Skip to content

CATASTRO

Privacy policy

Who is responsible

Luis Ángel Garrido Gutiérrez, a private individual. For any privacy matter: [email protected].

What CATASTRO is and what it publishes

CATASTRO is a free, public registry of specialty coffee farms, producers, lots and coffees. It publishes descriptive facts with their source and date: never opinions, scores or judgements about anyone. Commercial data — prices, availability, quantities, relationships between companies — is never published.

Personal data in the registry

Most of the registry is about companies and organisations, which is not personal data. Where a coffee producer is a private individual, the registry publishes only their name, their country and their link to their farms. Nothing else is collected from third parties: no biography, no town, no photograph, no precise location of their plot. That information appears only if the producer — or someone with a declared mandate on their behalf — claims their record and provides it themselves.

Where the data comes from (article 14 GDPR): public commercial sources where the producer already appears — exporter and importer sheets, roaster labels and websites — or verified supply-chain accounts. Every field shows who stated it, in what capacity and when.

Legal basis: legitimate interest (article 6(1)(f) GDPR) in documenting coffee provenance, assessed and documented in writing. You may request that assessment at [email protected].

Your rights if you appear in the registry

  • Claim your record: prove it is you and you gain authority over your data; your values replace those contributed by third parties.
  • Correct any inaccurate data.
  • Object or ask for erasure of your record: honoured without requiring a justification, removing the record, its web address and the associated history. Write to [email protected] from any record.
  • All other GDPR rights (access, restriction, portability) through the same channel. Response time: one month.
  • If you are not satisfied, you may complain to the Spanish Data Protection Agency (aepd.es).

User account data

To create an account we ask for two things and nothing more: your email address and the username you choose, which may be a pseudonym. We do not ask for your real name when you create the account or when you verify your link to an entity in the registry. Only if you subscribe to a paid plan do we ask for the invoicing details the law requires, and they are used for that purpose alone. Legal basis: performance of the service you request (article 6(1)(b)). Your contributions to the registry are signed with your account — that is the design of the system, not an accident: the provenance of every field is public. What you agree to when contributing is in the terms of use, and the terms under which what you contribute is published, in the data licence.

Your private layer — cuppings, notes, ratings and entries — is never published, not even in aggregate, and is deleted with your account.

Who else sees your data

Nobody beyond what is needed for the site to work. Four companies process data on our behalf: Webdock hosts the server (Denmark, EU); Cloudflare provides delivery and protection (with the transfer safeguards it maintains for the EU); Hetzner stores the registry backups (Germany, EU); and Google Workspace runs the domain email, so messages you send to [email protected] or [email protected] pass through its servers (with the transfer safeguards Google maintains for the EU). We do not sell data, there is no advertising, and we do not use your data for anything other than operating the registry.

Retention

Registry data is kept indefinitely: CATASTRO is an archive, and its purpose is that the information persists — except where erasure is exercised by the data subject, handled as described above. Account data is kept for as long as the account exists.

Cookies

Reading the registry without an account. The registry pages — records, indexes, search, home — store no cookies in your browser. If you choose a language or open the sign-up form, one cookie of our own is stored, catastro_lang, which only remembers which language you want to see the site in. It does not identify anyone and does not track your browsing. It lasts a year and you can delete it from your browser at any time.

When you click «Log in». The login screen belongs to WordPress, the software this site is built with, and it leaves two cookies of its own: wordpress_test_cookie, used to check that your browser accepts cookies before attempting to log in, and wp_lang, which remembers which language to show that screen in. Both last only as long as your browser session. They are stored even if you do not go on to log in, so you may see them later while reading the registry: they have been there since you opened that screen — the record you are reading did not set them.

With an account and a session open. The cookies needed to keep your session open are stored. They are essential to provide the service you ask for, they expire after two days — or fourteen if you tick «remember me» — and they disappear when you log out.

In the forms (create an account, report a record, claim an entity, subscribe). We use Cloudflare Turnstile to tell people apart from automated programs. Turnstile stores cookies on its own domain, challenges.cloudflare.com: currently __cf_logged_in and two CF_VERIFIED_DEVICE_…, which may last up to a year. They belong to Cloudflare and exist so the check is not repeated for you; CATASTRO neither sets nor reads them. You can read its privacy policy.

We use no analytics, advertising or tracking cookies, neither our own nor third-party ones.

Changes

If this policy changes, the version date is updated here and substantial changes are announced on the site itself.

Version 2 — 29 August 2026.