Last updated: 21 September 2026.
This policy describes what Madrid Tourism Guide (madridtourism.org) collects when you visit, why, and what you can do about it. It describes the site as it is configured today, not as it might be configured later; when the site changes, this page is updated and the date above changes with it.
Who is responsible
Madrid Tourism Guide is an independently run publication at www.madridtourism.org. For the purposes of the UK and EU General Data Protection Regulation, the site’s operator is the data controller. Any question about this policy, and any request to see or delete data, should go through the contact page.
What is collected
Analytics
This site uses Google Analytics 4, provided by Google, to count visits and see which guides people actually read. It is implemented through a Google tag placed on every page.
Google Analytics sets cookies in your browser and records the pages you view, roughly how long you spend on them, the approximate location derived from your IP address (city level; the full address is not retained by this site), the referring site or search that brought you here, and your device, browser and screen size. Analytics data reaches this site only as aggregate reports. It is not used to identify individual visitors, is not combined with anything else, and is not sold or shared with anyone.
Google’s own handling of this data is governed by Google’s privacy policy, and Google may use it for its own purposes. Their terms are at policies.google.com/privacy. You can prevent Analytics from running at all with Google’s browser add-on at tools.google.com/dlpage/gaoptout, by switching analytics off in this site’s cookie settings, or by blocking cookies for this site in your browser settings. Whether it runs before you have made a choice depends on where you are reading from; see “Your choices” below.
Google Search Console
This site is verified with Google Search Console, which reports the search queries that lead to it. Search Console data is aggregated and anonymous by design; it does not tell the site who you are.
The contact form
If you use the contact form, the name, email address and message you type are emailed to the site’s editor so that a reply can be sent. They are not stored in a database on this site, published, sold, or added to any mailing list — there is no mailing list. The email sits in an ordinary mailbox and is deleted when the exchange is finished, generally within twelve months. Your IP address and the time of submission are recorded with the message as a spam-prevention measure.
Server logs
The web host records standard access logs — IP address, timestamp, requested page, browser user-agent — as every web server does. These are used for security and diagnosing faults, are not consulted for anything else, and are rotated by the host on its own schedule.
Comments
Comments are switched off across this entire site and no comment form is shown on any page. No comment data is collected. Comments received before they were disabled were spam and have been permanently deleted.
Accounts and newsletters
There is no reader registration, no login for visitors, and no newsletter. Nothing on this site asks you to create an account.
Cookies
Cookies currently set when you visit:
- Google Analytics cookies (names beginning
_ga) — distinguish one visitor from another and one visit from another, so that pageviews are not double-counted. Typical lifetime is up to two years. They are set only once analytics is allowed to run. - Caching cookies — this site runs a page cache to serve pages quickly. It may set a short-lived cookie to decide whether a cached or a fresh copy of a page should be served. It carries no information about you.
- Your cookie choice (
cookie_consent_1e7cfb) — records the answer you give in the cookie dialog or bar, so that you are not asked on every page. It is set by this site and readable by nobody else; a companion cookie,cookie_consent_1e7cfb_loc, remembers for a day which country you are reading from, so the right rules apply without looking it up again.
Blocking or deleting cookies for this site will not stop you reading anything here; every guide works without them. The cookie policy lists every cookie and every item of browser storage in use, generated from the services actually running here.
Consent
A consent tool now runs on this site. What it asks, and what may run before you answer, depends on where you are reading from; both are set out under “Your choices, and what runs before you make them” below.
Advertising
This site does not display advertising at the time of writing, and no ad network runs on it. The booking links described in the next section are a separate arrangement, and they are running now. Display advertising is intended, and the following will apply once it is live:
- Third-party vendors, including Google, use cookies to serve ads based on a visitor’s prior visits to this and other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the internet.
- You can opt out of personalised advertising by visiting Google Ads Settings, or opt out of a third-party vendor’s use of cookies for personalised advertising at aboutads.info/choices.
Advertising, when it appears, will be sold programmatically against the site as a whole. It has no influence on which places are recommended here or how they are ranked — see the about page.
Booking links and commission
Some links on this site earn a commission. Links to hotels, apartments and booking sites are handled by Stay22, a booking-link partner whose script turns them into commission-tracking links as the page loads. If you book after following one, the booking site pays this site a commission; the price you pay is the same either way. Every guide says so at the top, and the affiliate disclosure sets out the arrangement in full.
What that means for your data needs spelling out, because it is not what a cookie notice usually describes. Stay22 does not set a cookie. It recognises your device from the characteristics of your browser — fonts, screen, language and similar details — and keeps an identifier in your browser’s local storage under the names visitor_id_id22 and cache_id22, so that a booking made later can be credited here. Like any service your browser connects to, it also receives your IP address and browser details when it loads, and it processes data outside the EU. Blocking third-party cookies does not stop any of this; the cookie settings on this site do.
Stay22 sits in the Advertising group of those settings and does not load at all until that group is allowed. This site never sees your name, your travel dates or your payment details — what comes back is a count of clicks and, sometimes, the fact that a booking happened. Once you are on a booking site you are under its privacy policy, not this one.
Your choices, and what runs before you make them
What runs before you choose depends on where you are reading from, because the law does. In the European Economic Area and the United Kingdom, and in Brazil, Chile, China, Israel, Nigeria, Saudi Arabia, South Korea, Thailand, Türkiye and Vietnam, nothing beyond the strictly necessary runs until you answer the dialog on your first visit — not analytics, not Stay22 — and Reject all sits on that first screen next to Accept all, not behind a second click.
In the United States you are shown a bar rather than a dialog, and it is not only a notice: analytics starts on arrival there, but advertising and booking-partner scripts stay switched off until you answer it. In Switzerland you get the dialog too, but analytics starts on arrival there and only advertising and booking-partner scripts wait for your answer. Readers in Canada, Australia, New Zealand, Japan, Singapore, Hong Kong, Taiwan, India, Malaysia, Indonesia, the Philippines, Mexico, Argentina, South Africa and the United Arab Emirates get a notice instead: everything described on this page starts when they arrive, the notice says so, and the same control switches it off. Everywhere else, and whenever the site cannot tell where you are, the strictest setting applies: nothing beyond the necessary runs until you answer.
Your answer is kept on your own device, in a first-party cookie called cookie_consent_1e7cfb that only this site can read, so you are not asked again on every page. An answer lasts up to a year, and a refusal given in the dialog six months, before you are asked again. The Cookie settings link in the footer of every page reopens the choice, and withdrawing is the same two clicks as agreeing: the scripts stop and what they stored on your device is cleared, including visitor_id_id22, cache_id22 and the thumbmark_* keys.
Refusing costs you nothing. Every guide here is readable in full either way, nothing is paywalled, and no part of Madrid Tourism Guide is held back from readers who say no.
If you are reading this in the United States
Several US states give you the right to opt out of the “sale” or “sharing” of personal information, and those words are broader than they sound: letting an advertising or affiliate partner receive information about your visit can count as sharing even though no money changes hands for your data and this site has never sold anything of the kind. Rather than argue the definition, Madrid Tourism Guide treats it as covered.
So the bar shown to US readers carries a Do not sell or share button, and for US readers the Cookie settings link at the foot of every page reads Do not sell or share my personal information. The button switches off everything except the strictly necessary — Stay22 and any ad partner included — and clears what Stay22 stored on your device if you had let it run; the link reopens the full choice at any time.
This site also honours Global Privacy Control. If your browser or an extension sends a GPC signal, it is treated as a valid opt-out on arrival — you do not have to find the control and click it as well, and the site does not ask again on later visits. Do Not Track is a different and long-abandoned signal, and to be straight about it: this site does not act on DNT, because nothing agreed what it ought to mean.
The record kept of your choice
Proving that a choice was offered and honoured means keeping a record of it. Each answer is logged with the date and time, the two-letter country the choice was made from, which of the rule sets above applied, a reference to the exact wording you were shown, and the choice itself, against a random identifier generated for your browser.
That record contains no name, no email address and no IP address. It holds a salted hash of your browser’s user-agent string, and the salt changes every day, so two visits on different days cannot be linked back together through it. Records are deleted after 26 months. If you want to see or delete the entries tied to your browser, ask through the contact form.
Embedded content and outbound links
Guides on this site link out to primary sources: museum ticket pages, Patrimonio Nacional, Metro de Madrid, EMT, the Consorcio Regional de Transportes, Renfe, esmadrid.com and similar. Following one of those links takes you to a site with its own privacy policy, over which this site has no control and no visibility. Photographs are served from this site’s own server, not hot-linked from elsewhere, so viewing a page does not report your visit to a photo host.
Where a guide embeds something from another site — a map, a video, a post — that embed is held back behind a placeholder until the relevant category is allowed, so it cannot quietly set anything on your device before you have chosen. Clicking the placeholder loads that one item.
Your rights
If you are in the United Kingdom or the European Economic Area, you have the right to ask what personal data is held about you, to have it corrected or erased, to object to or restrict its processing, and to receive a copy in a portable form. You also have the right to complain to your national data protection authority.
In practice, the only personal data this site holds that could identify you by name is a contact-form email, if you sent one. Ask through the contact page and it will be found and deleted. Analytics and server-log data are not linked to a name and cannot be traced back to an individual by this site, so a request to delete them cannot be honoured here — switching analytics off in the cookie settings, or the Analytics opt-out linked above, is the effective remedy.
Children
This is a travel reference site written for adults planning trips. It is not directed at children under 16, and no data is knowingly collected from them. If you believe a child has submitted personal information through the contact form, get in touch and it will be deleted.
Data retention and security
Contact-form emails are kept only as long as the correspondence is active, and generally no more than twelve months. Analytics data is retained according to the retention period configured in Google Analytics. Consent records are deleted after 26 months, and Stay22’s identifier stays in your browser’s storage until you clear it, or until you withdraw consent here, which clears it. The site is served over HTTPS throughout.
Changes to this policy
This page is revised when the site’s configuration changes — for instance when display advertising goes live, which is noted above as intended rather than present. The date at the top reflects the last substantive revision.