Pending item — not definitive informationDraft for legal and language review. Not the final version. The name, tax ID and address provided have been added. This is not a legal opinion and does not claim GDPR or Spanish data-protection compliance.
Privacy policy
This policy describes the processing the site code performs today. Where a detail, legal basis or retention period is unconfirmed, it is marked as pending. Publishing this policy does not mean GDPR or Spanish data-protection law is fully complied with.
Controller
The controller is JUAN JOSE MENA CASANOCA, a natural person, tax ID (NIF) 46754258L.
Address: Bajada de Gomis número 1, 08023 Barcelona, Spain.
Contact: hola@adoptaunebiker.com.
Data collected at sign-up
The application form asks for first name, last name, email, country, city, whether you are experienced or a beginner in each discipline, interests, bike, how you ride, what you are looking for, and the language of the request.
A draft is stored only in your browser (sessionStorage) for this tab until you submit or close it. Nothing is sent to the server until you press send.
Applications, members and sign-in
The application is stored so the organisers can review it. If it is rejected or deleted, the code does not email the applicant. The application row stays in the database until it is deleted by hand.
If it is accepted, an account and profile are created and an operational email is sent with access details. The accepted application is not deleted: it is marked as accepted. The first sign-in requires a password change.
Organisers can update a profile, activate or deactivate a place, reset the password and keep internal notes. Deactivation makes the place inactive and blocks intranet access; it does not by itself delete the profile.
Today we send operational mail only: a welcome message when an application is accepted, and a notice if the password is reset. Those messages are needed to manage applications, accounts and the running of the community.
There is no newsletter and no marketing. We do not ask for marketing consent because that purpose is not active. If a newsletter is offered later, this policy and the consent mechanism will be reviewed.
Strava
Connecting Strava is voluntary and optional, and only available to signed-in members. The site asks for read access to the profile and activities. That access grant is given on Strava; it is not, by itself, the legal basis for later processing of those data on Adopta un eBiker.
We store athlete id, name, access and refresh tokens, and up to forty bike rides (name, type, distance, elevation, time, date, summary polyline, link and privacy flag).
Non-private rides can be seen on the peloton profile. Disconnecting deletes the local account and stored activities, and tries to revoke access at Strava.
Processors used today
Pending item — not definitive information
These services appear in the code or the current hosting setup. Each one is used for a different purpose and they do not all process the same data. Exact location, the processing agreement and international transfers must be confirmed against their contracts and the real project configuration.
- Site hosting: Vercel. It may process technical visit data (for example IP address and request logs) to serve the pages.
- Database and authentication: Supabase. It stores applications, profiles, internal notes, Strava accounts and member sessions.
- Operational email: Resend. It receives the email address and name when an application is accepted or a password is reset.
- Strava, only if the member connects the account. It receives the access grant and may process athlete data under its own terms.
- Ride maps: OpenStreetMap tiles through Leaflet, only in the intranet when a polyline is shown. The browser requests tiles from the map provider; this site does not send them your member profile.
Analytics
Google Analytics is planned for later, but it is not configured and is not loaded. There is no measurement ID. Accepting cookies does not turn analytics on while that ID is missing.
If it is switched on later, prior consent will be requested where required and this policy will be updated. There is no active analytics processing today.
Security and logs
Intranet access requires authentication. Server error logs are redacted so emails, passwords and tokens are not kept in clear text.
Those technical logs are distinct from operational application and profile data, and from backups the database provider may keep. No log in this code is a complete legal record on its own.
Retention
Pending item — not definitive information
The controller’s intention is not to keep applications or personal data for more than six months where that is compatible with the purpose and applicable duties.
That six-month period does not apply to data needed to keep an active account, provide the service, or handle a legal duty or claim. The code applies those rules: a weekly job lists candidates. The first cycle is a dry-run until a deletion is confirmed. Rows already rejected or inactive start the clock when the migration is applied, not at sign-up.
The table below describes what the code does. It does not claim a bulk irreversible deletion has already run.
| Category | What happens today | Proposed criterion | Event that starts the period | Automatic deletion |
|---|---|---|---|---|
| Rejected applications | The row remains. Rejection is dated in rejected_at | Six months from rejection | Date the application is marked rejected (rejected_at) | Yes, if there is no hold and the weekly job confirms deletion |
| Abandoned applications | There is no «abandoned» category. A pending application remains | It is not treated as abandoned. It is kept until a person decides | Does not apply. No verifiable operational rule of abandonment | No. Pending applications are not deleted |
| Applications awaiting a decision | They are kept so they can be reviewed | While they are being handled. If there is no decision, the proposed six-month period | Submission of the application or last action by the organisers | No |
| Accepted applications | The row is marked accepted. Useful data are copied to the profile | While the place exists, the application may keep the original text. When an inactive place is deleted, or if the application is orphaned for more than six months, personal fields are anonymised. The row remains as a record without contact data, unless there is a hold | Acceptance of the application. Anonymisation follows member closure or orphaning | The row is not deleted. It is anonymised when the member is purged or the application is orphaned |
| Members with an active account | Profile, authentication and, where used, internal notes | While the place is active and the service needs those data. The six-month period does not apply | Creation of the place. The deletion period does not start while the account is active | No. Deleting these data would stop the service |
| Closed accounts | The profile remains inactive; access is blocked | Six months from closure, unless a duty or claim is ongoing | Change to inactive (deactivated_at). created_at is not used | Yes, if there is no hold and the weekly job confirms deletion |
| Strava connection and ride data | Kept while the connection is active | While the member keeps the connection. Disconnecting deletes them on this site | Connection or disconnection by the member | Yes on disconnect: local account and activities are deleted and access at Strava is revoked if possible. There is no monthly expiry |
| Technical and security logs | Redacted error logs on the server or host | The minimum time needed to diagnose and protect the service. Still to be set | Each incident or request | Not controlled by this code |
| Backups | Outside this code; they depend on the database or hosting provider | Pending confirmation with the provider. They may outlive an operational deletion | The provider’s backup cycle | Not controlled by this application |
| Legal duties or claims | retention_hold can be set on the application or profile. The member cannot clear it | The time needed for that duty or claim, even if longer than six months | The fact that gives rise to the duty or claim | Deletion at six months is not promised |
How the six months are applied
Pending item — not definitive information
The code distinguishes rejected, pending and accepted applications, and does not delete active accounts or administrators. A weekly job lists candidates. A real deletion needs confirmation in the API and in SQL. The first cycle does not bulk-delete without reviewing that list.
Provider backups may outlive an operational deletion. A legal hold stops both deletion and anonymisation.
Rights
You may ask for access, rectification, erasure, objection, restriction and portability, where they apply, at hola@adoptaunebiker.com.
You may also complain to a competent supervisory authority. In Spain, that is the Agencia Española de Protección de Datos. This does not replace an analysis of which authority applies in each case.
Minors
Pending item — not definitive information
The intended minimum age to use the site is 18. The form does not check age. This needs legal review before it is treated as a final clause.
Processing matrix (proposal, not confirmed)
Pending item — not definitive information
The table is a proposal for legal review. It does not use one legal basis for every processing activity. It does not claim those bases are validated, or that the community model is a contract in every case.
| Purpose | Proposed basis | Reasoning | What the person is told | Legal decision still needed |
|---|---|---|---|---|
| Handle membership applications | Pre-contractual steps at the person’s request | The person sends the form so the application can be examined. Those data are needed to assess it | Controller, purpose, that there is no marketing, and a link to this policy | Confirm that an application can be treated as a pre-contractual step and not as generic consent |
| Provide the service and manage active accounts | Performance of the relationship with the member and steps needed to provide the service | After acceptance, a profile, authentication and place status are needed to use the intranet | That a place means an account, a profile visible in the intranet and operational emails | Confirm whether that relationship is a contract under GDPR article 6.1.b or another basis, given how the service actually works |
| Operational access or password emails | Necessary for that same relationship | Without the welcome or reset email, access cannot be given or recovered. They are not promotions | That only operational messages are sent and that there is no newsletter | Confirm that marketing consent is not required for these messages |
| Security, abuse prevention and account protection | Legitimate interest, still to be documented | Purpose: protect access. Necessity: authenticated session and redacted error logs. Balancing: security is expected; they are not used for marketing; logs are redacted | That there is a session and limited technical logs | Write and keep a legitimate-interest assessment. Confirm how long those logs are kept |
| Tax, accounting or other legal duties | Legal obligation, only if it actually applies | The site does not invoice applications or sell places. This basis is not treated as active | It will be mentioned only if a concrete duty exists | Confirm whether any real legal duty requires data to be kept |
| Optional Strava | Proposal: consent for processing on this site when connecting, distinct from the access grant on Strava | The connection is voluntary. Strava grants access; Adopta un eBiker then processes tokens and activities to show them in the intranet | That it is optional, which permissions are asked, what is stored, who sees non-private rides and how to disconnect | Confirm whether the basis is consent, performance of an optional service feature, or both, and Strava’s role as a recipient |
| Future analytics (off today) | Consent, when it is switched on and required | There is no measurement ID or script today. Accepting cookies does not load analytics | That analytics is not active and that, if it is switched on, prior consent will be asked | Do not switch it on or document it as real processing until the tool exists |
Status: draft updated with the controller’s identifying details. Legal review of bases, retention periods and transfers is still pending. The six-month periods are an intended criterion, not an automatic deletion already in place. The operational contact email is hola@adoptaunebiker.com.