA and United States.
Transfers outside the European Economic Area: Yes (USA — EU-U.S. Data Privacy Framework + SCC). How to obtain a copy of safeguards: GDPR compliant through Data Processing Addendum (DPA) signed with the provider and EU-U.S. Data Privacy Framework certification. https://www.cloudflare.com/cloudflare-customer-dpa/.
iChef (Visibility S.L.U.)
Activity: iChef — Consent Management. Role: data processor on behalf of the controller.
Processing and access countries: Spain / EU (EEA).
For this service, the controller declares that processing and access take place within the European Economic Area, without transfers outside this area.
bananatribe
Activity: Contact Form, Language and Theme Preferences, Guest Status, Zone and Invitations. Role: independent controller for processing operations within its competence.
Processing and access countries: Spain / EU (EEA).
For this service, the controller declares that processing and access take place within the European Economic Area, without transfers outside this area.
Supabase, Inc.
Activity: App Registration and Login. Role: data processor on behalf of the controller.
Processing and access countries: EU (AWS EU Data Center) and United States.
Transfers outside the European Economic Area: Yes (USA — Standard Contractual Clauses SCC). How to obtain a copy of safeguards: GDPR compliance guaranteed through DPA (Data Processing Addendum) and Standard Contractual Clauses (SCC) of Supabase, with data hosting within the European Union (AWS EU). https://supabase.com/legal/dpa.
OpenStreetMap Foundation
Activity: Interactive Maps (OSM). Role: independent controller for processing operations within its competence.
Processing and access countries: United Kingdom, Netherlands (EU), and global CDN.
Transfers outside the European Economic Area: Yes (United Kingdom — EU Adequacy Decision). How to obtain a copy of safeguards: Processing governed by the OpenStreetMap Foundation Privacy Policy and covered by the EU-UK Adequacy Decision. https://osmfoundation.org/wiki/Privacy_Policy.
Brevo / Sendinblue SAS
Activity: Management, delivery, and analysis of newsletters and transactional communications (via API). Personal data entrusted includes: email address, basic personal data (if associated with the account), IP address, and usage data (delivery, open, and click statistics tracked via invisible web beacons within messages). Role: data processor on behalf of the controller.
Processing and access countries: Yes. Although Brevo's primary data hosting is located in the European Union (France and Germany), the provider may use technical cloud sub-processors or support teams operating outside the European Economic Area (e.g., United States).
Transfers outside the European Economic Area: The transfer is legitimized by the signature of a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCC) approved by the European Commission and, for transfers to partners in the USA, relevant adequacy decisions (such as the Data Privacy Framework). How to obtain a copy of safeguards: Data protection safeguards can be consulted publicly at https://www.brevo.com/it/legal/privacypolicy/. In addition, the formal copy of the Data Processing Agreement (DPA) including SCC can be generated, digitally signed, and downloaded in PDF format directly from the reserved area (Account Settings) of your Brevo profile.
Google Ireland Limited (for users residing in the European Economic Area)
Activity: Google Analytics 4 (GA4). Role: data processor on behalf of the controller.
Processing and access countries: Ireland / European Union and United States of America.
Transfers outside the European Economic Area: European Commission Adequacy Decision based on the EU-U.S. Data Privacy Framework (which Google LLC formally adheres to) supplemented by the European Commission's Standard Contractual Clauses (SCC). How to obtain a copy of safeguards: https://business.safety.google/adsprocessorterms/.
Google Ireland Limited (for users residing in the European Economic Area) / Google LLC (USA)
Activity: Google Tag Manager / Google tag. Role: data processor on behalf of the controller.
Processing and access countries: Ireland / European Union and United States of America (Google LLC's global delivery infrastructure and CDN).
Transfers outside the European Economic Area: European Commission Adequacy Decision based on the EU-U.S. Data Privacy Framework (which Google LLC formally adheres to), supplemented by the Standard Contractual Clauses (SCC) contained in the data processing terms. How to obtain a copy of safeguards: https://business.safety.google/adsprocessorterms/.
5. COOKIES AND SITE SERVICES
Google Consent Mode Advanced is configured: Google tags can send measurement signals without cookies even before choice and after rejection. Statistical and advertising cookies depend on the choices of the respective services. The technical mode does not constitute verification of the legal basis of processing.
The declared inventory includes: Cloudflare (Cloudflare, Inc.); Cloudflare Bot Management (Cloudflare, Inc.); iChef — Consent Management (iChef (Visibility S.L.U.)); Contact Form (bananatribe); App Registration and Login (bananatribe / Supabase, Inc.); Language and Theme Preferences (bananatribe); Guest Status, Zone and Invitations (bananatribe); Interactive Maps (OSM) (OpenStreetMap Foundation); PWA Cache and Push Notifications (bananatribe); Brevo (Sendinblue SAS); Google Analytics 4 (GA4) (Google Ireland Limited (for users residing in the European Economic Area)); Google Tag Manager / Google tag (Google Ireland Limited (for users residing in the European Economic Area) / Google LLC (USA)).
For cookies, identifiers, purposes, duration, and preference management, consult the Cookie Policy associated with this site, accessible via the link on the page. Preference settings can be modified using the relevant command when the component is installed.
6. SPECIFIC CASES
Processing relating to minors: Possibility of registration from 14 years of age and up.
The controller declares that the processing described does not involve the collection of special categories of data or data relating to criminal convictions and offenses.
Profiling: purposes and methods: For the creation of statistics.
The controller declares not to adopt decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.
7. RIGHTS AND REQUESTS
In the cases and under the conditions provided by the GDPR, you can request access to your data, rectification, erasure, and restriction of processing. You can receive the data provided in a structured format and request its transmission to another controller when the conditions for portability are met, in particular for automated processing based on consent or a contract.
You may object, for reasons connected to your particular situation, to processing based on legitimate interest or public interest, in the cases provided for by Article 21. You may object at any time to direct marketing, including profiling related thereto.
When processing is based on consent, you can revoke it at any time without prejudice to the lawfulness of previous processing. To exercise your rights, contact hello@bananatribe.com.
You can lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged violation. In Italy: Garante per la protezione dei dati personali, https://www.garanteprivacy.it. The legal remedies provided by the GDPR remain available.
8. FURTHER INFORMATION
no