Subdiversión · Participation
Privacy of accounts and contributions
The data controller is Sebastian Moran, owner of Subdiversión. You can contact the controller at [email protected] for enquiries and to exercise your rights.
Data we use and why
We use your public name, email address, password protected by a hash function and activation status to manage your account and verify your email. If you provide them, we also use your profile photo and introduction. To receive and review a contribution, we use the photograph, proposed species, capture date and location, review outcome and record of accepted permissions. The proposed species is optional; the other fields marked as required are necessary to provide the service.
Account and contribution management is based on providing the service you request under the participation terms. Publication and use of photographs require the permission described in those terms. Protecting the service against abuse and retaining evidence of permissions are based on the controller’s legitimate interest in maintaining security and handling possible claims. The connection address is used to limit abusive attempts through a protected identifier. The module does not use these data to subscribe you to advertising.
What information is public
Your email and participation profile are private. If a contribution is approved, the photograph, your public name as author and the observation data, including the validated species, date and place, may be published. Do not send personal data about third parties or photographs containing identifiable people. A person reviews contributions; badges are calculated from approved contributions and do not involve automated decisions with legal effects.
Hosting and providers
Subdiversión uses its own server located in Spain. IONOS provides email services for account and participation communications and hosts a replica of the website databases and files. The replica may include accounts, pending contributions, approved photographs and permission records. Cloudflare provides DNS and web access intermediary services and processes the traffic and technical data necessary for those services.
These providers access the data needed to provide their services. Using authorised photographs on social media, in publications or on products may require sharing the photograph and its attribution with the providers needed for those uses, within the scope of the permission accepted. This does not authorise publication of your email or other private account data.
Services are provided under the data processing agreements with IONOS and Cloudflare. Cloudflare’s international infrastructure may involve processing data outside the European Economic Area. For transfers requiring additional safeguards, its agreement provides for standard contractual clauses and applicable supplementary measures. You can consult Cloudflare’s data processing agreement and request information about safeguards at [email protected]. The location of the private server in Spain does not mean that all processing by providers takes place exclusively in Spain. No other external backup services are currently used; if any are added, this information will be updated before data are transferred to them.
Retention
We retain your account and its history while you maintain the account or until you request deletion, except for data necessary to meet applicable obligations, evidence permissions or handle claims. Pending files are deleted on rejection or through scheduled cleanup after more than 90 days without review. Approved photographs are retained for authorised uses; deleting your account does not automatically terminate the perpetual permission. Removal and erasure requests are assessed in accordance with applicable rights and obligations.
Deletion is transmitted to replicas through synchronisation. Automatic copies created by this process at IONOS are deleted through maintenance when they are more than seven days old; synchronisation logs are deleted when they are more than fourteen days old. These periods apply to that process, not to all providers’ technical records. Recovery copies are kept separate from ordinary use for as long as needed for their recovery purpose, and data retained to handle claims are limited to that purpose. Recovery requires reapplying erasure requests so that the data are not reintroduced into the service. You can ask the controller about the retention applicable to your data.
Your rights
You may request access, rectification, erasure, objection, restriction or portability, where applicable, by writing to [email protected]. Where processing relies on your consent, you can withdraw it without affecting the lawfulness of earlier processing. Copyright permission and requests relating to photographs are handled under the terms and applicable rights. You may lodge a complaint with the Spanish Data Protection Agency.
Access uses WordPress technical session cookies. This information concerns the participation module and must be integrated with Subdiversión’s general privacy and cookie policy for the website’s other services.
Sign in with Google
If you choose Google, we receive your account identifier, name and email to create your account or sign you in. We do not receive your Google password or access to Gmail, Drive or your photographs. The button uses Google Identity Services, whose provider receives technical connection data. Accepting the terms is still required to create an account.