Privacy: what this site does with your data

The guide does not sell personal data and does not pass it to anyone for targeted advertising.

cartagena.info is published and edited by Rainer Lang. It is an independent guide: not the website of the city, the tourism board, the port or any tour operator or hotel.

Controller

The one who decides what this site does with personal data: Rainer Lang.

How to reach the publisher

By the contact form on the contact page and at [email protected]. No postal address is published.

Privacy contact

Any question or request about your data: write by email at [email protected] or through the contact form.

The host. The site is hosted on Cloudflare Pages, a service of Cloudflare, Inc., a US company. To deliver a page, Cloudflare’s servers receive what every web server receives: your IP address, the page you asked for and technical details of your browser. Cloudflare handles this on the guide’s behalf, to deliver the page and to keep the service secure. What else it does with it, and how long it keeps its logs, is in its privacy policy. The site’s own code does not store your IP address.

Cloudflare can show the publisher totals drawn from those logs, such as the number of requests. The totals do not name a reader.

No cookies, one outside script. The site sets no cookies. Fonts, images and the pages’ own scripts come from the site itself. The one exception is the Cloudflare Web Analytics script named above, which the host adds; nothing else is loaded from another company.

Two things saved in your browser. The month you pick at the top of a page is saved in your browser’s local storage under the name ctg-month, so the next page opens on the same month. It is saved only when you pick a month. On the cruise port page, the hours-ashore tool saves its settings under the name ctg-ashore: arrival, all aboard, the ship and the way into town. It saves them when the page opens, with the starting values, and again each time you change one, so your plan is still there when you come back.

Both stay in your browser. They are never sent to the site and are not used to recognize you. Clearing the site’s data in your browser removes them. They do nothing but remember settings of the page you are using, which is why the site shows no consent banner.

Analytics. The site counts visits with Cloudflare Web Analytics. It sets no cookie and stores nothing in your browser. A small script from Cloudflare reports the page address, the page you came from, your browser type and how fast the page loaded. Cloudflare states that it does not use this to identify you or to follow you across sites (Cloudflare Web Analytics).

Partner links are the links whose address begins with /go/ (see the affiliate disclosure). When you click one, this site’s server sends your browser on to the partner.

The server notes four things for each click: which link, the path of the page your browser says the click came from, the country Cloudflare places the request in, and the time. It does not record your IP address or anything else that identifies you, and it sets no cookie. The counts are kept in Cloudflare’s Workers Analytics Engine for three months and then deleted. They show which pages send readers to partners.

What goes with you to the partner. Three things, all about the guide and the page you were on:

• The account idThe address you are sent to carries the guide’s account id with that partner. It tells the partner that a booking came through the guide, which is how the guide is paid.
• A page tagThe same address carries a tag that names the page you clicked on, for example cartagenainfo-cartagena-nightlife. It shows the guide which page a booking came from. The page name is read from the page address your browser sends; if it sends none, the tag names the page the link was written for.
• The page addressYour browser also tells the partner the full address of the page you clicked on, for example cartagena.info/cartagena-nightlife/. The redirect asks for this on purpose, so the partner can see which page sent you. Ordinary outside links on this site, such as official sites and map links, pass on only cartagena.info, not the page.

A partner link carries no name, no email address and no account of yours: the guide sends none. As with any site you open, the partner receives your IP address and your browser’s technical details directly from your browser.

The partners. From the click on, you are on the partner’s site. Each partner is responsible for what it does with your data there, and each may set its own cookies.

GetYourGuide

Tours, boats, tickets and classes. GetYourGuide Deutschland GmbH, Germany. GetYourGuide privacy policy

Viator

Tours, boats, tickets and classes. Viator, Inc., United States, a Tripadvisor company. Viator privacy policy

Stay22

A travel affiliate network. Every hotel link goes to Stay22 first, which sends you on to Booking.com. Stay22 Technologies Inc., Canada. Stay22 privacy policy

Booking.com

Hotels and other places to stay. Booking.com B.V., the Netherlands. Booking.com privacy policy

The contact form stores what you type: your message, your name and email address if you give them, and the time you sent it. Only the message is required. It is kept with the site’s host, Cloudflare, for up to 180 days and then deleted automatically, or sooner if you ask. Your IP address is not stored with it.

The message is used to read and answer it, and for nothing else. The form itself sends no mail; the editor reads the stored messages. If you gave an email address and he answers, the answer is an ordinary email, and that exchange is then in his mailbox like any other mail. Spam is kept out with a hidden form field, not with an outside service.

If you are in the European Union, the European Economic Area or the United Kingdom, data protection law asks for a legal basis for each use of personal data. For each use below it is the legitimate interest named beside it (Article 6(1)(f) of the GDPR).

• Delivering pagesTo send you the page you asked for and to keep the site secure.
• Partner linksTo send you to the partner and to be credited for a booking, which is how the guide is paid. To see which pages send readers to partners, counted without recording who clicked.
• Contact messagesTo read and answer what you wrote.

Nothing on the site requires you to give data. You can read every page without typing anything, and in the contact form only the message is required. The site makes no automated decisions about you and builds no profile of you.

The host. Cloudflare is a US company with servers around the world. Your request is normally answered by a server near you, but data about it can be processed in the United States and in other countries. Cloudflare is certified under the EU-US Data Privacy Framework, and its data processing addendum includes the EU standard contractual clauses for transfers the framework does not cover. The addendum applies to the account that hosts this site.

The partners. GetYourGuide and Booking.com are based in the EU. Viator is based in the United States. Stay22 is based in Canada, a country the European Commission has found to protect personal data adequately. You reach them by your own click; their privacy policies say how they protect data.

Wherever you live, you can ask the guide what data it holds about you, ask for a copy, have it corrected or deleted, or object to its use. Write by email at [email protected] or through the contact form. You get an answer within one month, and asking costs nothing.

The only data the guide itself can look up is a contact message, found by the name, email address or date you give. Click counts carry nothing that points to a person. For the host’s logs and for anything a partner holds, the guide passes your request on or tells you where to send it.

In the EU, the EEA and the UK. The GDPR gives you the rights of access, correction, deletion, restriction and data portability, and the right to object to a use that rests on legitimate interest. You can also complain to a data protection authority: the one where you live or work (list of EU authorities, the ICO in the UK).

In the United States. Several states, California among them, give residents the right to know, correct and delete their personal information and to opt out of its sale or sharing. The guide does not sell personal information and does not share it for targeted advertising, so there is nothing to opt out of. It answers a request the same way whichever state you live in, and it does not treat you differently for asking.

Do Not Track and Global Privacy Control. Your browser can send either signal. The site does not follow you from site to site, sets no cookies and sells no data, so there is nothing for the signal to switch off, and the site does not read it. Pages and partner links work the same with or without it. Once you are on a partner’s site, the partner decides how it treats the signal.

Children. The guide is written for adults planning a trip. It is not directed to children under 13 and does not knowingly collect data from them. A parent who thinks a child has sent a message can ask for it to be deleted.

This wording has been in effect since 12 November 2026. The site has no reader accounts and keeps no list of readers, so a change is announced here: the date under the title changes, and the list below says what changed. A new partner, analytics being switched on or the contact form going live is a change of this kind.

12 November 2026

First version of this page.