Privacy policy
Last updated: June 2026
1. Data controller
TopPalomas operates this platform as a private intermediation service. You can contact us at toppalomas@gmail.com regarding any matter related to your personal data.
2. Data we collect
When you sign up we collect your name and email address. While you use the platform we record your activity: bids placed, auctions you take part in and account preferences. We do not collect payment data (payments are handled directly between users).
3. Identity verification
In order to bid or list pigeons on the platform, your account must first be validated by the administrators. During this process we may ask you for an identity document (DNI, NIE or another equivalent document). This data is used exclusively to verify your identity, prevent fraud and ensure the security of transactions between users. It is not required if the administrators can validate you by other means. The legal basis is the legitimate interest of the platform and its users. The document is kept while your account remains active and is deleted together with the rest of your data if you request account closure.
4. Purpose and legal basis
Your data is used to manage your account and allow you to take part in auctions (legal basis: performance of a contract). We also use it to send you notifications about bids and auctions you take part in (legitimate interest). We do not transfer your data to third parties for commercial purposes.
5. External providers
To operate the platform we rely on the following data processors: Supabase Inc. (database and authentication, servers in the EU), Vercel Inc. (web hosting and anonymous traffic analytics), Resend Inc. (transactional email delivery) and Google LLC (web analytics configured without cookies and without personal identifiers).
6. International transfers
Vercel, Resend and Google are US companies. Data transfers to these providers take place under the Standard Contractual Clauses approved by the European Commission, guaranteeing a level of protection equivalent to that required by the GDPR.
7. Data retention
We keep your data while your account remains active. If you request the deletion of your account, we erase your personal data within a maximum of 30 days, unless there is a legal obligation to retain it.
8. Your rights
You have the right to access your data, rectify it, request its erasure, object to its processing, request the restriction of processing and obtain a portable copy of your data. You can exercise any of these rights by writing to toppalomas@gmail.com, stating your name, registration email and the right you wish to exercise.
9. Complaints before the AEPD
If you consider that the processing of your data is not appropriate, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
This is a courtesy translation. In case of discrepancy, the Spanish version prevails.