Privacy policy

1. Controller and scope

Esferacreix SL operates EsferaUp and is the controller for the processing described here as its own. Privacy contact: privacy@esferaup.com. Tax identification number: B66933300. Registered address: Carrer Balmes, no. 15, 08750 Molins de Rei (Barcelona), Spain. Initial registration: Barcelona Mercantile Registry, volume 45762, page 172, sheet B 498175, entry 1, 6 February 2017.

This policy covers the public website and the waiting list. Before the family service opens we will publish the policy that governs it; until then it does not apply to family data. The contact above is for privacy; it is not described as a data protection officer without an actual designation.

2. Waiting list

The list is for adults aged 18 or over living in Spain. We request your email and language and record signup and confirmation dates, the version of the notice shown and subscription status. We do not request names or children’s information. If you arrive from a campaign link, we store the tag of that link (for example the social network or the message) with your signup to learn which communications work. We use no cookies or device storage for this, and it is deleted when you leave the list. Basis: our legitimate interest in measuring the campaign; you can object by writing to privacy@esferaup.com. Joining does not create an app account or paid subscription.

Your specific consent allows us to confirm your address and send the invitation and launch offer; it does not cover general newsletters. Withdraw it through an email link or privacy@esferaup.com without forfeiting an already confirmed reservation. After withdrawal we stop invitations; contact us when the service opens to claim your reservation. Offer administration relies on the reservation agreement; abuse prevention and limited compliance evidence rely on assessed legitimate interests.

3. Providers, recipients and locations

Hosting and database: DigitalOcean, Frankfurt. Confirmation email: Scaleway Transactional Email, region fr-par. Incoming email: Cloudflare Email Routing and the team mailbox (Google Gmail). Server and web errors: Sentry, EU project.

Cloudflare provides CDN, firewall and Turnstile. Turnstile receives browser/device, interaction and IP information to check abuse; Cloudflare acts as processor for site protection and independently as controller for improving bot detection under its privacy notice. We do not sell data or share it for third-party advertising.

Hosting core data in the EU does not exclude global services or access. Before each transfer, the receiving entity, country and applicable safeguard must be identified: an adequacy decision covering the recipient, or standard clauses with assessment and supplementary measures where required. Request information and copies of safeguards at privacy@esferaup.com.

4. Retention

Unconfirmed requests: we delete them after 30 days. The active email list ends at most 12 months after opening, or 18 months after signup if the service has not opened. Leaving removes the address from the mailing list. We keep separately, without a decryptable address and with restricted access, a minimal record of consent, withdrawal and confirmed reservation (cryptographic hash of the email, language, versions, digest and dates) to handle rights and claims; it does not allow promotions to continue. The period for this record (proposed: five years from withdrawal or expiry) will be confirmed with legal advice. Deleting this record does not extinguish rights that can be shown by other means.

5. Security and your rights

We use access controls, family separation, encryption of sensitive fields and file checks. No measure removes all risk. You may request access, correction, erasure, restriction, portability where applicable and objection, including objection to marketing. You may withdraw consent without affecting earlier lawful processing. We request proportionate identity evidence where needed, not routinely a complete identity-document copy.

Write to privacy@esferaup.com or use available privacy controls. We respond within one month; complexity or request volume may justify up to two additional months, with notice during the first month. You may complain to the AEPD, www.aepd.es, or the competent authority. Material changes will be notified and any necessary fresh consent obtained before new processing. Applicable versions will be retained.