Privacy policy

Last updated: 05/10/2026.

Data Controller

Arnau Font i Soto. Contact for privacy: hola@senyorfont.cat.

The website has no registration, forms, comments or user accounts. Even so, its technical operation and optional analytics may involve the processing of personal data.

Why data is processed and on what legal basis

• Serving and protecting the website. The hosting service may process IP, date and technical data of requests in its logs. The basis is the legitimate interest in providing an available and secure service (Art. 6.1.f GDPR), limited to what is necessary for these purposes.
• Optional analytics. Only if you accept, Google Analytics 4 processes browser identifiers and usage data to compile statistics. The basis is your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). Rejecting does not limit access. Analytics tags are not loaded before accepting. The four Consent Mode v2 indicators start as "denied"; accepting only enables analytics storage.
• Technical preferences. The device saves the chosen language and the decision on analytics, exclusively to respect those preferences. These storages are not used for advertising or to track the user across sites.
• Email inquiries and rights. If you write, your address and the necessary content are used to answer the inquiry, based on legitimate interest (Art. 6.1.f). Data protection requests are attended to in order to comply with a legal obligation (Art. 6.1.c).
• Information on candidacies. Names and minimal electoral data from the lists published in the BOE are reproduced, with their source and context. The purpose is to inform about who ran in the elections and to preserve relevant electoral context. The proposed basis is the informative legitimate interest (Art. 6.1.f), subject to a balancing of necessity and proportionality. No public task under Art. 6.1.e is attributed to the owner. When the candidacy may reveal political opinions, such data will only be incorporated if an exception under Art. 9.2 is established; in particular, Art. 9.2.e for data which are manifestly made public by the data subject themselves through their voluntary electoral participation. The fact that information appears in the BOE is not enough, on its own, to fulfill this condition. Appearing on a candidacy does not prove party affiliation either.

The sources are the proclaimed candidacies of July 23, 2023 (23J), their corrections of July 4 and of July 7, and the list of proclaimed elected deputies. The copy from the portal is limited to name, list, constituency, position and published electoral circumstances. No private contacts or inferences about affiliation or ideology are added. This privacy information is also offered from the lists and files; it will be provided individually when an adequate contact channel exists, unless an applicable exception under Article 14.5 GDPR applies.

Analytics use URLs without query or fragment, a fixed title and, at most, the name of a section of the portal. It does not receive party selections, simulation bases or seat distributions. Scenario changes within the same section do not generate additional visits. Google Signals, ad personalization and automatic measurement of interactions are disabled. Ideological profiles are not created, and automated decisions with legal effects are not made. The four additional data sharing options for the Analytics account are disabled.

Only if you accept analytics, GA4's granular location and device collection is enabled to compile geographic and usage statistics. Google infers an approximate location (country, region and city) from the IP address; this website does not request GPS location or geolocation permissions. Technical browser and device data are also collected, such as the user-agent string, brand, model and device name, browser versions, operating system and platform, and screen resolution.

Providers, recipients and transfers

• Google Ireland Limited / Google Analytics: data processor for analytics according to its processing terms; it is only activated after accepting. It may use Google LLC and other sub-processors outside the EEA.
• Netlify, Inc.: hosting provider and technical processing of requests and logs.
• Cloudflare, Inc.: DNS provider. The configuration uses "DNS only": it does not act as an HTTP proxy for the pages. DNS queries do not contain the portal query scenarios.
• cdmon (10DENCEHISPAHARD, SLU): email reception service for hola@senyorfont.cat, identified in the domain configuration.

Data is not sold. It will only be communicated to authorities when there is a legal obligation. Published candidacy data is accessible to website visitors. Providers may act as data processors for the contracted service and as data controllers for their own obligations or purposes described in their terms.

There may be transfers to the United States. When the recipient is certified and the processing is covered, the adequacy decision of the EU–US Data Privacy Framework (Art. 45 GDPR) is used. In other cases, valid safeguards must exist, such as standard contractual clauses and necessary supplementary measures (Art. 46). The DPF does not automatically cover any provider or sub-processor. You can request information about the safeguards from hola@senyorfont.cat. Also consult the policies of Google, Netlify and Cloudflare.

The Archivo font is served from this domain: there are no requests to Google Fonts. Links to Google Calendar, WhatsApp, Instagram and external sources do not integrate content from those services; by clicking on them, you access their own terms and processing.

The portal's new links save selections in the URL fragment, after "#": that part is not sent to the hosting in the HTTP request. The website also does not send the referring URL as a referrer when opening links. An old link with parameters after "?" may send those parameters to the hosting in the first request; afterwards, the portal moves them to the fragment. This conversion does not delete previous provider logs.

Retention

• GA4: event data, 2 months; user data, 14 months. The configuration renews the identifier's timeframe with new activity. Standard aggregated reports are not subject to these same timeframes. The duration of cookies, up to 2 years, is different from the retention on servers.
• Consent: the choice is valid for 180 days; the local record may remain until it is deleted or replaced. Language: until it is changed or the browser storage is deleted.
• Infrastructure logs: for the time necessary to provide and protect the service in accordance with the provider's applicable timeframes; they are not used to create electoral profiles. You can request information from the owner regarding the timeframes of the contracted service.
• Email: as long as necessary to address the matter and, subsequently, only during the applicable legal retention or claim defense periods, with restricted access.
• Candidacies: as long as they are necessary as electoral information or relevant historical context. Their necessity, accuracy and proportionality will be reviewed; they will not be retained indefinitely solely because they come from the BOE.

The next review of the 2023 lists will be, at the latest, on 31/12/2026 and thereafter at least once a year, in addition to when there is a correction or a rights request. The necessity of retaining the data of substitutes and non-elected persons will be particularly evaluated.

Your rights

You can request access, rectification, erasure, objection and restriction. Portability applies when the requirements of Art. 20 GDPR are met; it does not automatically extend to candidacies processed on the basis of legitimate interest. You can withdraw analytics consent in "Cookie preferences", at the footer of the website, without affecting the lawfulness of the prior processing. Withdrawing it deletes the accessible GA4 cookies on this domain; it does not by itself equate to deleting data that Google has already received.

If you are a candidate, you may object on grounds relating to your particular situation. Your information will no longer be processed unless compelling legitimate grounds which override are established or for the necessity of addressing claims. Erasure requests and the informative interest will be evaluated on a case-by-case basis. The owner can correct or remove their copy, even if they cannot alter the BOE.

Write to hola@senyorfont.cat, indicating the right you wish to exercise and the information necessary to locate the data. Additional identification will only be requested if there are reasonable doubts about your identity. The ordinary response will be provided within one month; if an extension is appropriate due to complexity, by up to two further months, you will be informed within the first month. You can also lodge a complaint with the Spanish Data Protection Agency.