Privacy Policy
Our Privacy Commitments
- We do not sell your personal data to third parties — ever.
- You can request deletion of your personal data at any time.
- Location data is used only to improve event discovery and is not stored server-side after your session.
- Uploaded event images may be publicly displayed — only submit images you have the right to share.
- Event information you submit may be publicly visible on the Marcha platform.
- All data processing follows EU GDPR requirements.
Introduction
Welcome to Marcha ("Marcha", "we", "us", or "our"). Marcha is a lifestyle event discovery platform focused on Marbella, the Costa del Sol, and other destinations. Our platform is available at gomarcha.com as a Progressive Web App (PWA) and as native mobile applications for Android and iOS.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and other applicable data protection laws.
By using Marcha, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please discontinue use of the platform.
Who We Are
Marcha is operated by Heinz Frank Hilgers, a private individual based in Spain, trading under the brand Marcha / GoMarcha. Under the GDPR, Heinz Frank Hilgers acts as the data controller for all personal data collected through the platform and determines the purposes and means of processing.
Our platform is built on the following infrastructure:
- Supabase — database, authentication, and file storage (acting as a data processor on our behalf)
- Cloudflare — content delivery network (CDN), security, and DDoS protection
- Google Fonts / Google Maps Platform — typography and venue search
For full contact details and data subject requests, see Section 16 – Contact Information.
Information We Collect
Marcha is designed to be low on data collection. We do not require account registration to discover events. The data we collect falls into the following categories:
| Data Category | What We Collect | Legal Basis | Linked to You? |
|---|---|---|---|
| Usage Data | Pages visited, events viewed, searches performed, device type, browser | Legitimate Interest | No |
| Technical Data | IP address (via Cloudflare), user agent, timestamps, referrer URL | Legitimate Interest | Indirect |
| Location Data | GPS coordinates or IP-based location (only when you enable "Near me") | Consent | No (session only) |
| Event Submission Data | Event details, submitter name, contact email, optional website / social links | Contract | Yes |
| Uploaded Images | Event photos you upload (stored in Supabase Storage) | Contract | Yes (public) |
| Support Communications | Email address and message content when you contact us | Consent | Yes |
Data We Do Not Collect
- We do not collect payment or financial information.
- We do not collect government-issued identification.
- We do not build advertising profiles or sell data to advertisers.
- We do not use tracking pixels or cross-site tracking cookies.
- We do not require account registration to use core features.
Event Submissions
When you submit an event through the "Add Event" form, we collect the following information:
- Event details: Title, date and time, venue, address, description, genre / category, ticket link, website
- Submitter details: Your name and contact email address
- Optional media: Event images (see Section 5)
How Submitted Events Are Used
Event information is reviewed by our team before publication. Once approved, event details are displayed publicly on the Marcha platform and may be shared via our social media channels. Your personal contact details (name and email) are stored for administrative purposes and are not displayed publicly.
Legal Basis
Processing of event submission data is necessary for the performance of the service you have requested (Article 6(1)(b) GDPR) — namely, listing your event on the Marcha platform. Submitter contact details are processed on the basis of our legitimate interest (Article 6(1)(f) GDPR) in being able to follow up regarding your submission.
Uploaded Images
When you upload an event image through the submission form, that image is stored in Supabase Storage (a cloud storage service). Once the associated event is approved and published, the image is publicly accessible via a permanent URL and is displayed alongside the event listing.
Your Responsibilities
By uploading an image, you confirm that:
- You hold the rights to that image, or have obtained permission from the rights holder.
- The image does not depict minors without appropriate parental consent.
- The image does not violate any applicable laws or third-party rights.
Image Deletion
You may request deletion of an uploaded image at any time by contacting us at support@gomarcha.com. Please include the event name and a description of the image. We will process deletion requests within 30 days.
Location Data
Marcha offers location-based event discovery to show you events happening near your current position. Location access is strictly optional.
How Location is Used
- When you tap "Near me" or enable location, your device's browser or OS will request your permission before any location data is shared with us.
- Location coordinates are used only within your active session to sort and filter events by proximity.
- We do not store your location coordinates on our servers.
- We do not track your location history or movement patterns.
- We do not share location data with advertising networks.
IP-Based Location
Cloudflare may infer a coarse geographic region from your IP address for the purpose of routing your request to the nearest data centre. This is a technical necessity of CDN operation and does not constitute location tracking.
Legal Basis
Precise location processing is based on your explicit consent (Article 6(1)(a) GDPR), granted via the browser or OS permission dialog. You may revoke this consent at any time by changing your browser or device settings. Revoking consent does not affect the lawfulness of processing carried out before revocation.
Analytics and Cookies
Cookies and Local Storage
Marcha uses browser localStorage and sessionStorage to remember your preferences (such as language selection and the email address you optionally save when submitting events). These are stored on your device and are not transmitted to third parties.
We do not use advertising cookies, third-party tracking cookies, or cookie-based behavioural analytics.
Service Worker Cache
As a Progressive Web App (PWA), Marcha uses a Service Worker to cache static assets locally on your device. This allows the app to load faster and function offline. No personal data is stored in the Service Worker cache.
Analytics
We may use Cloudflare Web Analytics, a privacy-first, cookieless analytics solution. Cloudflare Web Analytics does not use cookies, does not track individual users across sessions, and does not build user profiles. Data collected includes aggregate page views, visitor counts, and technical metrics.
We do not use Google Analytics, Meta Pixel, or other cookie-based analytics platforms.
Supabase Data Processing
Marcha uses Supabase as its primary data infrastructure for database, authentication services, file storage, and serverless edge functions. Supabase acts as a data processor on our behalf under a Data Processing Agreement (DPA).
What is Stored in Supabase
- Event records submitted by users (including title, date, venue, description)
- Submitter name and contact email associated with event submissions
- Uploaded event images (stored in Supabase Storage)
- Application logs generated by Edge Functions (social posting, queue processing)
Data Location and Transfers
Supabase stores data in Frankfurt, Germany (EU West — eu-west-1) by default. This means your data remains within the European Economic Area (EEA), which complies with GDPR's requirements for data transfers without additional safeguards.
Supabase's infrastructure is provided by Amazon Web Services (AWS). AWS operates as a sub-processor. For more information, see supabase.com/privacy.
Row-Level Security
Supabase's Row-Level Security (RLS) policies are applied to all tables containing user-identifiable information, ensuring that data is only accessible to authorised parties.
Cloudflare Services
Marcha's web infrastructure is protected and accelerated by Cloudflare, Inc. All traffic to gomarcha.com and our APIs passes through Cloudflare's global network.
Services Used
- CDN (Content Delivery Network): Static assets (HTML, CSS, images) are cached at Cloudflare edge nodes close to your location for faster delivery.
- DDoS Protection and Web Application Firewall (WAF): Cloudflare automatically inspects incoming requests to protect against malicious traffic. This involves processing IP addresses and request metadata.
- Cloudflare Web Analytics: Privacy-preserving, cookieless analytics (see Section 7).
- Workers / Pages: Edge compute may be used to serve the PWA and handle API routing.
Data Processed by Cloudflare
Cloudflare processes IP addresses, HTTP request headers, and user agent strings as part of normal CDN and security operations. This is a legitimate interest processing basis (Article 6(1)(f) GDPR) required to deliver the service securely.
Cloudflare is certified under the EU–US Data Privacy Framework and processes data in accordance with Standard Contractual Clauses. For more information, see cloudflare.com/privacypolicy.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Published event records | Duration of platform operation or until deletion requested | Core platform functionality |
| Submitter name & email | 3 years from submission date | Administrative follow-up; fraud prevention |
| Uploaded event images | Duration of event listing or until deletion requested | Event display; CDN caching |
| Location data | Session only — not persisted server-side | Real-time event proximity sorting |
| Cloudflare access logs | Up to 30 days (Cloudflare policy) | Security and abuse prevention |
| Edge Function logs (Supabase) | Up to 7 days (Supabase policy) | Operational debugging |
| Support communications | 2 years from last contact | Resolution of ongoing issues; legal obligations |
At the end of the applicable retention period, personal data is securely deleted or anonymised. You may request earlier deletion of your data — see Section 11.
Your Rights (GDPR)
If you are located in the European Union or European Economic Area, you have the following rights under the GDPR regarding your personal data:
Art. 15 Right of Access
Request a copy of the personal data we hold about you.
Art. 16 Right to Rectification
Request correction of inaccurate or incomplete personal data.
Art. 17 Right to Erasure
Request deletion of your personal data ("right to be forgotten").
Art. 18 Right to Restriction
Request that we limit how we process your data in certain circumstances.
Art. 20 Right to Portability
Receive your data in a structured, machine-readable format.
Art. 21 Right to Object
Object to processing based on legitimate interests.
Art. 7(3) Withdraw Consent
Withdraw any consent you have given at any time, without affecting past processing.
Art. 77 Lodge a Complaint
File a complaint with your national data protection supervisory authority.
How to Exercise Your Rights
To exercise any of the above rights, please contact us at support@gomarcha.com with the subject line "GDPR Data Request". Include a brief description of your request and, where relevant, the email address used when submitting content. We will respond within 30 days. Complex requests may require up to 90 days, and we will notify you within the first 30 days if an extension is needed.
We do not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.
Supervisory Authority — Spain (AEPD)
If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish data protection authority:
C/ Jorge Juan, 6 · 28001 Madrid, Spain
Website: www.aepd.es
EU/EEA residents may also contact the data protection authority in their own country of residence.
Data Deletion for App Users
In compliance with Google Play Store and Apple App Store requirements, you may request deletion of your account and all associated personal data at any time. To submit a deletion request, email support@gomarcha.com with the subject "Delete My Data". We will confirm and complete the deletion within 30 days.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure.
Technical Measures
- Encryption in transit: All data is transmitted over HTTPS (TLS 1.2 or higher). Cloudflare enforces HTTPS on all connections.
- Encryption at rest: Data stored in Supabase is encrypted at rest using AES-256 encryption.
- Row-Level Security (RLS): Supabase RLS policies prevent unauthorised database access at the row level.
- Access control: Administrative access to the database is restricted to authorised personnel via Supabase's role-based access control.
- DDoS and WAF protection: Cloudflare protects the platform against malicious requests and automated attacks.
- Environment isolation: Secret keys and API credentials are stored as environment variables and are never committed to source code.
Organisational Measures
- Access to personal data is limited to personnel who require it to perform their duties.
- We review our security practices and update them in response to new threats.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay (Article 34 GDPR).
Third-Party Services
Marcha integrates with the following third-party services. Each acts as a data processor or independent data controller as described below:
Children's Privacy
Marcha is intended for users who are 16 years of age or older. In accordance with Article 8 of the GDPR, we do not knowingly collect or process personal data from children under the age of 16 without verifiable parental consent.
Many events listed on Marcha (live music, nightlife, bars) are intended for adult audiences only. The platform does not verify the age of visitors, but event organisers are responsible for ensuring their events comply with applicable age restrictions.
If you are a parent or guardian and believe that your child under the age of 16 has provided us with personal data, please contact us immediately at support@gomarcha.com. We will investigate and delete the relevant data within 14 days.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make significant changes, we will:
- Update the "Last updated" date at the top of this page.
- Post a notice on the Marcha homepage or within the app where reasonably practicable.
- Where required by law or where changes materially affect how we use your data, provide more prominent notice or seek renewed consent.
We encourage you to review this Privacy Policy periodically. Your continued use of Marcha after changes take effect constitutes acceptance of the updated policy.
Previous versions of this policy are available on request — please contact us at support@gomarcha.com.
Contact Information
For any questions about this Privacy Policy, to exercise your data subject rights, or to report a privacy concern, please contact the data controller directly:
How to Request Data Access, Correction or Deletion
You have the right to request access to, correction of, or deletion of any personal data we hold about you. To exercise any of these rights, send an email to support@gomarcha.com with one of the following subject lines depending on your request:
- "GDPR Data Request" — to receive a copy of your personal data (Art. 15)
- "Correct My Data" — to request a correction or update (Art. 16)
- "Delete My Data" — to request full erasure of your personal data (Art. 17)
Please include a brief description of what data you are referring to (e.g. the email address used when submitting an event). We will confirm receipt and complete your request within 30 days. No fee is charged for these requests unless they are manifestly unfounded or excessive.
For complaints about our data processing that we have been unable to resolve, you may contact the Spanish data protection authority (AEPD) at www.aepd.es, or the data protection authority in your country of residence within the EU/EEA.