What we know about you — and what we don't

1. Controller

The controller for data processing on meteo365.es is:

• MAWE MEDIAONLINE, S.L.U.
• CIF: B93564425
• Apartado de Correos 14.007, 29080 Málaga, Spain
• E-Mail: contact@meteo365.es
• Authorised representative: Maren Becker · Management: Thomas Weber

For data protection enquiries, email is the fastest way to reach us at the address above. For full mandatory details see the legal notice.

2. Which data we process

When you use meteo365.es, various data is generated. The main categories:

2.1 Technical access data

Each time a page is requested, your browser automatically transmits data to our server. This is technically necessary in order to deliver the page.

• IP address (stored anonymised in logs)
• Date and time of access
• Requested URL / resource
• Referrer URL (previous page)
• User agent (browser, operating system)
• Data volume transferred / HTTP status code

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website).

2.2 Optional location data

If you wish to use your location on the weather map, your browser will ask for permission (Geolocation API). The coordinates are processed locally on your device and sent to our weather API only to return a forecast for your location. We do not store your location permanently.

2.3 Contact by email

If you write to us, we store your message and your email address in order to handle your enquiry. We do not pass this data on to third parties.

2.4 Special categories and minors

We do not process special categories of personal data (Art. 9 GDPR). meteo365.es is not directed at children; we do not knowingly collect data from minors.

Account, sign-in and Premium subscription

When you create an account or take out a Premium subscription, we additionally process the following data. The legal basis is the performance of the usage or subscription contract (Art. 6(1)(b) GDPR).

Sign-in & account

For sign-in we use a passwordless procedure: you provide your email address and we send you a one-time sign-in link. Of that link we store only a cryptographic hash, never the link in plain text; it expires after 15 minutes. Alternatively you can sign in via a supported service (e.g. Google) — in which case we receive your email address and a user identifier from that service. As account data we store your email address and the sign-in method.

After sign-in we set a technically necessary session cookie (named “m365_session”). It contains a signed, short-lived sign-in token and is used to recognise you as signed in and, where applicable, as a subscriber. Without this cookie the sign-in area cannot be used.

The sign-in and subscription service runs on a separate server at account.meteo365.es. Sign-in links are sent via our email service provider.

Your settings

If you are signed in, we store your personal settings on our server so that they are the same on all your devices: your saved places (favourites) including any names you gave them, your preferred weather model, the chosen units and display options such as colour scheme or map style. They are linked to an identifier derived from your sign-in token — not to your email address in plain text. The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR). If you delete your account, these settings are deleted with it. Without signing in they remain solely in your browser.

Payment processing (Stripe)

Payments are processed via the payment provider Stripe (Stripe Payments Europe, Limited, Ireland). You enter your full payment data — such as the card number — directly with Stripe; we neither receive nor store it. We store only the identifiers assigned by Stripe (customer and subscription ID) and the status of your subscription (active/inactive, end of period). Stripe may also transfer personal data to third countries; details and Stripe’s privacy notice are at stripe.com/privacy.

Storage & deletion

We store account and subscription data for as long as your account exists or as long as statutory retention obligations (in particular tax and commercial-law periods for invoice data) require. After that the data are deleted or anonymised. Your data-subject rights (see the “Your rights” section) also apply to this data.

3. Server logs

Our web servers keep technical logs for error analysis, attack detection and statistical evaluation of load. These logs are automatically deleted or anonymised after no more than 24 hours, unless a security incident requires longer retention.

Legal basis: Art. 6(1)(f) GDPR.

4. Cookies & local storage

Cookies are small text files that a website stores on your device when you visit — for example to remember your language or settings. Besides cookies, modern browsers use local storage, a similar store directly on your device.

meteo365.es stores settings mainly in your browser's local storage — that is, locally on your device. These entries are not transmitted to our server. A single cookie is set for your language choice.

4.1 Our own cookies & local storage entries

These entries never leave your device and are used locally only. You can remove them at any time via your browser settings or by clearing local storage.

Legal basis: Art. 6(1)(b) and (f) GDPR as well as § 25(2) TTDSG / Art. 22.2 LSSI-CE (technically necessary or explicitly requested storage).

4.2 Cookie settings

On your first visit we ask whether you allow analytics and advertising cookies. Without your consent, no such cookies are set. You can also block or delete cookies in your browser at any time. Note that some convenience features will no longer work without local storage — for example your unit preferences will reset on every visit.

4.3 Managing cookies in your browser

In addition to our cookie prompt, you can view, block or delete cookies directly in your browser at any time:

• Google Chrome: Settings › Privacy and security › Cookies and other site data
• Mozilla Firefox: Settings › Privacy & Security › Cookies and Site Data
• Safari: Settings › Privacy
• Microsoft Edge: Settings › Cookies and site permissions

If you disable cookies entirely, some features of the website may no longer be available.

5. Third parties

We deliberately keep the number of external services small. Maps, tiles, weather and radar data are served from our own servers — no third-party maps such as OpenStreetMap or Google Maps are embedded. Fonts are also self-hosted; no Google Fonts are used.

Data transfers outside the EEA (e.g. to Google) are based on an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework, where the recipient is certified) or on the EU standard contractual clauses.

6. Analytics (Google Analytics 4)

We use Google Analytics 4 to understand which parts of the site are used and where problems occur. We use Google's Consent Mode: as long as you do not consent, no cookies are set and no identifiers are stored — Google only receives anonymous, cookieless signals from which aggregated statistics are modelled.

If you consent, Google Analytics sets cookies to recognise returning visits. Your IP address is truncated in the process. You can change your decision at any time by deleting the local storage entry m365_consent — the prompt will then appear again.

Legal basis: Art. 6(1)(a) GDPR (consent), or Art. 6(1)(f) GDPR for the cookieless measurement.

7. Advertising

We currently show no advertising. We plan to integrate Google AdSense in the future. Once advertising is activated, this will happen exclusively on the basis of your consent via the cookie prompt, and we will update this policy accordingly. Independently of that, you can disable personalised advertising at any time:

• Via Google ad settings: adssettings.google.com
• Via the EDAA industry opt-outs: youronlinechoices.eu

Further information can be found in Google's privacy policy.

8. Our own APIs (weather, radar, earthquakes, storms)

Weather, radar, earthquake and storm data are delivered via our own APIs on our servers in Spain. These APIs log only anonymised access data for capacity planning and abuse prevention. No personal profiles are created.

9. Legal bases

Your data is processed on the basis of:

• Art. 6(1)(a) GDPR — consent (analytics, advertising in future)
• Art. 6(1)(b) GDPR — provision of the website
• Art. 6(1)(f) GDPR — legitimate interest (security, functionality)

In Spain, the LOPDGDD and the LSSI-CE apply in addition.

10. Retention periods

• Server logs: no more than 24 hours
• Language cookie: up to 12 months
• Local storage entries: until you delete them yourself
• Email correspondence: as long as required to handle your enquiry, then deleted — statutory retention obligations remain unaffected

11. Your rights

Under the GDPR you have the following rights at any time:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, write to us at contact@meteo365.es — an informal email is sufficient.

You also have the right to lodge a complaint with the competent supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD).

12. Security

We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access. These include in particular TLS encryption for all connections to meteo365.es, regular security updates and a restrictive permissions model on our servers.

13. Changes to this policy

We update this privacy policy when the legal situation or our processing activities change. The current version can always be found at this URL. The "last updated" date above helps you place any changes.

This text is a translation provided for ease of understanding only. In the event of any discrepancy or legal dispute, the original Spanish version of this privacy policy shall prevail.