Privacy policy

Statement

Our organisation respects and upholds the fundamental right to privacy. We protect personal data proactively, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

• Personal data belong to each individual. When you provide them to us, you are lending them to us, and our commitment is to process them lawfully, fairly and transparently and, above all, confidentially.
• We process your data on an equal basis, without any discrimination or distinction on grounds of race, colour, sex, language, religion, political opinion, national or social origin, economic position, birth or any other status.
• We make it easy for you to access and control your personal data at all times. We want to be your trusted organisation where privacy is concerned.

Data controller

Factor Ideas Agencia Interactiva, S.L., owner of sidrerias.ws, with tax ID (NIF) B20986188 and registered address at Paseo de Errotaburu 8, bajo, 20018 Donostia (Gipuzkoa).

The contact addresses are set out in the Legal notice, including that of our privacy officer: elena@factorideas.com.

Which data we process and why

sidrerias.ws is, above all, a directory for consultation: you do not need to give us any data to read it, and it has no shop and no advertising. We process personal data only in the following cases:

If you create an account

If you open an account, as a visitor or as a professional (cider house or cider maker), we process your email address, your password if you choose one (stored encrypted, so that not even we can read it), the language in which you want to receive our emails and, if you are a professional, your name, your telephone number and the establishment you run, in order to give you access, manage your account and, if you are a professional, check that you run the business and enable you to keep its listing up to date.

• Legal basis: performance of the terms of use you accept when you register (Art. 6(1)(b) GDPR).
• Retention: for as long as the account remains open. You can delete it whenever you wish from “My details”, in your account: the account, your profile, your photo and the access log are deleted immediately. Accounts that are never confirmed are deleted automatically after 30 days.

Your account’s access log. We record sign-ins to your account, the links we send you and important changes (email address, password), with the date, the IP address and the browser, in order to protect it and so that you can see in “My details” whether anyone other than you has signed in. Legal basis: our legitimate interest in the security of accounts (Art. 6(1)(f) GDPR). It is kept for one year.

Your profile and what you publish

If you complete your profile, we process whatever you decide to share: your username, your name, your photo or the avatar you choose, a few lines about yourself, your town, the year of your first txotx, your favourite cider house and your links. All of it is optional. We keep a small copy of the photo without its metadata (neither the location nor the device it was taken with).

• Your profile is private until you make it public. When it is public, anyone can see it at its address (/en/community/your-username), but we never show your email address and we ask search engines not to index it. You can make it private again whenever you wish.
• The reviews you publish will be shown on the establishment’s listing, and your comments on news stories under each story, with your username, your name if you have added it and your photo or avatar. All visitors can see them; reviews can also be seen by the establishment, which can reply to them. Your likes on news stories are never shown to anyone: only the number each story has is visible.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you give when you fill in each item, make your profile public or publish content, and which you withdraw by deleting it. Anything already published that you withdraw stops being shown on the website immediately, although it may take a little longer to disappear from copies held by other sites.
• Retention: until you delete it or delete your account.

Your achievements and your activity

With your account you earn achievements (medals and levels) for using the website. To count them we store, only while the “Count my activity” option is switched on:

• which cider house listings, news stories and events you have opened (which ones, not when or how many times);
• which days you have visited;
• your searches, turned into a code from which it is not possible to tell what you typed (only whether two searches are the same);
• the cider houses whose telephone number, email address or website you have looked up.

We do not store the pages you view one by one or at what time. So that we know you have signed in to your account without opening a session on every page, your browser stores a technical cookie, sidrerias_member, which only says “someone is signed in” and is deleted when you sign out.

• Your achievements are shown on your public profile only if you switch this on (it is off by default). What you have visited is never shown.
• You can switch off the counting in “My achievements”: we delete what we have counted immediately and stop counting. The medals you already have are kept.
• Legal basis: performance of the terms of use (Art. 6(1)(b) GDPR), as achievements are part of your account’s service, and you can switch them off.
• Retention: for as long as the option remains switched on and your account remains open. All of it is included in the “My details” download.

If you reply on behalf of an establishment

If your professional account is verified and you reply to a review, the reply is published with the establishment’s name and the official reply mark, not with your name. We keep a record of who wrote it so that we can deal with complaints.

• Legal basis: performance of the terms of use (Art. 6(1)(b) GDPR).
• Retention: for as long as the reply remains published and, after that, for the limitation period for legal actions.

Moderation and reports

To apply the Community guidelines we review the content that is published, using automatic filters (links, banned words, signs of fake reviews) and people on our team. The filters only prevent a text or a username containing links or banned words from being saved, and tell you why. Removing content that has already been published or restricting an account is always decided by a person; we tell you the reason and you can appeal.

If you report content, we process your report and, if you give them to us, your name and email address in order to reply to you. We do not tell the person reported who reported them, unless the law or a court requires us to.

• Legal basis: our legitimate interest and our legal obligation to keep the website free of illegal content and to deal with reports (Art. 6(1)(c) and 6(1)(f) GDPR; Regulation (EU) 2022/2065 (Digital Services Act)).
• Retention: for the time needed to resolve the report or the appeal and, after that, for the limitation period for legal actions.

When you write to us

If you write to us at info@sidrerias.ws or at any other address we publish, we process your name, your email address and what you tell us in order to reply to you and, if you are the owner of a cider house or cider maker, to add, correct or remove its listing.

• Legal basis: your consent when you write to us (Art. 6(1)(a) GDPR) and, if we manage your establishment’s listing, the taking of pre-contractual or contractual steps at your request (Art. 6(1)(b) GDPR).
• Retention: for the time needed to deal with your enquiry and, after that, for the limitation period for any legal actions that may arise.

Data about the cider houses and cider makers in the directory

We publish the name, address, telephone number, website, opening hours and services of cider houses and cider makers. These are business data, obtained from publicly accessible sources and from the establishments themselves. Where the owner is a natural person, these data are also personal data.

• Legal basis: our legitimate interest in offering a complete directory of cider culture (Art. 6(1)(f) GDPR), which does not override your right to object.
• Retention: for as long as the establishment remains in business or until its owner asks us to remove it.

If you are the owner and do not wish to appear, or if any information is incorrect, write to us: we will correct it or remove it.

Usage statistics

We measure how the website is used in two ways.

Our own statistics, without cookies. When each page opens, the website sends our server which page it is, which page or website you came from, its title, the type of device, browser and operating system, the screen width, the language, how long you look at it, how far you scroll and clicks on phone numbers, email addresses and links to other websites. To group the pages of a single visit, we calculate a key from your IP address, your browser and a secret that changes every day and is deleted at the end of the day. We do not store your IP address or your full browser details, and we do not link these visits to your account. Once the secret has been deleted, there is no reasonable way of knowing whose visit it was. These statistics are used to improve the website and to give each cider house or cider maker the figures for its listing, always in aggregate: they never see visits one by one.

• Legal basis: our legitimate interest in understanding how the website is used and in informing the establishments in the directory of the interest in their listing (Art. 6(1)(f) GDPR). We have weighed up that the processing is minimal, sets nothing in your browser, does not create profiles, is not cross-referenced with other websites or disclosed to anyone, and does not allow you to be identified.
• Your right to object: you can ask us not to count your visits using the “Don’t count my visits” button in the Cookie policy, without giving reasons. You can also write to us at the privacy address.
• Retention: the detailed visit data, 13 months; each day’s secret, until the end of that day.

Matomo and Google Analytics, with your consent. If you accept them in the cookie banner, we also measure visits with Matomo, on a Factor Ideas server in the European Union, and with Google Analytics, provided by Google Ireland Ltd. They process browsing data: pages viewed, referral source, type of device and browser, and a truncated IP address. With that same consent, our own statistics store a random identifier (sidrerias_vid) in your browser in order to recognise your visits on other days and, if you have signed in to your account, link them to it. We do not use any of this for profiling or advertising. The details are in the Cookie policy.

• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22(2) of Law 34/2002 on Information Society Services and Electronic Commerce, LSSI), which you can withdraw at any time using the “Cookie settings” link in the page footer.
• Retention: 13 months for the cookies and the identifier; aggregated reports are kept without any data that identify you.

Server logs

Like any website, our server records each request (IP address, date, page requested and browser) in order to maintain the service and its security.

• Legal basis: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
• Retention: a maximum of 12 months.

We have made an effort to keep the processing of personal data to a minimum by applying the principle of data minimisation. Withdrawing consent to any of the processing operations will not affect the lawfulness of processing carried out before its withdrawal.

Recipients of your data

We do not sell, rent or disclose your data. They will be known only to:

• The competent national or European public authorities, in the cases provided for by law.
• Our processors, who provide services to us under contract and do not use the data for their own purposes: hosting and maintenance of the website and systems (including our own statistics, which are stored on our server), our accounting, tax and legal advisers and, if you accept analytics cookies, Google Ireland Ltd. as the provider of Google Analytics.

In addition, what you publish with your account (your profile, if you make it public, and your reviews and replies) can be seen by any visitor to the website: that is its purpose.

International transfers

We do not carry out international data transfers, except for the one that Google Analytics may involve, and only if you accept its cookies: Google may process data in the United States, under the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.

In addition, when we reply to your emails or send you files, you may, without realising it, be sharing your data with your email or storage provider (Google, Microsoft, Meta, Telegram…) and its partners. We recommend that you review their privacy policies.

Your rights

Your personal data belong to you: you lend them to us and we process them because you wish us to, or because we have a contractual or legal obligation, or a legitimate interest that will under no circumstances override your right to privacy. Accordingly, you can:

• Access your data: find out which data we hold, their purpose, their legal basis, to whom they have been disclosed and where they come from.
• Rectify them if they have been recorded incorrectly or contain errors.
• Erase them, object to their processing (for example, to our counting your visits, using the button below) or withdraw your consent, and ask us for a copy to take them to yourself or to another organisation (portability).
• Restrict processing, so that we do not process any of your data or do not carry out profiling or automated decision-making.
• Expressly forbid us to send you advertising.

If you exercise your privacy rights, you will never be discriminated against, subjected to reprisals or prevented from accessing the website.

How to exercise your rights

You do not need to write to us to object to our cookie-free statistics:

If you have an account, you can exercise many of your rights yourself from “My details”: download everything we hold about your account in a file (access and portability), correct your profile and your email address (rectification), make your profile private or delete what you have published (objection and withdrawal of consent) and delete the account (erasure). For everything else:

Send an email to elena@factorideas.com or a letter to the privacy officer at the address in the Legal notice, stating which right you are exercising and what you are asking us for. We will reply within the one-month period laid down by law.

If we do not respond to your rights, you can lodge a complaint with the supervisory authority:

• Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency)
• C/ Jorge Juan, 6. 28001 Madrid
• Telephone: 901 100 099 · 91 266 35 17
• Online office: https://sedeagpd.gob.es
• Website: https://www.aepd.es

If we cause you harm in carrying out our privacy policy, you can bring a claim, individually or collectively, before the ordinary courts of your jurisdiction.

Protection of children and young people

Our website is aimed at all audiences. We do not collect data from minors below the age of digital consent (14 years). If you are a parent, guardian or educator and you know that we have collected data from a minor, please contact us so that we can delete them.

Security incidents and breaches

We are not infallible. We take the technical and organisational security measures reasonably necessary to secure your information, but the internet is a risky environment, and human or programming error, an attack, unauthorised access or unauthorised disclosure can cause security incidents and breaches.

We keep a record of incidents with the place, day and time they were detected, the type of attack, its origin, what the security breach consists of and which systems, data and equipment have been affected, together with the solutions applied.

If a security breach puts your rights and freedoms at risk, we will notify the supervisory authority within the legal period of 72 hours, stating its nature, the data subjects and data affected, and the measures taken to resolve it and reduce its risks, and, where the risk is high, we will also inform you.

Social networks

sidrerias.ws does not embed social network buttons, pixels or content that process your data.

Changes to this policy

We may update this policy when the processing or the law changes. The date of the last update is shown at the top. If the change affects cookies, we will ask for your consent again.