Privacy Policy

Regulatory framework

The General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — is the European Union's primary data-protection law. It applies to any organisation that processes the personal data of people located in the EU or EEA, regardless of where the organisation itself is based. It gives individuals enforceable rights over their data and requires organisations to be transparent about how they use it.

The Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) is the Spanish national law that complements and implements the GDPR within Spain. Because Deister, S.A. is incorporated and headquartered in Barcelona, Spain, both instruments apply to all data this company processes.

1. User information

Who is the controller of your personal data?

Deister, S.A. (referred to below as "we", "us" or "the Company") is the data controller — the entity that determines the purposes and means of processing your personal data. We are incorporated in Spain (Sant Pere Claver 15, 08034 Barcelona) and registered with the Spanish data-protection authority (AEPD). We process personal data in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and the Organic Law 3/2018 of 5 December (LOPDGDD).

Why do we process your personal data?

To maintain a commercial relationship with the USER. The planned processing operations are:

• Sending commercial advertising communications by email, fax, SMS, MMS, social networks or by any other electronic or physical means, present or future, that make it possible to carry out commercial communications. These communications will be made by the CONTROLLER and will be related to their products and services, or those of their partners or suppliers with whom they have reached a promotion agreement. In this case, the third parties will never have access to personal data.
• Conduct market research and statistical analysis.
• Processing orders, requests, respond to queries or any type of request made by the USER through any of the contact methods available at the CONTROLLER's website.
• Send the online newsletter with news, offers and promotions related to the CONTROLLER.

Why can we process your personal data?

Because the processing is lawful according to article 6 of the GDPR:

• USER's consent: sending commercial communications and the newsletter.
• CONTROLLER's legitimate interest: conduct market research, statistical analysis and process orders, requests, etc. at the request of the USER.
• CONTROLLER's legitimate interest: persist the visitor's regional navigation choice in a first-party functional cookie when the visitor lands on a country-prefixed home (see clause 4).

How long will we keep your personal data?

Your personal data shall be stored for no longer than necessary in order to maintain the purpose or purposes of the processing, or as long as there are legal prescriptions dictating their custody. When such purpose is no longer necessary, the data shall be erased with appropriate security measures to ensure the anonymisation of the data or their complete destruction.

To whom do we disclose your personal data?

No communication of personal data to third parties is foreseen, except: legal obligation, when necessary for the development and execution of the purposes of the processing, to our suppliers of services related to communications with which the CONTROLLER has signed the confidentiality and data processor contracts as required by current privacy regulations.

What are your rights?

The rights of the USER are:

• Right to withdraw consent at any time.
• Right of access, rectification, portability and erasure of your data and the limitation or objection to their processing.
• The right to file a claim with the Spanish Supervisory Authority (www.aepd.es) if you consider that the processing does not comply with the current legislation.

Contact information for exercising rights: Deister, S.A. — Sant Pere Claver 15 — 08034 Barcelona (Spain). E-mail: [email protected]

2. Compulsory or optional nature of the information provided by the user

The USER, by marking the corresponding boxes and entering their personal data in the fields, expressly, freely and unequivocally accepts that their data is necessary to meet their request.

The CONTROLLER will indicate which data is necessary for the provision of an optimal service to the USER. In the event that such data is not provided, it is not guaranteed that the information and services provided will match your needs.

The USER guarantees that the personal data provided to the CONTROLLER are true and is responsible for communicating any changes to them.

3. Security measures

The CONTROLLER is complying with all the provisions of the GDPR and LOPDGDD regulations for processing the personal data for which they are responsible, and is manifestly complying with the principles described in Article 5 of the GDPR, whereby data are processed lawfully, fairly and transparently in relation to the data subject and appropriately, relevantly and limited to what is necessary in relation to the purposes for which they are processed.

The CONTROLLER guarantees that all appropriate technical and organisational policies have been implemented to apply the security measures established by the GDPR and LOPDGDD in order to protect the rights and freedoms of USERS and has communicated the appropriate information for them to be able to exercise them.

In practical terms this means: access to personal data is restricted to authorised personnel; data in transit is encrypted; retention periods are enforced by automated processes; and any data breach that meets the GDPR notification threshold is reported to the AEPD within 72 hours.

For more information about privacy guarantees, you can contact the CONTROLLER through Deister, S.A. — Sant Pere Claver 15 — 08034 Barcelona (Spain). E-mail: [email protected]

4. Cookies and similar technologies

This site does not set any cookies for analytics, marketing or profiling. The site does not embed Google Analytics, Google Tag Manager, Meta pixel, HubSpot, Intercom or any equivalent tag-manager or behavioural-tracking platform.

The site does use Cloudflare Web Analytics — a privacy-friendly JavaScript beacon hosted by Cloudflare that captures aggregate traffic data (page views, top URLs, referrer host, viewer country, browser and operating system, core-web-vitals performance signals) without setting any cookie and without persisting any client identifier. Cloudflare derives sessions from a daily-rotating salt of the visitor's IP address and user-agent, so the same visitor on two different days is counted as two anonymous visitors. No data flows to advertising networks, no fingerprinting beyond the salt mechanism. The CONTROLLER receives only aggregate counts on the Cloudflare dashboard.

The legal basis for Cloudflare Web Analytics is Article 6(1)(f) of the GDPR — the CONTROLLER's legitimate interest in measuring aggregate traffic to operate and improve the site. The processing qualifies for the strictly-necessary-analytics exemption from consent under Article 5(3) of the ePrivacy Directive as interpreted in EDPB Guidelines 2/2023 §3.2 and the AEPD Guía sobre el uso de cookies (analytics exempted because no cookie is set, no persistent identifier is stored, and the data is used only for aggregate audience measurement by the publisher).

The site does set one first-party functional cookie called deister_locale. The cookie is set when the visitor lands on a country-prefixed home (/pk/, /pe/ or /co/) so the regional navigation choice persists across subsequent page loads, and is also written by the locale-override link when the visitor explicitly chooses to switch to the global edition. The cookie carries a single short string (pk, pe, co or default), has SameSite=Lax, persists for one year, and is read by the geo-routing Lambda@Edge function at the CloudFront viewer-request stage so the cached regional home is served on cache hits.

The legal basis for this cookie is Article 6(1)(f) of the GDPR (legitimate interest in delivering geo-appropriate navigation). The cookie qualifies for the strictly-necessary exemption from consent under Article 5(3) of the ePrivacy Directive, EDPB Guidelines 2/2023 §3.2 and the AEPD Guía sobre el uso de cookies (table 4, cookies de personalización exentas del consentimiento). No cookie consent banner is therefore required to display this site.

For the full per-third-party disclosure required by the AEPD, see the Cookies Policy at /cookies/. Visitors can clear any cookie at any time using their browser's standard privacy controls; clearing the deister_locale cookie returns the navigation to the canonical home.

5. Server access logs

The site is served through Amazon CloudFront. CloudFront writes standard access logs to an S3 bucket the CONTROLLER owns. Each log line records, per request: the request timestamp, the visitor's IP address, the requested URL, the HTTP status code, the size of the response, the referring URL, the user-agent string, the viewer's country (derived by CloudFront from the IP), and the edge location that served the request. No cookies are recorded in the logs (include_cookies is set to false on the distribution).

The lawful basis for this processing is Article 6(1)(f) of the GDPR — the CONTROLLER's legitimate interest in operating the site reliably, detecting abuse and security incidents, measuring aggregate traffic volume per country and per URL, and producing the operational and security telemetry a Tier-1 infrastructure surface is expected to keep. No automated decision-making is performed on the basis of these logs.

Logs are retained for a maximum of 180 days, after which the S3 lifecycle policy deletes them automatically. The retention is proportionate to the operational-telemetry purpose: long enough to back-fill quarterly security and traffic reviews, short enough to keep the per-IP record retention bounded.

The logs are stored within the European Union (the S3 bucket is region-locked to the CONTROLLER's AWS account region). They are not shared with third parties, except where a legal obligation requires disclosure to a competent authority.