Privacy
policy

1. What is personal data?

It is any information relating to an identified or identifiable natural person that you give us when using this site: your email address, your username, your country or your mobile number. Some technical data is also recorded automatically, such as your IP address and the date and time of your visits.

The data we ask you for in order to play and to deliver your prize is identifying and contact data, and does not fall under the special categories of Article 9 GDPR. The one possible exception is the identity verification of winners: the provider compares the image of your face with the one on your document, and that comparison may amount to biometric processing. It happens only if you win and only if you agree to start the check; we explain it in section 7.

2. Data controller

Controller: Niquelao, S.L.
VAT number: B40616260
Address: Camino Casas de Bárcena, 79, 46131 Valencia, Spain
Data protection email: [email protected]

Niquelao, S.L. also owns OkGift, the platform used to issue the game gift cards. There is therefore no transfer to a third party in order to deliver your prize.

3. What we collect and why

We only ask for what we need so you can play and so we can hand you the prize:

• Email — this is how you sign in. dasminia uses no passwords: every time you want to get in, we send a temporary link to that address, valid for 10 minutes. We also use it to tell you about each new round and about the outcome of the game.
• Username — the one you choose when you sign up. It is unique, it identifies you in the game and it is the one shown in the ranking.
• Invitation code — if you sign up with another player code, we record who invited you so that they get an extra life when you verify your mobile. Your own code is a number derived from your record and contains no personal data.
• Month and year of birth — to check you meet the minimum age the game rules require. We do not ask for the day: month and year are enough for that check, and it is one less piece of data about you.
• Country of tax residence — it determines which gift card we can issue if you win, because the catalogue of brands differs from country to country, and how the prize is taxed. For now the game can only deliver prizes to people who are tax resident in Spain, Portugal or Andorra.
• Tax details, only if you win — when you are proclaimed a winner, and before we deliver the prize, we ask for your tax identification number (NIF, NIE or the equivalent in your country) and, if you live outside Spain, evidence of your tax residence. We do not ask for these at registration: only from whoever wins, because without them we cannot declare the prize or deliver it.
• Mobile (optional when you sign up, but it must be verified to vote) — to verify over WhatsApp that there is a real person behind each player, to prevent duplicate or automated sign-ups, and to grant you the extra life that verifying it earns. It is never published nor used for marketing unless you authorise it. By verifying it you agree to receive on that number, over WhatsApp, the game notifications and updates (round published, results); you can stop them at any time by replying BAJA to that same number.
• Public ranking — your dasminia username, the one you choose when you sign up, appears in the site's cumulative ranking (rounds guessed right and games won). No other data of yours is shown.
• IP and timestamp of your consent and of your last sign-in — so we can evidence when and from where you accepted this policy, as required by Article 7(1) GDPR, and to investigate duplicate, automated or fraudulent sign-ups if ever needed.

The sign-up form has two optional boxes: one to receive dasminia news and promotions, and another to receive offers from sponsors and partner brands. In both cases we send the email ourselves: your address is never handed over to anyone. You can switch each one on or off from your account at any time.

We run statistical studies of site usage (visits, time on page) that do not identify individuals.

4. Legal basis

Each purpose has the legal basis that fits it. Ticking the box on the sign-up form is not a blanket consent: it evidences that you have read this information and that you accept the game rules.

Taking part and applying the rules — performance of the relationship created by accepting the rules (Art. 6(1)(b) GDPR). It covers your profile, your votes, Extra Lives, the ranking and the titles.

Delivering your prize and documenting it — that same relationship (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)) as regards tax and accounting records, which is what obliges us to ask for your tax identification number and to verify your tax residence before we deliver the prize.

Keeping the game fair — legitimate interest (Art. 6(1)(f)): mobile verification and control of duplicate or automated sign-ups.

Marketing — consent (Art. 6(1)(a)), and only the box you tick: one for dasminia news and another for sponsor offers. Both are optional, unticked by default, and you may withdraw them at any time without affecting your participation.

Game notifications over WhatsApp — consent (Art. 6(1)(a)) that you give by verifying your mobile: from then on we send the game notifications and updates (round published, results) to that number, and nothing else. You withdraw it at any time by replying BAJA to that same number, without affecting your participation or the verification.

Extra lives for invitations are part of the game rules you accept when signing up.

5. Minors

dasminia is for people aged 18 and over. The game rules require it, which is why the sign-up form asks for your month and year of birth and turns away anyone below that age.

We do not knowingly process the data of minors. If we detect a sign-up by a minor, we delete it along with all their data.

If you are a parent or guardian and believe a child in your care has registered, write to [email protected] and we will delete it, no questions asked.

6. How long we keep your data

We keep your data for as long as you are a dasminia player and do not ask us to delete it.

If you ask to leave, we delete your record except for data we are legally required to retain: in particular, data linked to a prize already delivered, which is kept for the applicable tax and accounting periods (up to six years under the Spanish Commercial Code).

The access links we email you are not stored in any database: they expire on their own after 10 minutes. Of the send itself we only keep a minimal record (email, IP and time) for at most 30 days, to throttle bulk sending.

The log of your sign-ins and data changes (date and IP) and the copy of your votes in each round are kept for two years, a reasonable period to settle prize claims or investigate fraudulent sign-ups. An automatic process deletes whatever exceeds these periods.

7. Recipients and processors

We do not sell, rent or disclose your personal data to third parties for commercial purposes.

We do rely on providers that process data on our behalf, under a data processing agreement (Art. 28 GDPR):

• OVH Hispano, S.L.U. — website and email hosting (servers in the European Union).
• Cloudflare, Inc. — content delivery network, protection against attacks and Turnstile, the check that confirms there is a person and not a program behind the form. Turnstile uses no tracking cookies and does not profile your browsing.
• Meta Platforms Ireland Ltd. — WhatsApp, for mobile verification and player support.
• Gift card issuers — to issue the prize, only the minimum needed to generate and deliver it is passed to the relevant brand.
• Veriff OÜ (Estonia) — identity verification of winners before the prize is delivered, as required by the legal rules. It is only used with winners who agree to start the check. Your identity document and a facial image taken at that moment are sent to them, and the provider compares one against the other to confirm that the document is genuine and that it is you: that comparison may amount to biometric processing. dasminia does not receive the images; it receives the result of the check, your name and surname and the document details (type, number and expiry date), which are what evidence who the prize was delivered to. Veriff is established in the European Union, so this processing does not leave the European Economic Area.

When we send you offers from sponsors or partner brands, we do the sending: the sponsor receives neither your email nor any other data of yours.

If we were legally required to disclose data to a public authority, a court or law enforcement, we will do so.

8. International transfers

Our web and mail servers are located in the European Union.

Some of the providers listed above are US companies that may process data outside the European Economic Area. In those cases the transfer relies on the EU-US Data Privacy Framework adequacy decision or, failing that, on the standard contractual clauses approved by the European Commission.

9. Security measures

We apply the technical and organisational measures needed to protect your data, following privacy by design and by default:

• The whole site is served over HTTPS with an SSL certificate.
• We store no passwords, because dasminia does not use them: there is no credential of yours that could leak from here.
• Access links are cryptographically signed (HMAC-SHA256) with a key that never leaves our server, include a different random value every time, and expire after 10 minutes.
• Database access is restricted to the staff who need it to run the game.

Should a security breach occur that poses a high risk to your rights, we will inform you and notify the Spanish Data Protection Agency within the legal deadlines.

10. Exercising your rights

You may exercise, free of charge, your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw your consent at any time.

Fastest route: sign in with an access link: from your account you can check your data, manage which emails you receive and delete your account with the «Delete my account» button, which erases your record instantly.

By email: write to [email protected] from the address you registered with.

By post: Niquelao, S.L., Camino Casas de Bárcena, 79, 46131 Valencia, Spain, stating the right you are exercising and enclosing a copy of a document proving your identity.

We will reply within one month at most. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the competent supervisory authority.

11. Marketing messages and withdrawal

Under Spanish Law 34/2002 on Information Society Services and Electronic Commerce, we will only send you marketing messages if you have ticked the relevant box. There are two, independent of each other: dasminia news and promotions, and offers from sponsors and partner brands in the leisure and entertainment, consumer goods, fashion and technology sectors and the brands whose gift cards are given away. Sponsor offers are also sent by us: we never hand your email to a third party.

Essential game notices (your access link, a round opening, the result or the delivery of your prize) are not marketing messages and are sent even if you declined marketing, because they are part of the game itself.

You can unsubscribe from either of them using the «your email preferences» link included in every message (it takes you to your account with the box in view), from your account at any time, or by writing to [email protected]. It will take effect within 48 hours at most.

12. Cookies and third-party services

dasminia uses no analytics, advertising or tracking cookies, which is why you will not see a cookie banner: the only ones set are technical, exempt from consent under Article 22.2 of the Spanish LSSI and the AEPD Guide on the use of cookies.

• Session cookie (PHPSESSID) — keeps you signed in after you open your access link. It disappears when you close the browser or sign out.
• Cloudflare security cookies (__cf_bm, cf_clearance) — tell legitimate traffic from automated attacks. They expire within 30 minutes at most and do not identify individuals.

Should we add analytics or advertising cookies in the future, prior consent will be requested through a banner and they will be detailed in a specific cookie policy.

13. Accuracy of the data

You are responsible for the data you give us being truthful and up to date. If the mobile you declare is not yours, or the email is wrong, we will not be able to validate your entry or deliver your prize.

Keeping your details current matters: it is the only way we will reach you if you win.

14. Changes to this policy

Niquelao, S.L. reserves the right to amend this privacy policy to adapt it to legislative or case-law developments, or to changes in how the game works.

Any change will be published on this same page at least ten days before it takes effect. If the change affects the purpose of the processing, we will ask for fresh consent.

By registering you declare that you have been informed of the personal data protection terms and accept the processing as described here. You may withdraw your consent at any time, without retroactive effect.