Privacy
policy

1. What is personal data?

It is any information relating to an identified or identifiable natural person that you give us when using this site: your email address, your social network handle, your country or your mobile number. Some technical data is also recorded automatically, such as your IP address and the date and time of your visits.

The data we ask you for in order to play is identifying and contact data, and does not fall under the special categories of Article 9 GDPR.

2. Data controller

Controller: Niquelao, S.L.
VAT number: B40616260
Address: Camino Casas de Bárcena, 79, 46131 Valencia, Spain
Data protection email: [email protected]

3. What we collect and why

We only ask for what we need so you can play:

• Email — this is how you sign in. dasmina uses no passwords: every time you want to get in, we send a temporary link to that address, valid for 10 minutes. We also use it to tell you about each new round and about the outcome of the game.
• Social network and handle (@) — to identify your comments on the rounds and link them to your entry. If you press «I have added it» to prove the profile is yours, we automatically read the public bio of that profile, only to look for your code, and we keep just the snippet where it appears as evidence of the verification.
• Sign-up with TikTok (only if you choose that route) — TikTok passes us your user identifier, your display name and your profile picture, which we use to fill in your social network and handle. We do not receive your TikTok email nor access your videos, messages or contacts.
• Month and year of birth — to check you meet the minimum age the game rules require. We do not ask for the day: month and year are enough for that check, and it is one less piece of data about you.
• Mobile (optional) — to verify over WhatsApp that there is a real person behind each player and to prevent duplicate or automated sign-ups. It is never published nor used for marketing unless you authorise it. By verifying it you agree to receive on that number, over WhatsApp, the game notifications and updates (round published, results); you can stop them at any time by replying BAJA to that same number.
• Public ranking — the TikTok, Instagram or YouTube @ you comment with in the rounds appears in the site's cumulative ranking (rounds guessed right and games won), whether you are registered or not. It is already public on those networks; no other data of yours is shown.
• IP and timestamp of your consent and of your last sign-in — so we can evidence when and from where you accepted this policy, as required by Article 7(1) GDPR, and to investigate duplicate, automated or fraudulent sign-ups if ever needed.

The sign-up form has two optional boxes: one to receive dasmina news and promotions, and another to receive offers from sponsors and partner brands. In both cases we send the email ourselves: your address is never handed over to anyone. You can switch each one on or off from your account at any time.

Comments from people who have not registered. Playing does not require registering, so the comments on the rounds include people with no dasmina profile. From those comments we keep the handle, the text and the time, exactly as TikTok, Instagram and YouTube show them to us as the authors of the post: it is what is needed to count the votes and detect fraud, and it is kept for two years, like every other vote. We explain it separately, in the notice for people who comment without registering.

We run statistical studies of site usage (visits, time on page) that do not identify individuals.

4. Legal basis

Each purpose has the legal basis that fits it. Ticking the box on the sign-up form is not a blanket consent: it evidences that you have read this information and that you accept the game rules.

Taking part and applying the rules — performance of the relationship created by accepting the rules (Art. 6(1)(b) GDPR). It covers your profile, your votes, the ranking and the titles.

Keeping the game fair — legitimate interest (Art. 6(1)(f)): mobile verification, duplicate-entry control, checking that the social profile is yours —which we only do when you ask for it from your account— and reading the public comments on the rounds in order to count the votes.

Marketing — consent (Art. 6(1)(a)), and only the box you tick: one for dasmina news and another for sponsor offers. Both are optional, unticked by default, and you may withdraw them at any time without affecting your participation.

Game notifications over WhatsApp — consent (Art. 6(1)(a)) that you give by verifying your mobile: from then on we send the game notifications and updates (round published, results) to that number, and nothing else. You withdraw it at any time by replying BAJA to that same number, without affecting your participation or the verification.

5. Minors

dasmina is for people aged 18 and over. The game rules require it, which is why the sign-up form asks for your month and year of birth and turns away anyone below that age.

We do not knowingly process the data of minors. If we detect a sign-up by a minor, we delete it along with all their data.

If you are a parent or guardian and believe a child in your care has registered, write to [email protected] and we will delete it, no questions asked.

6. How long we keep your data

We keep your data for as long as you are a dasmina player and do not ask us to delete it.

If you ask to leave, we delete your record except for data we are legally required to retain.

The access links we email you are not stored in any database: they expire on their own after 10 minutes. Of the send itself we only keep a minimal record (email, IP and time) for at most 30 days, to throttle bulk sending.

The log of your sign-ins and data changes (date and IP) and the copy of your votes in each round are kept for two years, a reasonable period to settle claims about results or investigate fraudulent sign-ups. An automatic process deletes whatever exceeds these periods.

7. Recipients and processors

We do not sell, rent or disclose your personal data to third parties for commercial purposes.

We do rely on providers that process data on our behalf, under a data processing agreement (Art. 28 GDPR):

• OVH Hispano, S.L.U. — website and email hosting (servers in the European Union).
• Cloudflare, Inc. — content delivery network, protection against attacks and Turnstile, the check that confirms there is a person and not a program behind the form. Turnstile uses no tracking cookies and does not profile your browsing.
• Meta Platforms Ireland Ltd. — WhatsApp, for mobile verification and player support.

If you choose to sign up with your TikTok account, TikTok Technology Limited (Ireland) passes us your identifier, name and profile picture under its own privacy policy; we send it no data of yours.

When we send you offers from sponsors or partner brands, we do the sending: the sponsor receives neither your email nor any other data of yours.

If we were legally required to disclose data to a public authority, a court or law enforcement, we will do so.

8. International transfers

Our web and mail servers are located in the European Union.

Some of the providers listed above are US companies that may process data outside the European Economic Area. In those cases the transfer relies on the EU-US Data Privacy Framework adequacy decision or, failing that, on the standard contractual clauses approved by the European Commission.

9. Security measures

We apply the technical and organisational measures needed to protect your data, following privacy by design and by default:

• The whole site is served over HTTPS with an SSL certificate.
• We store no passwords, because dasmina does not use them: there is no credential of yours that could leak from here.
• Access links are cryptographically signed (HMAC-SHA256) with a key that never leaves our server, include a different random value every time, and expire after 10 minutes.
• Database access is restricted to the staff who need it to run the game.

Should a security breach occur that poses a high risk to your rights, we will inform you and notify the Spanish Data Protection Agency within the legal deadlines.

10. Exercising your rights

You may exercise, free of charge, your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw your consent at any time.

Fastest route: sign in with an access link: from your account you can change your social handle, manage which emails you receive and delete your account with the «Delete my account» button, which erases your record instantly.

By email: write to [email protected] from the address you registered with.

By post: Niquelao, S.L., Camino Casas de Bárcena, 79, 46131 Valencia, Spain, stating the right you are exercising and enclosing a copy of a document proving your identity.

We will reply within one month at most. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the competent supervisory authority.

11. Marketing messages and withdrawal

Under Spanish Law 34/2002 on Information Society Services and Electronic Commerce, we will only send you marketing messages if you have ticked the relevant box. There are two, independent of each other: dasmina news and promotions, and offers from sponsors and partner brands in the leisure and entertainment, consumer goods, fashion and technology sectors. Sponsor offers are also sent by us: we never hand your email to a third party.

Essential game notices (your access link, a round opening, or the result) are not marketing messages and are sent even if you declined marketing, because they are part of the game itself.

You can unsubscribe from either of them using the «your email preferences» link included in every message (it takes you to your account with the box in view), from your account at any time, or by writing to [email protected]. It will take effect within 48 hours at most.

12. Cookies and third-party services

dasmina uses no analytics, advertising or tracking cookies, which is why you will not see a cookie banner: the only ones set are technical, exempt from consent under Article 22.2 of the Spanish LSSI and the AEPD Guide on the use of cookies.

• Session cookie (PHPSESSID) — keeps you signed in after you open your access link. It disappears when you close the browser or sign out.
• Cloudflare security cookies (__cf_bm, cf_clearance) — tell legitimate traffic from automated attacks. They expire within 30 minutes at most and do not identify individuals.

Should we add analytics or advertising cookies in the future, prior consent will be requested through a banner and they will be detailed in a specific cookie policy.

dasmina pages link to our TikTok, Instagram and X profiles. Clicking those links takes you off our site and under each social network privacy policy. dasmina is not responsible for the content or the privacy practices of third-party sites.

13. Accuracy of the data

You are responsible for the data you give us being truthful and up to date. If the social handle or the mobile you declare are not yours, or the email is wrong, we will not be able to validate your entry.

Keeping your details current matters: it is the only way we will reach you about what happens in the game.

14. Changes to this policy

Niquelao, S.L. reserves the right to amend this privacy policy to adapt it to legislative or case-law developments, or to changes in how the game works.

Any change will be published on this same page at least ten days before it takes effect. If the change affects the purpose of the processing, we will ask for fresh consent.

By registering you declare that you have been informed of the personal data protection terms and accept the processing as described here. You may withdraw your consent at any time, without retroactive effect.