Privacy

Controller

Name: Vitalie Ciobanu
NIE: Y3939529B
Email: vitalie@porsitoca.es

Data processor: Raiola Networks S.L., which hosts the site and the database in Spain. There is nobody else.

Purpose

Running the lottery ticket penya of the people invited to porsitoca.es: knowing who is in, how many tickets each person has put in and what share corresponds to them.

Documenting the agreement: that each person accepted specific rules before the draw, with the date and the text they read.

Producing the document the holder takes to the bank if a ticket wins, where the bank needs each participant's name, DNI and share.

Sending by email the notices that concern each person: invitations, access codes, new rules, the closing and the split.

Legal basis

Consent confirmed when registering on the site, which you may withdraw whenever you wish, and performance of the penya agreement, which is what is needed to work out each person's share.

Consent and legitimate interest: the record of acceptances and the copy of the list at closing are also kept on the basis of legitimate interest, because they are the proof that the split was agreed before the draw and is not a gift.

porsitoca.es is a personal, non-profit project created with the sole purpose of documenting a lottery ticket penya among people who know each other. Our legitimate interest is being able to show that agreement, without that interest overriding the fundamental rights and freedoms of users.

Recipients of personal data

The User's personal data may be disclosed to the following recipients:

• The other members of your penya, who see your name, who invited you, how many tickets you have put in and your share. Nothing else.
• The administrator of the penya and whoever holds a winning ticket that is collected at the bank, who see your DNI and IBAN for the document presented there. And if another member has to transfer your part of the split to you, they see your IBAN and the payment reference, so they can do it.
• Raiola Networks S.L., as data processor, which hosts the site, the database and the mail in Spain.
• Public Administrations and Bodies when required by tax, labour or any other applicable regulation.

Data is not passed to anybody else, it is not sold, and it is not used for advertising or to build profiles. There are no transfers outside the European Economic Area.

We undertake never to use your personal data for purposes other than those set out in this privacy policy, nor to pass it on unlawfully to third parties.

Principles applied to the processing of personal data

The principles set out below are applied within the framework of, and by, the person responsible mentioned in the first section. Personal data will always be:

• processed lawfully, fairly and transparently
• collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
• accurate and, where necessary, kept up to date, taking every reasonable step to ensure that data that are inaccurate with regard to the purposes for which they are processed are erased or rectified
• kept for no longer than is necessary for the purposes of the processing
• processed with integrity and confidentiality, so as to ensure appropriate security of the data.

Types of personal data processed and purpose

The personal data provided must be true, accurate and complete and kept up to date. Providing data through the form is mandatory, at least the fields marked as such, and implies that you have been informed and have given your consent to the content of this privacy policy. Failure to provide it, or providing incorrect data, will make it impossible for us to handle the requests made correctly.

On our website we collect the following categories of personal data:

• About each person: name, email address, the password stored as a hash (never in the clear), the language, theme and date format you chose, and who invited you.
• About each ticket: number, series, fraction, price, where it was bought if you write it down, and any photos you take.
• To collect a prize: DNI or NIE and IBAN. These are optional and only needed if one of your tickets wins. They are stored encrypted.
• To sign in: if you use an authenticator app, its key, encrypted; and for every open session and every sign-in attempt, the IP address and the browser.
• For security and to be able to explain what happened: the date, the IP address and the browser you accept each rule with, a log of the important actions (tickets added and removed, checks, closings) and a log of the emails the site sends (to whom and when). All of it is backed up every night, encrypted.

At any time you can change your information or preferences or provide additional details.

We will not use your personal data to make automated decisions that affect you or to create profiles other than those described above. In any case, if the data were further processed for a purpose different from the one for which it was originally collected, we will inform you of all the relevant aspects of that other purpose before carrying out that further processing.

Retention period of personal data

Users' personal data will be kept for as long as their participation in the penya lasts and in any case for the time necessary to fulfil the purpose for which it was collected and to determine any liabilities that may arise from that purpose and processing.

To determine the appropriate retention period for personal data, we also consider the amount, type and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the legal requirements that apply.

Nothing is deleted automatically. Data is kept until you ask for it to be deleted. There are two reasons: the penya runs again every year, and the record of the split is the evidence that it was not a gift, which may be needed while tax matters can still be looked at, which is four years.

When you ask for deletion, your personal data goes: name, email (also from the action log, the email log and the sign-in attempts), DNI, IBAN, the authenticator app key, your sessions and your photos, including the copies in the backups. The split lines already generated are kept anonymised, because they are also somebody else's accounts. The IP address and browser of your acceptances and of the action log are kept: they are part of the evidence of each acceptance. Database backups from before the deletion disappear on their own after a few days.

One exception: if an incident was recorded about you (a winning ticket that could not be presented, for instance), that incident is kept with the name, email, date, type and amount. It is a dated fact that can affect other people in the penya.

Rights of individuals

Users may exercise any of the rights recognised in data protection regulations before us.

We undertake to respect and facilitate the exercise of these rights and, in particular, the rights of access, rectification, suspension, objection, restriction of processing and data portability. These rights may be exercised by sending an email to vitalie@porsitoca.es, from the address you registered with. Deletion can also be requested from your profile.

We will provide you with all the necessary information about the actions we take on the basis of any request to exercise the rights that concern you as a data subject, within the legally stipulated time limits.

In any case, we inform you that you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

Security measures applied to personal data

We guarantee that we maintain levels of security for the protection of the personal data you provide through the website in line with current regulations, and that all the corresponding technical and organisational measures have been established and are applied to prevent the accidental loss, destruction or damage, misuse, alteration and unauthorised or unlawful processing of the data provided by Users.

We have also implemented a notification procedure in case of any suspected breach of the security of personal data, addressed to the data subjects and also to the competent supervisory authority.

DNI, IBAN and the authenticator app key are stored encrypted. Passwords are stored as a hash and cannot be recovered, only changed. Signing in always requires a second factor, with an authenticator app or a code by email. Ticket photos and backups are not in a public folder: the site serves the photos only to whoever is entitled to see them, and the database backups are encrypted with a key that is not on the server. All traffic goes over HTTPS.

Right to withdraw consent

If you have given your consent to the processing of your personal data, you have the right to withdraw it in whole or in part. To withdraw your consent, contact us by email at vitalie@porsitoca.es or ask for deletion from your profile.

Once we have received notice that you have withdrawn your consent, we will no longer process your information for the purposes for which you originally authorised it, unless there are compelling legitimate grounds for further processing that override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Withdrawing consent to receive communications will not affect the processing of personal data for the fulfilment of legal obligations.

Cookies

Only the technical ones: the session cookie, so you do not have to sign in on every page, and the ones that remember the language, theme and date format you chose.

There is no analytics, no third-party cookies and no tracking of any kind. That is why this site does not ask you to accept cookies. The detail is in the cookie policy, linked in the footer of every page.

Contact

If you have questions, comments or complaints about the use of your personal data, contact us by email at vitalie@porsitoca.es or by phone at +34.633.10.70.42.

Change history

Version 2.0 — 4 October 2026: update of the privacy policy (identified controller, principles, recipients, withdrawal of consent and contact); it is corrected that how you are related to whoever invited you is no longer kept.

Version 1.2 — 3 October 2026: the site stops asking for and storing the mobile phone number.

Version 1.1 — 15 September 2026: deletion on request, who sees each piece of data and how it is protected are explained.

Version 1.0 — 12 September 2026: initial version.