Privacy Policy

1. Identity of the Data Controller

The data controller responsible for the processing of personal data on this platform is:

Wonderteamjumble Editorial Media SL
Spanish Company Identification Code (CIF): ESB-08942177
Registered Corporate Office: Passeig de Gràcia 38-40, Eixample, 08007 Barcelona, Spain
Contact Email: [email protected]
Designated Data Protection Officer (DPO): [email protected]

2. Categories of Data Collected

We collect and process only the minimal personal information necessary to deliver high-quality editorial content, answer reader concierge inquiries, and sustain web infrastructure performance:

• Voluntarily Provided Information: When you complete our inquiry or contact forms, we collect your name, email address, inquiry topic, and message content.
• Technical and Device Data: When accessing the website, our web servers log standard internet telemetry including IP address (anonymized prior to storage), browser user-agent string, operating system version, referring URLs, date/time stamps, and page request counts.
• Cookie and Local Storage Preferences: Records of consent preferences stored locally on your device to remember banner dismissals and functional choices.

3. Legal Bases for Processing Under GDPR

We process your personal data under the following lawful bases established in Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): For non-essential analytics cookies, functional preferences, or voluntary newsletter communications where explicit consent is requested.
• Legitimate Interests (Art. 6(1)(f)): To monitor server integrity, defend against malicious cyberattacks or denial-of-service attempts, and analyze aggregated readership trends to improve site architecture.
• Pre-Contractual and Contractual Steps (Art. 6(1)(b)): Responding to specific concierge or editorial inquiries submitted through our contact form.

4. Third-Party Data Processors

Wonderteamjumble does not sell, lease, or trade personal data to marketing brokers. We employ contracted third-party processors adhering to strict technical and organizational measures (TOMs):

• Cloud Hosting & CDN Providers: Data center operators located inside the European Economic Area (EEA) providing static file distribution, TLS encryption, and firewall security.
• Email Delivery Infrastructure: Cloud SMTP relays operating under standard contractual clauses (SCCs) to transmit inquiries securely to our Barcelona editorial desk.

5. Your Rights Under European and International Law

Under Articles 15 through 22 of the GDPR and California Consumer Privacy Act (CCPA) provisions, visitors possess the following enforceable rights:

• Right of Access: You may request a verified copy of all personal data held concerning your identity.
• Right to Rectification: You may correct inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your inquiry records when retention is no longer justified by law.
• Right to Restriction and Objection: You may object to data processing grounded in legitimate interests or request processing restrictions.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format.
• Right to Withdraw Consent: Consent granted for cookies or communication may be retracted at any moment without retroactive penalties.

To exercise any of these statutory rights, transmit an authenticated request to our Data Protection Officer at [email protected]. We respond to all formal requests within thirty (30) calendar days. You also maintain the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD, www.aepd.es).

6. Retention Schedules

Inquiry correspondence submitted via our contact portal is retained for a maximum duration of twenty-four (24) months from resolution, after which it is permanently purged from active systems. Anonymized web telemetry logs are rotated and permanently removed every ninety (90) days.

7. Security Measures

Our web infrastructure enforces modern transport layer security (TLS 1.3), hardened HTTP response headers (Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options), and restricted physical access to database instances.