Privacy

Who is responsible for your data

Data controller: Vitalie Ciobanu, as a private individual. Contact: vitalie.ciobanu@gmail.com.

Data processor: Raiola Networks S.L., which hosts the site and the database in Spain. There is nobody else.

What is stored

About each person: name, email address, mobile number if you give one (it is optional), the password stored as a hash (never in the clear), the language and theme you chose, and how you are related to whoever invited you.

About each ticket: number, series, fraction, price, where it was bought if you write it down, and any photos you take.

To collect a prize: DNI or NIE and IBAN. These are optional and only needed if one of your tickets wins. They are stored encrypted.

On top of that, for security and to be able to explain what happened: the date, the IP address and the browser you accept each rule with, and a log of the important actions (tickets added and removed, checks, closings).

What it is for

To run the penya: who is in, how many tickets each person put in, and what share that gives them.

To document the agreement: that each person accepted particular rules before the draw, with the date and the text they read.

To produce the document the holder takes to the bank if a ticket wins, where the bank needs each participant's name, DNI and share.

To email you about what affects you: invitations, access codes, new rules, the closing and the split.

On what legal basis

Your consent, which you give when you sign up and can take back whenever you like, and carrying out the penya agreement, which is what makes working out your share possible.

The record of acceptances and the closing snapshot are also kept on legitimate interest: they are the evidence that the split was agreed before the draw and is not a gift.

For how long

Nothing is deleted automatically. Data is kept until you ask for it to be deleted.

There are two reasons: the penya runs again every year, and the record of the split is the evidence that it was not a gift, which may be needed while tax matters can still be looked at, which is four years.

When you ask for deletion, your personal data goes (name, email, phone, DNI, IBAN and photos) and the split lines already generated are kept anonymised, because they are also somebody else's accounts.

One exception: if an incident was recorded about you (a winning ticket that could not be presented, for instance), that incident is kept with the name, email, date, type and amount. It is a dated fact that can affect other people in the penya.

Who can see it

The other members of your penya see your name, how you are related to whoever invited you, how many tickets you put in and your share. Nothing else.

Your DNI and IBAN are seen only by the administrator and by the holder of the winning ticket, and only for the document presented at the bank.

Nothing is passed on to anybody else, nothing is sold, and none of it is used for advertising or profiling.

How it is protected

DNI and IBAN are stored encrypted. Passwords are stored as hashes and cannot be recovered, only changed.

Signing in always takes a second factor, either an authenticator app or a code by email.

Ticket photos are not in a public folder: the site serves them only to people entitled to see them.

All traffic goes over HTTPS.

Your rights

You can ask to see your data, correct it, delete it, object to it being used, restrict it or take it elsewhere. Just write to vitalie.ciobanu@gmail.com from the address you signed up with.

If you think your data is not being handled properly, you can complain to the Spanish data protection authority (www.aepd.es).

Cookies

Only the technical ones: the session cookie, so you do not have to sign in on every page, and the ones that remember the language, theme and date format you chose.

There is no analytics, no third-party cookies and no tracking of any kind. That is why this site does not ask you to accept cookies.