Privacy policy

This policy explains which personal data Onda processes, why, on what legal basis, for how long and what rights you have. It applies to the Onda app, the business app, the event sharing pages and the website pending: domain.

Summary

1. Controller and contact

Controller: pending: betreiber name, pending: anschrift, NIF pending: nif.

Privacy contact: pending: email kontakt or the contact form on the website. A person replies.

Data protection officer: pending: dpd kontakt

2. What data we process and why

2.1 Account and profile

When you sign up we process your name, email address, password (we only store an encrypted hash, never the password itself), year of birth, language and your acceptance of the terms. You can optionally add a username, photo, short bio, area of the island, interests and languages.

Only your display name, username, photo, bio and reputation level are public. Your email is never shown to others, including community admins.

Purpose: creating and managing your account and providing the service. Basis: contract (Art. 6(1)(b) GDPR).

2.2 Joining without an account

You can RSVP to an event or join a community without creating an account. For this we process the name you enter (2 to 40 characters), whether you bring a plus one, and a random code stored on your device to recognise your RSVP. On our servers we only store an encrypted hash of that code. You appear on the guest list marked “Guest”. If you later create an account on the same device, your RSVPs move to your account.

To prevent abuse we limit the number of RSVPs per IP address. Basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

2.3 Events, RSVPs and invitations

We process the events you create, your RSVPs (“Going”, “Interested”), waitlists, invitations, bring lists and saved events. Depending on the event’s visibility, others can see that you are going: the organiser sees the guest list; your friends see your RSVPs unless you turn this off in Settings. Private events are only visible to invited people.

Keep in mind that an RSVP reveals where you will be. That is why you decide on visibility and can cancel your RSVP at any time.

Basis: contract (Art. 6(1)(b) GDPR).

2.4 Chats, comments, photos and reviews

We process the messages, comments, photos and reviews (1 to 5 stars with text) you post. Event and community chats are only visible to their members; direct messages only to the participants. Chats are not end-to-end encrypted: they are technically accessible to Onda, which only accesses them when needed to handle a report or where required by law.

We automatically remove metadata from photos (for example GPS location) and keep a reduced copy; the original is not kept. Only people who attended an event can post reviews; the business concerned sees them in its dashboard.

Basis: contract (Art. 6(1)(b) GDPR).

2.5 Live vibe and reputation

When you report the vibe at a venue (how busy it is, queue, music, mood, entry and optionally a short text), we store your report with the venue, the time, your reputation level at that moment and the weight of your report. Publicly, we show the aggregated result (“confirmed”, “unconfirmed”, number of people reporting), not who reported. Free text is only published after a person on our team has reviewed it.

Your votes (“Yes, that’s right”, “Not sure”, “Not true”) and your reports feed your reputation: a score and a level (new, regular, trusted) that determine how much your reports count. Reputation has no effect outside the live vibe.

Basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in reliable information and preventing manipulation (Art. 6(1)(f) GDPR).

2.6 Location

Onda only uses your location when you ask for it and your browser or system allows it:

• Map: to centre the map on your position after you tap the location button. To load events we only send the visible map area to the server, not your exact position, and we do not log it.
• Reporting the vibe: when you send a report, your position is sent once to check that you are near the venue (within 500 metres). The server calculates the distance and discards the coordinates. We do not store your location or write it to logs.

We never use location in the background. Basis: your consent (Art. 6(1)(a) GDPR), given in the browser or system permission prompt, which you can withdraw in its settings. Without it you can still use Onda, but you cannot report the vibe on site.

2.7 Personalised recommendations (profiling)

If you turn on personalised recommendations, we use your interests and your interactions with Onda (events viewed, saved, RSVPs, “Not interested”, follows) to sort the “For you” section. The main criteria are how well an event matches your interests, how soon it is, the distance to your chosen area and recent popularity. This is profiling within the meaning of the GDPR.

Basis: your consent (Art. 6(1)(a) GDPR), with its own switch at sign-up and in Settings, which you can turn off at any time. Without consent we do not personalise anything and sorting is based on date, area and general popularity.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

2.8 Statistics for businesses and communities

We record interactions (views, clicks, saves, RSVPs, special redemptions, follows, ticket purchases) with a pseudonymous identifier. From these we calculate aggregated statistics for businesses and communities, for example visits by weekday, an event funnel or the language breakdown. Businesses never see data about individual people in these statistics, and breakdowns (for example by language or by residents and visitors) are only shown from 20 records upwards. If you are not logged in, we use a daily encrypted hash of the IP address and browser, which changes every day.

Basis: our legitimate interest and that of businesses and communities in understanding the reach of their events in aggregated form (Art. 6(1)(f) GDPR). You can object at any time (section 9).

2.9 Notifications and push

In the app you see notifications (invitations, RSVPs on your events, waitlist, vibe confirmed or removed, community announcements, reminders, messages). If you also allow push notifications, we store the subscription address generated by your browser, its technical keys and the browser type. Messages are delivered via your browser’s push service (for example Google for Chrome, Apple for Safari, Mozilla for Firefox). Content is limited to a title and a link, without message texts.

Basis: your consent (Art. 6(1)(a) GDPR) through the browser permission and the per-type switches in Settings.

2.10 Email

We send emails needed for the service: address confirmation, password reset, invitations, receipts and moderation decisions. We do not send newsletters or advertising without your prior consent. Basis: contract (Art. 6(1)(b) GDPR) and, for moderation decisions, legal obligation (Art. 6(1)(c) GDPR in conjunction with Art. 17 of the Digital Services Act).

2.11 Tickets, specials and entry

If you get a ticket, we process the order, the holder’s name, the ticket code and its status (valid, used). At the door, venue staff see whether the ticket is valid, the holder’s name and the ticket type. If you redeem a special, we process the one-time code (valid for 90 seconds), the time of redemption and which team member recorded it.

During the test phase payments are simulated: you do not enter payment details and no money is charged. Before real payments go live we will update this policy (planned payment provider: Stripe).

Basis: contract (Art. 6(1)(b) GDPR). Once real payments exist, also the legal obligation to keep records (Art. 6(1)(c) GDPR).

2.12 Business accounts and venue claims

For business accounts we process company data and the data of team members (name, email, role). To claim a venue we ask for evidence (website, Instagram, business email and optionally a photo of the licence), which is reviewed by a person on the Onda team. Basis: contract (Art. 6(1)(b) GDPR) and legitimate interest in preventing impersonation (Art. 6(1)(f) GDPR).

2.13 Reports and moderation

If you report content, we process your explanation, the reference to the content and, if you have no account, your name and email. The person affected receives our reasoned decision but never your details, unless strictly necessary and permitted by law. We keep every moderation decision in an unalterable record, with the reason and the basis, as evidence towards the people affected and the authorities.

Basis: legal obligation (Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065) and legitimate interest in a safe service (Art. 6(1)(f) GDPR).

2.14 Machine translation

If you tap “Translate” on a description, we send that text (without your name or other account data) to the translation service pending: uebersetzungsdienst and store the result so it is not translated twice. Basis: contract (Art. 6(1)(b) GDPR).

2.15 Map

To display the map, your device downloads tiles from OpenFreeMap (Hyperknot Software Kft., Hungary), which may use Cloudflare’s content delivery network. This transmits your IP address and the map area being loaded, not your account. Basis: legitimate interest in displaying the map (Art. 6(1)(f) GDPR). We plan to serve the tiles from our own server.

2.16 Security, logs and backups

To protect the service we process the IP address, browser and time of each session (you can see and end your sessions in Settings), as well as technical logs without coordinates, access codes or plain-text email addresses. We make encrypted backups. Basis: legitimate interest in the security of the service (Art. 6(1)(f) GDPR) and the security obligation (Art. 32 GDPR).

2.17 Website

The website uses no analytics or advertising tools. External content (for example an embedded map or video) only loads if you consent with a click. Details in Cookies and storage.

2.18 Contact form and security check

If you write to us with the contact form, we process your role (for example bar or press), your name, your email address, the area and your message to reply to you. Basis: your consent with the box in the form (Art. 6(1)(a) GDPR), which you can withdraw at any time. We delete the conversation once it is no longer needed to reply. While Onda is a prototype, the form sends nothing and we store nothing.

To slow down automated submissions, the form uses the Cloudflare Turnstile security check from Cloudflare, Inc. (USA). It only loads once you tick the consent box. Cloudflare receives technical data (IP address, TLS fingerprint, browser identifier and the page it loads from), not what you type into the form. Basis: legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR).

3. Legal bases (summary)

Where the basis is consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4. Recipients

We do not sell your data or share it for advertising.

5. International transfers

We host data in data centres in the European Union. Google’s and Apple’s push services and Cloudflare’s network (including Turnstile on the contact form) may process data (IP address, subscription address) in the United States. Where the recipient is certified, these transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework and otherwise on standard contractual clauses (Articles 45 and 46 GDPR).

6. Retention periods

7. Automated decisions

Onda uses automatic rules in two cases, without legal effects for you:

• Live vibe: a venue’s status is calculated by adding up the weights of the reports; a value is hidden automatically if at least three people vote “Not true” and there are more votes against than in favour.
• Word filter: before saving free text in a vibe report, we check whether it contains names of people, accusations or insults; if so, it is not saved and we tell you why.

All other moderation decisions are taken by a person. You can always ask for a human review (see Digital services).

8. Minimum age

Onda is only for people aged 18 and over. When you sign up you enter your year of birth; if it shows you are under 18, no account is created. If we learn that an account belongs to a minor, we suspend it and delete the data.

9. Your rights

You have the right to:

• access your data and get a copy (Settings, Export my data, as JSON);
• rectify inaccurate data (in your profile or by writing to us);
• erase your data (Settings, Delete account);
• restrict processing;
• data portability for the data you provided to us;
• object to processing based on legitimate interest, in particular to statistics for businesses (section 2.8);
• withdraw consent at any time (location, recommendations, push), in Settings or in your browser.

To exercise them, write to pending: email kontakt. We will reply within one month. If you think we are not handling your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, e-office sedeagpd.gob.es) or with the supervisory authority of your EU country of residence.

10. Required data

Name, email, password and year of birth are required to create an account; to join without an account, a name is enough. Everything else is optional. Without the required data we cannot provide the service.

11. Security

Encrypted connections (HTTPS), passwords stored as encrypted hashes, separate sessions per app, photos without metadata, location checks without storage, restricted access for the moderation team with a record of every action, and encrypted backups.

12. Changes

If we change this policy significantly, we will notify you in the app before the change applies. The date of the current version is shown above.

This is a translation. The Spanish version is the original.