1. Data controller
- Controller: Astranova Consultoría Avanzada S.L.U. (Eskotin)
- NIF/CIF: B75884403
- Registered address: C/ Aranzabal 4, 9B, 01008 Vitoria-Gasteiz, Álava, España
- Country: Spain (European Union)
- Privacy contact: privacidad@eskotin.com
We are not required to appoint a Data Protection Officer (art. 37 GDPR). Privacy requests are handled through the email address above.
2. Data we process
- Account: email, name, hashed password and, if you sign in with Google, the identifier and basic profile data that provider shares with us.
- Profile (optional): photo, bio, country and city, level and discipline, interests, gender (used only to pick a default avatar, never published), social links, public phone or email if you choose to show them.
- Platform activity: content you publish, participation in challenges and giveaways, group outings and requests, reviews, wishlists, follows, reports, contact messages to creators or brands and clicks on deals.
- Brand or creator: entity details, commercial contact, catalogues, acceptance of terms and, where applicable, professional credential number and issuing authority.
- Payments and subscriptions: customer and subscription identifiers, status, period, amount, currency and billing data processed by our payment provider. Eskotin does not store card numbers.
- Email: send logs, deliveries, bounces, complaints and unsubscribes, so we stop writing to failing or unsubscribed addresses.
- Giveaway prizes: shipping address, only if you win and visible only to the prize organiser and administration.
- Technical: IP address, device and browser type, language and timestamps, logged for security and diagnostics.
- Server metrics: the hosting platform we use (Lovable, with Cloudflare CDN and protection) produces aggregate visit and pageview statistics from server logs, without analytics cookies or identifiers in your browser. Those logs include your IP and request data and are used for security and basic service measurement (legitimate interest, art. 6(1)(f) GDPR). Their retention is managed by the provider as our processor, for a limited period that we do not configure; we only access the statistics in aggregate form. The logs we do control ourselves (security and email delivery) are kept for up to 12 months.
3. Purposes and legal basis
- Creating and managing your account, publishing your profile and content and enabling community interaction — performance of a contract (art. 6.1.b GDPR).
- Managing subscriptions, payments, renewals and invoicing — performance of a contract and legal obligation (arts. 6.1.b and 6.1.c).
- Sending essential service communications (verification, password recovery, review notices, giveaway results, reminders for outings you joined) — performance of a contract.
- Sending non-essential community communications (news, featured content) — consent (art. 6.1.a), withdrawable at any time from the unsubscribe link in every email.
- Moderating content, handling reports and blocks, preventing fraud and abuse and maintaining security — legitimate interest (art. 6.1.f) and Digital Services Act obligations.
- Running giveaways and delivering prizes — performance of the contract with the participant and giveaway rules.
- Measuring platform use in aggregate — consent where non-essential cookies or identifiers are required; legitimate interest for aggregated statistics that do not identify you.
4. Who can see your data
Your public profile (name, photo, bio, country/city and the links you choose to show) is visible to any visitor if you enable public visibility. Private contact details, exact outing locations, quiz answers and prize shipping addresses are not public and are restricted by database access rules.
When you contact a brand or creator, or join an outing, we share with that person only the minimum data needed to respond to you.
5. Processors and transfers
- Backend, authentication, database and image storage provider (EU infrastructure).
- Web application hosting and CDN.
- Payment and subscription processor (Stripe).
- Transactional email provider.
- Machine translation and AI assistance provider, when used to translate public listings.
- Google Fonts, to load the site typeface (it may process your IP when serving the font).
- Google, only if you choose to sign in with your Google account.
Some of these providers are established in the USA. In those cases the transfer relies on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework. We do not sell your data and we do not share it with third parties for advertising.
6. Retention
- Account and profile: while the account is active. On deletion, associated data is erased or anonymised within a maximum of 30 days.
- Billing and payments: 6 years, under Spanish commercial and tax obligations.
- Security and email delivery logs: up to 12 months.
- Email suppression list (unsubscribes, bounces and complaints): we keep only the minimum data needed (your email address and the reason) for as long as it is necessary to keep honouring your opt-out or objection. If we stop sending communications, or you ask us to delete that record and it is no longer needed to respect your objection, we erase it.
- Prize and winner data: as long as needed to deliver the prize and evidence the giveaway.
7. Automated decision-making
We do not make automated decisions with legal effects on you, nor do we profile you for that purpose. Giveaway winners are selected at random and content review is carried out by a person on the team.
8. Your rights
You can exercise your rights of access, rectification, erasure, portability, objection, restriction and withdrawal of consent by emailing privacidad@eskotin.com. We reply within one month. If you believe your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
You can also delete your account directly from this page.
9. Cookies
We use strictly necessary storage to keep your session, security and the language you choose. Analytics and marketing cookies or identifiers require your consent and none is active today. Details and management in the Cookie Policy.
10. Minors
Eskotin sets, as its own platform rule, a minimum contractual age of 16 to create an account. This is an Eskotin decision based on the nature of the activity, person-to-person interaction and the contracting of services — it is not a requirement of art. 7 of Spanish Law 3/2018 (LOPDGDD), which sets 14 as the age from which a minor may consent to the processing of their own data. We do not knowingly collect data from anyone under 16; if we detect an account below that minimum age, we delete it.
11. Security
We apply technical and organisational measures appropriate to the risk: encryption in transit, hashed passwords, row-level access control in the database, separation of administrative roles and access logging. In the event of a breach posing a risk to your rights, we will notify the authority and, where required, the affected people.
12. Changes
We will publish any material change on this page, showing the update date, and will notify you at least 15 days in advance where legally required.
Astranova Consultoría Avanzada S.L.U. (Eskotin)