Skip to content
La Nova AFA -Promoter groupPetit Estel - La Nova School

Privacy policy

Last updated: 28 September 2026

1. Who processes the data

Data controller: Rubén Garrido Camps, member of the promoter group “La Nova AFA - Promoter group”.

Privacy contact and exercise of rights: info@lanovaafa.cat

This website is not the institutional website of Petit Estel La Nova School or of the current AFA. The school’s website is petitestellanova.cat.

2. Data and processing

There are two separate areas of processing. The form is not the only processing: the site is hosted on Vercel and loads Vercel Web Analytics, and the server processes technical visit requests.

  • Access form (POST /api/inscripcio and /api/inscripcio/verify): full name of the adult, mobile number, consents, language, received time, a cryptographic hash of the MFA code (never the code in clear text) and, if validated, the approval time. Purpose: to verify the number and send the WhatsApp community link. We do not collect stage or year.
  • Selected country or international prefix, to normalise and send the verification code to the stated number.
  • Hosting, CDN, access and runtime logs: each visit or API call generates ordinary technical processing (IP address, date and time, URL or path, user agent, response code). Purpose: to serve the site, security and diagnostics. Provider: Vercel, Inc., as processor.
  • Visit analytics: Vercel Web Analytics measures page views in aggregated form, without cookies. It identifies visits with a hash of the request, discarded after 24 hours. It may record URL, referrer, approximate country/region, operating system, browser and device type. There are no custom events, pixels, CAPTCHA, session tools or third-party embeds. Site routes do not contain a name or phone number. Documentation: https://vercel.com/docs/analytics/privacy-policy
  • Request storage: the form POST writes a private JSON file to Vercel Blob (the “restricted store”). In local development it may be saved on disk; in production the provider is Vercel. Documentation: https://vercel.com/docs/storage/vercel-blob
  • WhatsApp / Meta: sending the MFA code and the invite link, and providing the community once you join, as explained in section 4.

3. Legal basis

Form, MFA and invitation: consent (Article 6(1)(a) GDPR), given by ticking the boxes on the form, including the specific information about WhatsApp.

Hosting, CDN, technical logs and storage needed to run the site: legitimate interest (Article 6(1)(f)) in keeping a public site secure and available.

Vercel Web Analytics: legitimate interest (Article 6(1)(f)) in knowing in aggregated form which pages are consulted, without cookies or a persistent identifier. It is not used for advertising or to follow people across sites.

Form consent may be withdrawn at any time, without affecting the lawfulness of processing already carried out, by writing to info@lanovaafa.cat.

4. WhatsApp community (before the invitation is sent)

Communication with you (the verification code and, if you validate it, the invitation) is made through a WhatsApp community, not by email or SMS. The access space is the families’ community and the “Grup Informatiu - Famílies” group.

Purpose of this communication: to verify that the number is yours and, if the code is correct, to send you the link to join the community. Recipient of the messaging service: WhatsApp, provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. WhatsApp processes service data as an independent controller, under its privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

Who will see the phone number and profile: other members of the community and of the groups you join can see your phone number. Depending on your WhatsApp privacy settings, they may also see your profile name, photo, profile information and that you belong to the group. Community administrators can also see the number.

Joining the community is a step you take, by opening the invite link. Once inside, the service is operated by WhatsApp, not by this website.

5. Retention

The periods are as follows. If you ask for erasure sooner, the earlier date applies, unless a legal duty requires us to keep the data.

  • Pending request (MFA not validated): 30 days from the received date; then it is deleted from the store.
  • Rejected request: this site has no rejected status. If the code is not validated, the request stays pending and is deleted after 30 days.
  • Accepted request (MFA validated): 30 days from the approval date and time, or until an erasure request, whichever comes first. A daily cron (cron-job.org) deletes expired records.
  • MFA code hash: 10 minutes (code expiry) or until it is validated; the code is not stored in clear text.
  • List of administrators (identifier, password hash and MFA secret in environment variables): while they hold that role. If someone leaves, their entry is removed and their sessions are revoked.
  • WhatsApp messages (code, invitation and community chat): this website does not archive their content. WhatsApp keeps them under its own policy. Administrators do not export the history to a system of our own.
  • Vercel hosting and runtime logs: kept by Vercel according to the project plan, typically between 1 hour and a few days. We do not copy them to a store of our own.
  • Analytics: the visit hash is discarded after 24 hours; aggregated metrics (page views) are consulted in the Vercel dashboard without identifying people.

6. Processors, providers and transfers

Data are not shared with third parties for advertising and are not used commercially. The providers and their roles are:

  • Vercel, Inc. (United States): processor for hosting, CDN, access and runtime logs, Vercel Web Analytics and Vercel Blob (private store of requests). Processing is under Vercel’s data processing addendum (DPA), which the controller must have accepted on the Vercel account. Location: Vercel’s infrastructure, with possible processing in the United States and in regions where Vercel or its sub-processors operate. Addendum: https://vercel.com/legal/dpa Privacy: https://vercel.com/legal/privacy-policy Analytics: https://vercel.com/docs/analytics/privacy-policy Blob: https://vercel.com/docs/storage/vercel-blob
  • Meta Platforms Ireland Limited (WhatsApp): independent controller of the messaging service and of the community. It operates worldwide and provides for processing and transfer outside the EEA, including the United States. Mechanism: Standard Contractual Clauses (Article 46(2)(c) GDPR) and, where applicable, the EU–US Data Privacy Framework. Policy: https://www.whatsapp.com/legal/privacy-policy-eea
  • Vercel and Meta state that, for international transfers, they use Standard Contractual Clauses and, where applicable, the Data Privacy Framework for certified entities.

7. Rights

You may request access, rectification, erasure, restriction, portability and objection, and withdraw consent, at info@lanovaafa.cat. You may also lodge a complaint with the Catalan Data Protection Authority (apdcat.gencat.cat) or the Spanish Data Protection Agency (aepd.es).

8. Security measures

Production requests are stored in Vercel Blob with private access. The /admin panel requires a username, a strong password and MFA (TOTP), limits login attempts and revokes the session if the administrator’s account is removed. Family MFA codes are stored only as a cryptographic hash. No system is infallible; if we detect an incident that may affect you, we will inform you in accordance with the law.