Privacy policy

1. Who processes your data

The data controller is the owner of this site, whose identification and contact details are set out in the legal notice. Any question about this policy, and any of the rights explained below, is handled at that same email address.

2. What data is processed

Only what is needed for what is being done. No data is requested «just in case», and none of it exists solely to build a commercial profile of the person giving it.

• To have an account: an email address, a display name and a password, which is stored hashed and which nobody —not even the site owner— can read.
• What you post: comments, wall notes, polls, lineups and a profile picture if you add one. This is public content, so anyone can see it.
• Technical data about browsing itself: IP address, browser type and pages visited, which are kept in the server logs for security.
• The choice you make about cookies, stored in your own browser so you are not asked again.

3. What for, and on what legal basis

Each kind of processing has to rest on something that justifies it, and it is not the same thing in every case. These are the four that apply here.

4. How long it is kept

Account data, for as long as the account exists. If you delete it, the data is erased; what you posted may be kept without your name, because it forms part of other people’s conversations and removing it would leave those conversations meaningless.

Server logs are kept for a short period, the one needed to spot security incidents, and then deleted. The cookie choice expires after a year, and then you are asked again.

5. Who else sees your data

It is neither sold nor handed to anyone. It is processed, on the owner’s behalf and only to provide their service, by the companies that keep the site running: the hosting provider and the email provider.

And there are the videos that go with some articles: the player is served by YouTube, and when it loads, your IP address reaches Google. That is why you are asked on arrival: if you accept, the player loads by itself as you approach the video; if not, only when you ask for it by pressing play. The cookie policy has the detail.

6. Data outside Europe

Google —both the video player and, if there ever is any, the advertising— may process data in countries outside the European Economic Area. Where that happens it relies on European Commission adequacy decisions or on standard contractual clauses, the two mechanisms the GDPR provides for it. If you do not accept third-party content, there is no transfer.

7. What you can do, and how

Two of these rights do not have to be asked for: they are in your profile, they work immediately and you do not have to explain why. “Download my data” gives you a file with everything held about you, and “Delete my account” deletes it right there.

Deleting the account empties it: your email, your name, your handle, your bio and your picture stop existing, and what was only yours is deleted — votes, reactions, predictions, who you followed. What you wrote inside a conversation stays without your name, for the reason explained above. Your email address is freed and you can sign up with it again.

There is one exception, and it is the one the law imposes: if you have ever signed the contributor agreement or been paid, those documents have to be kept for the period tax law sets (art. 17.3.b GDPR). In that case the button tells you so, and the rest is settled by writing.

And for what has no button, by writing to the contact address in the legal notice, also without having to explain why:

• Access the data held about you.
• Correct anything that is wrong.
• Erase it, and the account with it.
• Restrict or object to a particular kind of processing.
• Take it elsewhere in a machine-readable format.
• Withdraw at any time the consent you gave to third-party content, from the cookie link in the footer. Withdrawing it does not undo what was done while it was given.

8. And if the answer does not satisfy you

You can complain to the Agencia Española de Protección de Datos (www.aepd.es), the supervisory authority in Spain. You do not have to write to the site owner first, although it is usually quicker.

9. Minors

An account requires you to be fourteen or older, the age Spanish law sets for consenting to data processing on your own behalf. An account belonging to someone younger, without authorisation from whoever represents them, is deleted when detected.

10. Security

The whole site is served over an encrypted connection, passwords are stored using a key-derivation function designed for it —not in the clear, and not reversibly— and access to the data is limited to whoever needs it to keep the site running. No system is invulnerable, and promising otherwise would be a lie.

11. Changes to this policy

If anything changes in how your data is handled, it is published here with its date, and if the change is one that requires asking for consent again, consent is asked for again.