Privacy policy
This website handles very little personal data: the technical data of each visit, a cookieless count of visits, and any email you send us. This policy explains what that data is used for, on what legal basis, who else is involved and what rights you have.
Last reviewed:
1. Who is responsible for your data
The controller of your personal data is JDOI, SLU, a single-member limited liability company (societat limitada unipersonal) incorporated in Andorra, with tax registration number (NRT) L-717971-A and its address at C/ del Doro, 6, 2-3, Edifici La Llenguadera 6, Vila, AD200 Encamp, Andorra. Props360 is its product, and the rest of its details are in the legal notice. In this policy, "we" means JDOI, SLU.
For any privacy matter the point of contact is the company mailbox, whatever country you are in, including the European Union and the United Kingdom: support@props360.app. You can also write by post to the address above.
JDOI, SLU has no data protection officer.
2. Which laws apply
JDOI, SLU is an Andorran company and applies Andorran data protection law to everything it does with personal data: Law 29/2021 of 28 October on personal data protection (Llei 29/2021, qualificada de protecció de dades personals) and its implementing regulation (Decree 391/2022). That law protects every individual, whatever their nationality or country of residence.
If you are in the European Union or the European Economic Area, the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") also applies. If you are in the United Kingdom, the UK version of that regulation ("UK GDPR") also applies.
3. What data we process, why and on what legal basis
Today this website processes personal data in only three situations: when you visit it, when visits are measured, and when you write to us. The data always comes from you or from your browser; we do not obtain it from third parties.
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the website | IP address and technical connection data | Delivering the pages and protecting the website | Legitimate interests: operation and security | Set by Cloudflare; we keep no copy of our own |
| Measuring visits | Page viewed, referrer, country, device and browser, without identifying you | Knowing, in aggregate, how the website is used | Legitimate interests: aggregate statistics. You can object | Figures available for six months |
| Emails you send us | Your address, your name if you give it, and your message | Replying to you | Legitimate interests in handling your request; legal obligation if you complain or exercise a right | Up to two years after the matter is closed |
Technical data of your visit
The website is served by Cloudflare, which provides its hosting, security and content delivery network. To get a page to your browser, Cloudflare processes the technical data of the connection on our behalf: your IP address, the date and time, the page you request, the page you came from, and your browser and device type. This is the data any browser sends when it requests a page, and without your IP address the page could not reach you.
Purpose. To deliver the pages and to protect the website against attacks and abusive automated traffic. For the same purpose, Cloudflare may store a technical security cookie in your browser; the cookie policy explains it.
Legal basis. Our legitimate interest in keeping the website working and secure. We do not use this data to identify you or to learn what you do on other sites.
Aggregate, cookieless measurement of visits
The website can count its visits with Cloudflare Web Analytics. Today that measurement is switched on. According to Cloudflare, this tool uses no cookies, stores nothing in your browser, and does not identify individuals through their IP address or their browser data. It builds no profiles and does not follow you from one site to another: all we see is aggregate figures.
What it collects. The page viewed, the referring page, the country, the device type, the browser and operating system, and loading speed.
Purpose. Only to know, in aggregate, how many visits each page gets, where they come from and whether the website loads well, so that we can improve it. It is not used for advertising or for anything else.
Legal basis. Our legitimate interest in understanding how the website is used through aggregate statistics. You have the right to object, without giving any reason.
When visits are not measured. The measurement script only loads if measurement is switched on, and it never loads if you have objected with this switch or if your browser sends the Global Privacy Control or Do Not Track signal.
The switch saves your choice in this browser, sends it nowhere, and you can change it whenever you like.
Emails you send us
If you write to our mailbox, we process your email address, your name if you give it, and whatever you tell us in the message. Writing to us is your choice: you are under no obligation to give us any data.
Purpose. Only to reply to you and deal with your request. We do not add you to any list or send you marketing email.
Legal basis. Our legitimate interest in handling the request you have made. If your email is a complaint or a request to exercise a right, the basis is also our legal obligation to answer it.
We do not need sensitive data, such as health information, political opinions or bank details: please do not include it in your messages.
4. What this website does not do
- It has no user accounts, forms, waiting list or purchases.
- It sends no marketing email.
- It uses no cookies of its own, no advertising cookies, and no social media pixels or tools.
- It does not sell your data or share it with anyone for advertising.
- It builds no profiles and makes no automated decisions about you.
5. Who else processes the data
We do not hand your data to anyone for their own purposes. The only third parties involved are the technical providers that make the website and our email possible:
- Cloudflare, Inc., of the United States (101 Townsend St., San Francisco, California): website hosting, security, content delivery network and measurement of visits. It processes the data on our behalf and on our instructions (the law calls this a "processor"). Cloudflare explains how it handles data in its privacy policy.
- The company's email provider: it receives, delivers and stores the emails you send us and our replies.
Apart from that, we would disclose your data to an authority or a court only if a law required us to.
6. International transfers
JDOI, SLU is in Andorra, a country that the European Commission recognizes as providing an adequate level of data protection (Decision 2010/625/EU).
Cloudflare is a United States company and serves the website from its worldwide network of servers, so your technical data may be processed outside your country, including in the United States. That transfer rests on two safeguards: Cloudflare states that it adheres to the EU–U.S. Data Privacy Framework and its UK Extension, and its data processing agreement includes the standard contractual clauses approved by the European Commission, with the UK addendum.
Emails are stored on the email provider's servers, which may be outside your country. Write to us if you want to know which provider that is and what safeguards apply to that data.
7. How long data is kept
- Technical data of your visit: we keep no copy of our own. Cloudflare keeps it in its logs for as long as it needs to provide the service and protect its network, under the retention periods of its own service.
- Measurement of visits: the figures can be consulted for six months.
- Emails: while we deal with your request and, once it is closed, for no more than two years, so that we can show what was answered. They are kept longer only if a complaint is still open or a law requires it.
- Your choice not to be measured: it stays in your browser until you change it or clear the site data. It never reaches us.
8. Your rights
At any time, and free of charge, you can ask us for:
- access: to know what data of yours we process and to receive a copy;
- rectification: to have inaccurate data corrected;
- erasure: to have it deleted;
- restriction: to have us stop using it while a request of yours is being resolved;
- objection: to have us stop processing it where the basis is our legitimate interests (for measurement, the switch in section 3 is enough);
- portability: to receive it in a commonly used format, in the cases provided for by law.
Today no processing on this website is based on your consent. If any were in the future, you could withdraw it whenever you wished, as easily as you gave it.
How to exercise them. Write to support@props360.app and tell us what you want. If we have reasonable doubts about who is sending the request, we will ask you to confirm it. We reply within one month of receiving your request; if it is complex, the law allows that period to be extended by two further months, and in that case we will let you know within the first month.
Visit data does not carry your name or your email address, so we will usually be unable to tell which of it is yours. The emails you have sent us are different: those we can find.
9. How to complain
If you think we have not handled your data properly, you can tell us at support@props360.app. We acknowledge your complaint within 30 days and answer it without undue delay.
You can also complain to a data protection authority, without having to write to us first:
- in Andorra, the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, APDA): www.apda.ad;
- if you live in the European Union or the European Economic Area, the data protection authority of your country of residence (in Spain, for example, the Agencia Española de Protección de Datos); the European Data Protection Board publishes the list of authorities;
- if you live in the United Kingdom, the Information Commission (ICO): ico.org.uk.
10. Minors
Props360 is a service for adults (18+). This website is not directed at minors and we do not knowingly process minors' data. If you believe a minor in your care has written to us, let us know and we will delete their messages.
11. Automated decisions and profiling
We make no automated decisions about you and build no profiles from your data.
12. Security
The website is served over an encrypted connection (HTTPS) and is made of static pages: it has no visitor database and no user area. If a security breach ever affected your data, we would notify the data protection authority and you in the cases and within the time limits set by law.
13. Changes to this policy
This policy describes what the website does today. Before the Props360 app is released, it will be updated to explain what the app does: user accounts, subscriptions and the providers involved.
Whenever it changes, the review date shown above will change too, and significant changes will be flagged visibly on this page.
14. Language
This policy is published in Catalan, Spanish and English. If the versions differ, the Catalan version prevails.