Privacy Policy

1. Controller and contact

The data controller is CD Estepona Fans. For any privacy question you can write to info@cdesteponafans.com. Postal address: Avenida España, Estepona (Málaga), Spain.

2. Scope

This policy applies to the CD Estepona Fans website and to its iOS and Android apps. The apps do not require you to create an account or sign in, and they have no paid features. The website and the apps may show sponsor content and links, but they do not integrate advertising networks. Some data is processed only on the website and some only in the apps; each section says which.

3. Data we process on the website

• Newsletter: if you subscribe, we process your email address. Subscription requires confirmation: we send you an email and, until you confirm, the request remains pending.
• Analytics, only if you accept it: if you accept analytics cookies in the banner, Google Analytics 4, Vercel Web Analytics and Vercel Speed Insights are loaded. These tools process online identifiers, information about your browser and device, the pages you visit and interaction events (for example, reading articles, clicks on external links, and sponsor banner impressions and clicks). This data is not anonymous. If you reject analytics cookies, these tools are not loaded.
• Sponsor banners: we count each banner's impressions and clicks on our own server as daily totals, without storing any data about who sees them.
• Read counter: when you open an article, one read is added to its counter. We only store the total per article.
• Storage in your browser: we store technical preferences, such as your language or your cookie choice. Details are in our Cookie Policy.
• Embedded third-party content: some pages include YouTube videos or iVoox players. When they load, these services receive technical data from your browser, such as your IP address, and may use cookies under their own policies.

4. Data we process in the apps

The apps do not use cookies, do not contain built-in web browsers, do not integrate advertising, analytics or crash-reporting tools, do not access your device's advertising identifier and do not track you across third-party apps or websites. On Android, the app includes the Firebase Cloud Messaging SDK for notifications, with Google Analytics for Firebase collection disabled (see section 5).

Data the apps do process:

• Push notifications and device identifiers: see section 5.
• Newsletter: if you subscribe from the app, your email is sent to our server and handled as on the website. The app does not store it on the device.
• Read counter: when you read an article, the app sends our server the article's identifier to add one read to its counter. No identifier of yours or of your device is sent.
• Radio: radio and podcast audio is played directly from iVoox, which receives the connection's technical data, such as your IP address.
• Photos (iOS only): the app only asks for permission to add photos to your library when you choose to save an image. It does not read your photos.
• Data stored on the device: the notification registration identifier and key (on iOS the key is stored in the keychain and may remain there even if you uninstall the app; on Android it is stored encrypted with the system keystore) and cached copies of images and content. On iOS, also the latest headlines shown by the widgets and whether you dismissed the card offering to turn on notifications.
• Suggestions and corrections: from the "About" screen you can send us suggestions, change requests or corrections by email. The app opens your email app with a message addressed to info@cdesteponafans.com that includes the app version and build, the operating system and its version and, where relevant, the screen you are writing from; you can review or delete that text before sending it. The app sends nothing by itself: we only receive the message if you send it, and we then process your email address, the content of the message and that context to reply to you and improve the service.
• App rating: from time to time the app may ask the system to show the native App Store or Google Play rating dialog. To decide when, the app keeps some usage counters on your device only (days of use, finished matches viewed, and the date and version of the last request), which are not sent to our server. Ratings are handled by Apple or Google under their own policies.

5. Push notifications and device identifiers

Notifications are optional and you can turn them off at any time. How they are turned on depends on the platform:

• iOS: the app only asks for permission when you request it from the notifications card or from Settings, and it only registers for notifications if you grant it.
• Android 13 or later: the app asks for the notification permission when you request it from the notifications card or from Settings, and may also ask when you play the radio, to show the playback controls. It only registers with our server if you grant that permission.
• Android 8 to 12: the system has no notification permission the app can ask for, and notifications are on by default. The app registers with our server while the app's notifications are turned on in the system settings.

When the app registers for notifications, our server stores:

• your device's push notification token, issued by Apple Push Notification service (APNs) on iOS or by Firebase Cloud Messaging (FCM) on Android;
• the platform (iOS or Android), the app language, the app version, the operating system version and the device model (on iOS only the generic type, for example "iPhone"; on Android the manufacturer and model);
• a device identifier and a secret key generated by our server; of the key we only store a cryptographic hash;
• your notification topic preferences;
• technical dates (registration, last update and last activity) and whether the registration is active;
• a record of each notification sent to your device: whether the provider accepted it, the error code if any, and the sending date;
• on iOS, if you start a Live Activity for a match, that activity's token linked to the match;
• on iOS, if you turn on automatic Live Activities, the Live Activity start token issued by Apple and that preference (see below).

This data is not linked to your name, your email address or any account, and we do not use it to track you or for advertising. However, the token and the device identifier are unique identifiers, so we do not consider them anonymous data.

Notification content is sports and editorial information (goals, kick-off, half-time and full-time, line-ups, cards and featured news) and does not include personal data about you. To deliver it, we send the token and the content of each notification to Apple Push Notification service (APNs), by Apple, on iOS, and to Firebase Cloud Messaging (FCM), by Google, on Android.

In the app settings you can turn each topic on or off. Goal correction alerts (for example, when a goal is disallowed) cannot be turned off separately.

Automatic Live Activities (iOS only): if you turn them on in the app settings, the app sends our server a Live Activity start token issued by Apple, and we store that preference together with your device registration. Notifications must be turned on. When a match starts, we use that token to ask Apple Push Notification service (APNs) to show the match's Live Activity on your iPhone automatically; at most one request is sent per match and device, and it is noted in the delivery records. If you turn the option off, or if Live Activities are turned off in iOS Settings, the app tells the server and we delete the token; we also delete it if Apple tells us it is no longer valid.

What happens when you turn notifications off or uninstall the app:

• Android: the notification token is only generated and registered with our server when notifications are allowed as described above. If you turn them off in the system settings or withdraw the permission, the app deletes the token in Firebase Cloud Messaging the next time it is opened or returns to the foreground. From then on, notifications can no longer be delivered to that token and, at the next sending attempt, we mark the registration as inactive, but we do not delete it.
• iOS: turning notifications off in the system settings stops them from being shown, but does not delete or deactivate your device's registration on our server.
• If you uninstall the app, the token stops being valid. When Apple or Google tell us so during a sending attempt, we mark the registration as inactive, but we do not delete it.

6. La Quiniela participants

La Quiniela is a CD Estepona Fans competition in which people take part by posting their predictions in the comments of our Facebook posts. If you take part, we take your name as it appears in your public participation and publish it in the ranking on the website and in the iOS and Android apps, together with your points per matchday, your total score and your position. We do not store your predictions, your screenshots or your contact details.

Only some participants have a photo. Before using photos, we asked participants through Facebook whether they wanted their photo to be used, and we only show the photos of those who accepted. Photos are shown on the website and in the iOS app; the Android app shows names only.

Rankings from previous seasons, with their names, points and photos, remain published. There is no automatic deletion period.

This data is stored in our database (Railway) and in the website's private code repository (GitHub), and is published through our hosting (Vercel).

You can ask us at any time to remove or correct your name or photo by writing to info@cdesteponafans.com or through our Facebook page. Removal is done manually.

7. Technical connection data

When you use the website or the apps, our servers and hosting providers receive your IP address and technical data about each request, as happens with any internet connection.

We use the IP address temporarily to limit abuse (for example, too many subscriptions or registrations in a short time). It is kept in a cache that expires automatically within at most 24 hours. For the newsletter, your email is also used for this purpose.

We do not store your IP address together with your device registration, your subscription or reads. Hosting providers may keep technical logs under their own terms.

8. Purposes and legal bases

Below we indicate, for each processing activity, the legal basis on which we consider it rests under the General Data Protection Regulation (GDPR). This is our own assessment; if you have questions about any of them, you can write to us.

• Newsletter (sending you news and updates): we consider it to be based on your consent, which you can withdraw at any time.
• Website analytics through cookies (understanding how the site is used and improving it): we consider it to be based on your consent, given in the banner.
• Push notifications (token, preferences and Live Activities, including automatic ones, to send you the alerts you choose): we consider them to be based on your decision to receive notifications — by granting the permission on iOS and on Android 13 or later, or by keeping them turned on on Android 8 to 12 — and, for automatic Live Activities, on your decision to turn them on in the app settings; you can revoke them by turning them off.
• Technical device data and delivery records (making sure notifications arrive, in the right language, and diagnosing failures): we consider them to be based on our legitimate interest in the proper functioning of the service.
• Temporary use of the IP address to limit abuse and protect the service: we consider it to be based on our legitimate interest in the security of the service.
• Aggregate read and banner counters (knowing how popular content and sponsorships are): we consider them to be based on our legitimate interest; only totals are stored.
• La Quiniela names and scores: we consider them to be based on our legitimate interest in organising this public, voluntary competition and publishing its ranking. You can object at any time.
• La Quiniela photos: we only use those of participants who accepted when we asked them through Facebook; you can withdraw that acceptance at any time.
• Suggestion or correction messages you send us by email: we consider them to be based on our legitimate interest in replying to you and improving the service.
• Handling your requests and the exercise of your rights: we consider it to be based on compliance with our legal obligations.

We do not sell your data.

9. Providers involved in processing

To provide the service we use the following providers, which process data to the extent necessary to provide their service to us:

• Vercel: hosting of the website and of the apps' API, and website analytics (only with your consent).
• Railway: database and server processes.
• Upstash: cache and abuse limiting (temporary use of the IP address).
• Cloudflare (R2): image storage and delivery.
• Cloudinary: image storage.
• GitHub: the website's private code repository, which contains the list of La Quiniela participants and their photos.
• Brevo: sending newsletter and confirmation emails.
• Apple (Apple Push Notification service): delivering notifications on iOS.
• Google: Firebase Cloud Messaging, to deliver notifications on Android; Google Analytics 4, only with your consent; and YouTube, for embedded videos and YouTube API Services.
• iVoox: playing the radio and podcasts.

Participation in La Quiniela, and questions about it, take place on Facebook, by Meta, which is governed by its own terms and policies.

Some of these providers may process data outside the European Economic Area. You can check the safeguards they apply in their privacy policies.

10. Retention

• Newsletter: we keep your email until you ask to unsubscribe. Unconfirmed sign-ups have no automatic deletion period; they may be deleted through a manual process.
• Device registrations, preferences, delivery records and Live Activity records: there is currently no automatic deletion period, and they are kept until they are expressly deleted. When a token stops being valid, the registration is marked as inactive, but it is not deleted. Live Activity records are kept after the activity ends.
• Automatic Live Activity start token (iOS): kept while the option is turned on; deleted when you turn it off or when Apple indicates it is no longer valid.
• Messages you send us by email: there is no automatic deletion period; you can ask us to delete them.
• La Quiniela: names, scores and photos are kept, including in previous seasons' rankings, until their removal is requested. There is no automatic deletion period.
• IP address for abuse limiting: at most 24 hours.
• Analytics: according to each tool's configuration and Google's and Vercel's terms.
• Hosting technical logs: according to each provider's terms.

11. Your rights and how to request deletion

You can exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw your consent at any time, by writing to info@cdesteponafans.com.

• Newsletter: newsletter emails do not currently include an automatic unsubscribe link. To unsubscribe or request the deletion of your email, write to us from the subscribed address.
• Website analytics: you can withdraw your consent by clearing this site's data in your browser; the banner will appear again and you can reject analytics cookies.
• Apps: the apps do not currently include a feature to delete, from within the app, the device data stored on our server. You can turn notification topics off in the app settings, turn notifications off in the system (with the effects described in section 5) or write to us to request deletion. Because these records are not linked to your name or email, we may not be able to identify your device from your request alone; in that case we will tell you what information we need or whether it cannot be located.
• La Quiniela: you can ask us to remove or correct your name or photo by writing to info@cdesteponafans.com or through our Facebook page. There is no automatic feature; we do it manually.

If you believe we have not handled your rights properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

12. Security

Communications between the website, the apps and our servers are encrypted with HTTPS. Each device's secret key is stored on our server only as a hash and, on the device, in the iOS keychain or, on Android, encrypted with the system keystore. That key is required to read or change a device's notification preferences. No system is completely secure, but we apply reasonable measures to protect the data.

13. YouTube API Services

This service uses YouTube API Services to show live or upcoming videos from our channel. Through the API we obtain public video data: video ID, title, description, thumbnails, publication date, channel name, scheduled or broadcast times and, if available, recording locations.

By using these features, you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). To learn how Google collects and processes data, see the Google Privacy Policy (https://www.google.com/policies/privacy).

14. Changes to this policy

We may update this Privacy Policy to reflect changes to the website, the apps or the law. We will publish the current version on this page with its update date.