Privacy policy
Version 1.0 · In force from November 6, 2026
This is a translation. If there is any discrepancy, the Spanish version prevails.
This page explains, in plain words, what data we process when you sign up for the WinParking prelaunch, why, for how long and what rights you have. We comply with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Controller
- Controller: Fermín Solano Delgado (Tax ID 72805505V), sole trader.
- Business address: Calle Padre Barace, 1 Bj (trs), 31007 Pamplona (Navarre), Spain.
- Privacy contact: privacidad@winparking.com.
We have not appointed a data protection officer because we are not required to. For any question about your data, write to the address above.
Transfer to the company. We plan to incorporate Win Parking, S.L. (a single-member limited company based in Pamplona) in early 2027. Once it exists, we will transfer the WinParking activity to it, including your account and its data, and it will become the controller for the same purposes described here. We will email you before doing so, and you will be able to object or delete your account if you disagree. The legal basis is our legitimate interest in the continuity of the project (art. 6.1.f GDPR).
2. What data we process
| Type of data | Which data | Where it comes from |
|---|---|---|
| Registration data | First name, email, country, city, postcode and language, and whether we filled in your city from your postcode or you typed it. If you change your name, we record that you changed it and when, without the old or the new name | You provide it when signing up or when changing it in "My account" |
| Campaign source | If you arrived through a link with campaign parameters (utm_source, utm_medium and utm_campaign, for example "instagram", "social" and "profile"), those values | Stored with your account when you sign up. We do not use cookies or tracking pixels for this |
| Phone (optional during the prelaunch) | Mobile number and verification date. If you change your mobile or delete your account, a fingerprint of the previous number (a code calculated with a secret key, from which the number cannot be recovered) and the date | You provide it if you wish; we verify it with an SMS code. It will be required to activate your account when we open |
| Email change | The old and the new email, the dates of each step and the attempts | Generated if you change your email from "My account" |
| Acceptances and consents | Which texts and boxes you accepted, which version, when and from where (sign-up, "My account", newsletter unsubscribe or the cookie banner) | Generated when you sign up, change your preferences and accept or withdraw preference cookies. If you accept them before having an account, the proof is stored with a random identifier carried in the cookie itself and the invitation code, without your IP address, and linked to your account if you sign up |
| Affiliate programme | Your referral code, who invited you, how you arrived (link, cookie, typed code or email), your invitees, whether any invitation is under anti-fraud review and clicks on your link (without storing the IP address of whoever clicks). If you type the email of the person who invited you instead of their code, we record that you tried; we use the email only at that moment to look up their account and do not store it | Generated when you use the website |
| Survey | Your answers (what interests you, whether you have a space, how you would park, your area, how you heard about us, how much you would ask or pay for a space and what you would do in the first month after we open) | You provide them, if you wish |
| Technical and security data | IP address, browser and device type, access logs, results of anti-bot checks and verification attempts (of the SMS code and the 6-digit email code) | Generated when you use the website |
| Newsletter | Whether you agreed to receive it and, if you receive it, whether you open the emails or click their links | Generated when we send you the newsletter |
Founder and Founding Ambassador. If you get the Founder badge or Founding Ambassador status, we store it in your account. The Founder badge will be visible to other users on your profile and on your spaces once we open.
We do not ask for payment data, identity documents or special categories of data. The prelaunch is only for people aged 18 or over: if we detect an account belonging to a minor, we will delete it.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your prelaunch account, verifying your email (and your phone, if you give it), letting you sign in and granting you the Founder badge | Performance of the contract you accept with the prelaunch terms (art. 6.1.b GDPR) |
| Running the affiliate programme: giving you your link, associating your invitees, showing you your statistics and granting you Founding Ambassador status | Performance of the affiliate programme contract (art. 6.1.b GDPR) |
| Sending you the necessary service emails: sign-up confirmation, account notices, "someone has signed up with your link", the launch in your country and changes to the terms | Performance of the contract (art. 6.1.b GDPR) |
| Sending you the WinParking news and offers newsletter | Your consent, given by ticking a separate box and which you can withdraw at any time (art. 6.1.a GDPR and art. 21 LSSI) |
Remembering for 30 days who invited you, using the wp_ref cookie | Your consent in the cookie banner (art. 22.2 LSSI). The details are in the cookie policy, and you can change your choice in "Cookie settings" at the bottom of the website |
| Analysing survey answers and campaign sources and producing aggregated statistics (for example, how many people want to rent out their space in each city, what average price they expect or which social network brings the most sign-ups) to decide where, how and at what price to launch | Legitimate interest in preparing the launch (art. 6.1.f GDPR); answering is voluntary and you can delete your answers |
| Protecting the website, your account and the programme against bots, fake accounts, affiliate fraud and SMS abuse. Among other things: preventing for 30 days a number released by one account from being verified on another; checking, when you sign up or change your email, that its domain does not belong to a disposable email service, using a public list; and notifying your previous email if you change it, so you can block the account if it wasn't you | Legitimate interest in the security of the service and in preventing fraud (art. 6.1.f GDPR) |
| Reviewing new or changed first names to detect offensive names or impersonation | Legitimate interest in providing a safe and respectful environment (art. 6.1.f GDPR) |
| Detecting and fixing technical errors | Legitimate interest in keeping the website working (art. 6.1.f GDPR) |
| Handling your requests and the exercise of your rights, and meeting legal obligations | Legal obligation (art. 6.1.c GDPR) |
Name review. When you sign up or change your first name, we check that it is not on a list of offensive words. A member of our team may also review new or changed first names to detect offensive names or impersonation. If a name looks doubtful, it is hidden from other users until we decide.
We do not take decisions based solely on automated processing that produce legal effects for you. If our anti-fraud systems flag an account or an invitation as suspicious, a person reviews it before anything is suspended.
4. Who else sees your data
- Your affiliate. If another person invited you, they will see in their dashboard your first name, the date you signed up, whether you have verified your phone and, if our anti-fraud system is reviewing your invitation, the "Under review" label (without the reason). If your name is under review, they will not see it until it is resolved. They will never see your email, your phone or your survey answers.
- Providers working for us (processors), under contracts that comply with article 28 GDPR:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, accounts and sign-in | Servers in Frankfurt (EU); Singapore company |
| Vercel | Website hosting | Functions in Frankfurt (EU) and global network; the website is built in the USA, without personal data; US company |
| Cloudflare | Domain, security, anti-bot protection (Turnstile), access to the internal dashboard and storage of the email images, the promotional video and the postcodes (R2, without personal data) | Global network; US company |
| Twilio | Sending the SMS verification code and the email change code | USA |
| Resend | Sending service emails | Sending from Ireland (EU); account logs in the USA |
| Brevo | Sending the newsletter (only if you accept it); if you change your email, your contact moves to the new one | France (EU) |
| Sentry | Logging technical errors, without contact data | EU; US company |
| Google (Workspace) | The email we use to answer your messages | EU and USA |
- Authorities, only when the law requires it.
We do not sell your data or give it to third parties for their own advertising.
5. Transfers outside the European Union
Some providers are companies based outside the European Union (the USA and Singapore) or may access data from there. In those cases the transfer is protected by the EU-US Data Privacy Framework when the provider is certified or, otherwise, by the standard contractual clauses approved by the European Commission. You can ask us for more information at privacidad@winparking.com.
6. How long we keep it
| Data | Period |
|---|---|
| Account, phone, survey, affiliate relationship and badges | While you have the account. If you delete it, we delete or anonymise this data. Your affiliate's dashboard will only show "deleted account" |
| Accounts that do not verify their email | Deleted 30 days after sign-up |
| Accounts with a verified email and no phone | Kept until we open in your country. On that day we will ask you to activate the account in the app (where the phone is required). If you do not activate it within the following 12 months (counted from the opening in your country or from your sign-up, if you signed up later), we will notify you 30 days before and delete it |
| Accounts suspended for possible fraud | For as long as the case lasts. If you ask us to delete the account, we delete it when the case is closed (section 7) |
| Fingerprint of the mobile number released by an account (when changing mobile or deleting the account) | 30 days |
| Email change | Both emails, 24 hours at most. The rest of the change, without the emails, up to 31 days after it is completed (2 days if cancelled). The fingerprint of the "Wasn't this you?" link in the notice, 8 days, and the attempts to use it, 30 days |
| Proof of your acceptances and consents | While you have the account and then blocked for 3 years from deletion, only to defend ourselves against a claim |
| Proof of cookie consent for people who never sign up (random identifier, invitation code in the cookie, date and cookie policy version) | Blocked for 3 years from acceptance, for the same purpose |
| Newsletter | Until you unsubscribe |
| Technical and security logs (for example, that an account's email was changed or that support looked it up) | Up to 12 months. After that they are kept without any data that identifies you, only for statistics. If your account is suspended for possible fraud, those related to the case are kept for as long as it lasts |
| Technical errors | 90 days |
When we launch the service, your account will remain active under the retention rules of the general terms published at that time.
7. Your rights
At any time you can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent without affecting anything done before:
- from "My account" you can change your data and preferences, unsubscribe from the newsletter, download your data and delete your account. In the download, the person who invited you and your invitees appear only with their affiliate code and, for your invitees, their status; never with their name or any other data of theirs;
- if your account is suspended while we review possible fraud, you will not be able to delete it from "My account": write to soporte@winparking.com or privacidad@winparking.com and we will delete it when the case is closed, within the one-month period set by law;
- every newsletter has a one-click unsubscribe link;
- or write to privacidad@winparking.com stating which right you want to exercise. We will reply within one month at the latest.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es). If you live in Andorra, you can also complain to the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, apda.ad).
8. Security
We apply appropriate technical and organisational measures: encrypted connections, database access limited to what each person needs, two-step verification on all our internal accounts, an internal dashboard protected by two-factor authentication and restricted access, and logs of internal actions.
9. Changes to this policy
If we change this policy in a significant way, we will notify you by email and on the website before the change applies. The current version and its date are always shown at the top of this page.