Privacy policy

We process little data and only what is needed. This policy follows Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018.

1. Controller

Alfredo Domenech Nadal (20023606J) · Plaza España nº 7, 5º, Gandia · gestion@topandflop.com. Privacy contact: gestion@topandflop.com.

2. Data, purposes and legal bases

Votes and orders

• Data: email, alias and comment (optional), item voted, direction (TOP/FLOP), amount, payment status, gateway payment ID, approximate country, accepted terms version and time of consent, and a technical identifier derived from your IP (a keyed hash that cannot be reversed to the IP).
• Purpose: provide the service, send your receipt or contact you about issues, prove your consent and meet accounting and tax duties.
• Legal basis: performance of the contract (art. 6(1)(b) GDPR) and legal obligation (art. 6(1)(c)).

Payments

Payments are handled by Stripe, PayPal and Dodo Payments on their own pages. We do not receive or store your card data or credentials. They are responsible for that data under their policies. We only receive the confirmation, amount and a transaction ID.

Public aliases and comments

Published after moderation. Legal basis: contract and your request to publish them.

Cookie-less visit statistics

We count visits to understand how the site is used, without cookies and without storing your IP: we store an identifier that rotates daily (keyed hash of IP and browser), the page, the referring site, device type and the country indicated by the network. Bots are counted separately. We honour Do Not Track (DNT) and Global Privacy Control signals. Legal basis: legitimate interest (art. 6(1)(f)) in understanding and improving the service with minimal privacy impact. Maximum retention: 400 days.

Security and fraud prevention

We log abnormal access attempts, rate limiting and blocks, with the IP masked (last part removed) and its hash. Legal basis: legitimate interest in security. Retention: 90 days.

Suggestions and content notices

Data you send (email, name, explanation) is used to handle your request and comply with the Digital Services Act. Retention: while processed and up to 1 year afterwards.

3. Recipients and processors

• Payment providers: Stripe Payments Europe, Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and Dodo Payments.
• Hosting and server maintenance provider.
• Telegram, for internal notices to the owner (amount, item and alias of a vote; never your email or payment data).
• Public authorities where legally required.

Some providers may process data outside the European Economic Area; in that case they rely on adequacy decisions or standard contractual clauses.

4. Retention

Orders and invoicing: as long as commercial and tax law requires (up to 6 years). Everything else as stated above. Afterwards data is blocked or deleted.

5. Your rights

You may exercise access, rectification, erasure, objection, restriction and portability by writing to gestion@topandflop.com, identifying your order. We may ask you to prove your identity. If you think we have not handled your rights properly you may complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

6. Automated decisions and minors

We take no automated decisions with legal effects. The service is for people aged 18 or over.

7. Security

Encrypted connection, hashed passwords, two-factor authentication in the back office, encrypted gateway keys, webhook signature verification, rate limiting, audit log and data minimisation.

Last reviewed: 2026-09-20.