PRIVACY POLICY — bananatribe
Site: https://bananatribe.com
Included subdomains: https://my.bananatribe.com
Update: 2026-10-28
This privacy policy describes the processing of personal data relating to the indicated site, pursuant to Regulation (EU) 2016/679 (GDPR).
1. DATA CONTROLLER AND CONTACTS
Controller: bananatribe
Address: C. de la Platanera, 4 - 38400 Puerto de la Cruz - Tenerife
Country of establishment: Spain
Contact for data protection and exercise of rights: hello@bananatribe.com
The controller has not appointed a data protection officer (DPO).
The controller declares that the designation of a representative in the European Union is not envisaged.
For the processing described, the controller declares not to operate as a joint controller.
2. DATA, PURPOSES AND LEGAL BASES
Account and restricted area
Processed data: Nickname, email, mobile phone, date of birth, channel preferences to follow, neighborhood preferences to follow.
Purpose: Provide an account and restricted features.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: always.
Recipients: none.
Provision: Optional. You cannot enter the Restricted Area but you can browse the app.
Marketing, sending newsletters and promotional communications.
Processed data: Email address, basic personal data (Nickname/Name to personalize the greeting), area of interest (to send emails relevant to one's ZIP code) and usage data (delivery, opening and click statistics on emails).
Purpose: Sending commercial communications by email, periodic newsletters, updates on app features, invitations to local events and sending discount codes or promotions related to neighborhood commercial activities affiliated with bananatribe.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: Data is processed for this specific purpose until consent is revoked (opt-out) by the user via the unsubscribe link at the bottom of each email, or until the permanent deletion of the account.
Recipients: Email marketing and transactional sending service providers.
Provision: Necessary for the contract / requested service. It would not be possible to register on the platform.
Privacy preferences
Processed data: Consent.
Purpose: Record and respect choices regarding site services.
Legal basis: Consent — art. 6.1.a GDPR.
Retention: always.
Recipients: none.
Provision: Optional. You are not tracked.
3. SOURCE OF DATA
Data is collected directly from the data subjects and during the use of the site, in the forms described for the individual purposes.
4. PROVIDERS AND TRANSFERS
Cloudflare, Inc.
Activity: Cloudflare, Cloudflare Bot Management. Role: data processor on behalf of the controller.
Processing and access countries: EU / EEA and United States.
Transfers outside the European Economic Area: Yes (USA — EU-U.S. Data Privacy Framework + SCC). How to obtain a copy of the safeguards: Compliant with GDPR via Data Processing Addendum (DPA) signed with the provider and EU-U.S. Data Privacy Framework certification. https://www.cloudflare.com/cloudflare-customer-dpa/.
iChef (Visibility S.L.U.)
Activity: iChef — Consent Management. Role: data processor on behalf of the controller.
Processing and access countries: Spain / EU (EEA).
For this service, the controller declares that processing and access take place within the European Economic Area, without transfers outside this area.
bananatribe
Activity: Contact Form, Language and Theme Preferences, Guest Status, Zone and Invitations. Role: independent controller for processing within its competence.
Processing and access countries: Spain / EU (EEA).
For this service, the controller declares that processing and access take place within the European Economic Area, without transfers outside this area.
Supabase, Inc.
Activity: App Registration and Login. Role: data processor on behalf of the controller.
Processing and access countries: EU (AWS EU Data Center) and United States.
Transfers outside the European Economic Area: Yes (USA — Standard Contractual Clauses SCC). How to obtain a copy of the safeguards: GDPR compliance ensured via DPA (Data Processing Addendum) and Supabase Standard Contractual Clauses (SCC), with data hosting inside the European Union (AWS EU). https://supabase.com/legal/dpa.
OpenStreetMap Foundation
Activity: Interactive Maps (OSM). Role: independent controller for processing within its competence.
Processing and access countries: United Kingdom, Netherlands (EU) and global CDN.
Transfers outside the European Economic Area: Yes (United Kingdom — EU Adequacy Decision). How to obtain a copy of the safeguards: Processing governed by the OpenStreetMap Foundation Privacy Policy and covered by the EU-UK Adequacy Decision. https://osmfoundation.org/wiki/Privacy_Policy.
Brevo / Sendinblue SAS
Activity: Management, delivery and analysis of newsletters and transactional communications (via API). The personal data entrusted includes: email address, basic personal data (if associated with the account), IP address and usage data (delivery, open and click statistics tracked via invisible web beacons within messages). Role: data processor on behalf of the controller.
Processing and access countries: Yes. Although Brevo's main data hosting is located in the European Union (France and Germany), the provider may use technical cloud sub-processors or support teams operating outside the European Economic Area (e.g., United States).
Transfers outside the European Economic Area: The transfer is legitimized by the signing of a Data Processing Agreement (DPA) incorporating the Standard Contractual Clauses (SCC) approved by the European Commission and, for transfers to partners in the USA, relevant adequacy decisions (such as the Data Privacy Framework). How to obtain a copy of the safeguards: Data protection safeguards can be viewed publicly at https://www.brevo.com/it/legal/privacypolicy/. In addition, a formal copy of the Data Processing Agreement (DPA) including SCC can be generated, digitally signed and downloaded in PDF format directly from the restricted area (Account Settings) of your Brevo profile.
5. COOKIES AND SITE SERVICES
Google Consent Mode Advanced is configured: Google tags can send cookieless measurement signals even before choice and after rejection. Statistical and advertising cookies depend on the choices of the respective services. The technical mode does not constitute a verification of the legal basis of the processing.
The declared inventory includes: Cloudflare (Cloudflare, Inc.); Cloudflare Bot Management (Cloudflare, Inc.); iChef — Consent Management (iChef (Visibility S.L.U.)); Contact Form (bananatribe); App Registration and Login (bananatribe / Supabase, Inc.); Language and Theme Preferences (bananatribe); Guest Status, Zone and Invitations (bananatribe); Interactive Maps (OSM) (OpenStreetMap Foundation); PWA Cache and Push Notifications (bananatribe); Brevo (Sendinblue SAS).
For cookies, identifiers, purposes, duration and preference management, consult the Cookie Policy associated with this site, accessible via the link on the page. Preference settings can be modified using the relevant command when the component is installed.
6. SPECIFIC CASES
Processing relating to minors: Possibility of registration from 14 years of age and above.
The controller declares that the processing described does not involve the collection of special categories of data or data relating to criminal convictions and offenses.
Profiling: purposes and methods: For the creation of statistics.
The controller declares not to adopt decisions based solely on automated processing producing legal effects or similarly significantly affecting the data subject.
7. RIGHTS AND REQUESTS
In the cases and under the conditions provided by the GDPR, you can request access to your data, rectification, erasure and restriction of processing. You can receive the data provided in a structured format and request its transmission to another controller when the conditions for portability are met, in particular for automated processing based on consent or a contract.
You may object, for reasons connected to your particular situation, to processing based on legitimate interest or public interest, in the cases provided for by Article 21. You may object at any time to direct marketing, including profiling related thereto.
When processing is based on consent, you can revoke it at any time without prejudice to the lawfulness of previous processing. To exercise your rights, contact hello@bananatribe.com.
You can lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged violation. In Italy: Garante per la protezione dei dati personali, https://www.garanteprivacy.it. The legal remedies provided by the GDPR remain available.
8. FURTHER INFORMATION
no