Información legal

Privacy policy

Última actualización: 26 de septiembre de 2026

1. Data controller

Company name: Site Factory Digital Agency, S.L.
Tax ID (CIF): B-88047444
Registered address: C/ Velero 26, 28220 Majadahonda (Madrid), Spain
Data protection contact email: info@sitefactory.es

This policy applies to all personal data processed through the website fillow.net (hereinafter, “the Site”).

2. Legal framework

Your personal data is processed in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and digital rights (LOPDGDD).
Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

3. Data we process, purposes and legal basis

We only process personal data where a legal basis legitimises it. Each processing activity is detailed below.

3.1. Browsing the Site

Data: IP address, browser identifiers, pages visited, time on page, traffic source, cookie data (see the Cookie Policy).
Purpose: audience measurement, Site improvement, fraud prevention, technical security.
Legal basis: user consent (analytics, advertising and personalisation cookies) and the controller’s legitimate interest (strictly necessary cookies and fraud prevention).
Retention period: as stated in the Cookie Policy for each cookie.

3.2. Contact forms, suggestions and reports

Data: whatever the user provides voluntarily (typically email and message).
Purpose: handling the enquiry, content suggestions, error reports or content removal requests.
Legal basis: the data subject’s consent when sending the communication.
Retention period: for the duration of the conversation and, once closed, up to 12 months to evidence compliance.

Data: email address and, optionally, name.
Purpose: periodic delivery of the Site’s editorial updates.
Legal basis: the data subject’s express consent through double opt-in.
Retention period: until the user unsubscribes, which they can do at any time via the link included in every email.

3.4. Comments on articles and listings

Data: the name (or alias) you choose, your email address and the text of the comment.
Purpose: publishing the comment alongside the article after manual review. The name and text are published; the email is never published and is only used for moderation and to handle a possible removal request.
Legal basis: the data subject’s consent when submitting the form.
Retention period: for as long as the comment remains published or until you request its deletion.

3.5. Likes and quick comments in galleries

Data: a random identifier stored in the fillow-voter cookie (not linked to your identity) and, temporarily, your IP address.
Purpose: remembering which content you have voted on and rate-limiting submissions to prevent spam and abuse.
Legal basis: the controller’s legitimate interest (fraud and spam prevention).
Retention period: per-IP rate-limit counters are deleted automatically within minutes (5 at most). The voter identifier expires after 2 years.

4. Data recipients

We do not share your data with third parties except:

To comply with legal obligations (authorities, courts, competent bodies).
Data processors providing technical services to the Site under contract and with equivalent safeguards:
- Vercel Inc. (hosting and CDN). Servers in the US, covered by the European Commission’s Standard Contractual Clauses and EU-US Data Privacy Framework certification.
- Google LLC (Google Analytics and Google AdSense, where active). Transfers to the US under Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Cloudinary Ltd. (image storage and delivery, where applicable). Servers in the US.
- Supabase Inc. (database storing article comments: name, email and text). Project hosted in the EU or in the US under Standard Contractual Clauses, depending on configuration.
- Upstash Inc. (technical store for votes, voter identifiers and auto-expiring per-IP anti-spam counters). Servers in the US under Standard Contractual Clauses.
- Anthropic PBC (AI-assisted editorial workflows for internal use; it does not process identifiable end-user personal data). Servers in the US.
- Transactional email providers used for newsletter delivery or automated replies.

5. International transfers

Some of the above providers are based in the United States. These transfers are covered by:

Standard Contractual Clauses approved by the European Commission (Decision 2021/914).
The provider’s certification under the EU-US Data Privacy Framework where available.

6. Your rights

As a data subject, you have the right to:

Access: know which of your data we process.
Rectification: correct inaccurate data.
Erasure (“right to be forgotten”): have your data deleted when no longer necessary.
Objection: object to processing based on legitimate interest.
Restriction of processing: restrict the use of your data in certain circumstances.
Portability: receive your data in a structured, reusable format.
Withdrawal of consent: without affecting the lawfulness of prior processing.

To exercise them, write to info@sitefactory.es stating the right you wish to exercise and attaching a copy of an identity document. We will respond within one month of receiving your request at the latest.

If you believe the processing does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (https://www.aepd.es) or your local supervisory authority.

7. Security measures

Site Factory Digital Agency, S.L. has adopted the technical and organisational measures necessary to keep personal data secure and prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the stored data and the risks they are exposed to.

8. Changes to this policy

This policy may be updated when required by regulatory, technical or service changes. The date of the last update appears at the top of the document. We recommend reviewing it periodically.

Last updated: 26 September 2026.