Privacy policy

The data controller for the personal data collected through this platform is Lignina SA, with CIF A67634006 and registered office at calle Manuel de Ossuna, 5, 38202 San Cristóbal de La Laguna, Santa Cruz de Tenerife, Spain. Registered on November 16, 2021, in the Commercial Registry of Santa Cruz de Tenerife, volume 3760, folio 151, section 8, sheet TF-66984.

For any questions regarding privacy or the exercise of the rights recognized in the General Data Protection Regulation, you can contact us at privacidad@lignina.com.

Lignina SA has not appointed a Data Protection Officer, as none of the mandatory conditions provided for in Article 37 of Regulation (EU) 2016/679 apply: we are not a public authority, our core activities do not require regular and systematic monitoring of data subjects on a large scale, and we do not process on a large scale special categories of personal data referred to in Article 9 of the Regulation.

For any inquiry or to exercise your rights, the enabled channel is privacidad@lignina.com.

When creating an account, we request the following data:

• Identifying, mandatory: first and last name, email address.
• Operational, mandatory: date of birth and country.
• Demographic, optional: sex, with the option "prefer not to say" as a valid response.

During the use of the platform, the data that the user themselves decides to provide —added books, reading statuses, reviews, lists, followers and following, social interactions— are also recorded, as well as certain technical data essential for providing the service: IP address, access logs, and strictly necessary cookies to maintain the session.

None of the data collected belongs to the special categories of Article 9 of Regulation (EU) 2016/679: no health data, ethnic origin, religious beliefs, trade union membership, sexual orientation, or other analogous data are processed.

We process each category of data with a specific purpose and legal basis, pursuant to Article 6 of Regulation (EU) 2016/679.

First and last name, email address

They are necessary to identify the user, create and manage their account, send essential transactional notifications (account verification, password recovery, security notices), and provide customer support. The legal basis is the performance of the service contract between the user and Lignina SA (Article 6.1.b).

Date of birth

It serves a dual purpose. On the one hand, it allows us to verify that the user meets the minimum age of sixteen that we require for registration, a criterion aligned with the default threshold of Article 8 of Regulation (EU) 2016/679 and applied uniformly across all jurisdictions where we operate; the legal basis for this use is the performance of a contract (Article 6.1.b). On the other hand, it is used to compile aggregated and anonymized statistics on the reading community; for this purpose, the legal basis is the legitimate interest of Lignina SA (Article 6.1.f).

Country

The user's country determines the default language of the service, the relevant catalog (translations and editions published in each region), local reading recommendations, and, where applicable, taxation. It is therefore structural data for the provision of the service; hence, providing it is mandatory during registration. The legal basis is the performance of a contract (Article 6.1.b).

Sex

It is exclusively used to compile aggregated and anonymized statistics about the reading community—reading patterns by age group, country, or sex—and to provide better initial recommendations when there is not yet a sufficient reading history on the account. This data is optional: the user may choose not to provide it or select "prefer not to say". The legal basis is legitimate interest (Article 6.1.f), which allows them to exercise their right to object at any time.

Platform usage data

Added books, reading statuses, reviews, lists, and social interactions are the core of the contracted service. Their processing is based on the performance of a contract (Article 6.1.b).

Technical data (IP address, access logs)

We process them to ensure platform security, prevent abuse, apply usage limits, and diagnose incidents. The legal basis is the legitimate interest of Lignina SA in maintaining a stable and protected service (Article 6.1.f).

Commercial communications

We do not send marketing communications. The emails we send are exclusively transactional or service-related: account verification, password recovery, account-related notices, and social notifications according to the settings chosen by each user. If commercial communications were to be considered in the future, explicit consent would be requested beforehand (Article 6.1.a).

Right to object

When processing is based on legitimate interest—date of birth for statistics, sex, technical data—the user can object at any time in accordance with Article 21 of Regulation (EU) 2016/679 by writing to privacidad@lignina.com. We will address the objection unless there are compelling legitimate grounds that override their interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

To provide the service, Lignina SA uses the following providers, who act as data processors:

• UpCloud Oy (Finnish Business ID 2431560-5), located at Aleksanterinkatu 15 B, 7th floor, 00100 Helsinki, Finlandia, as the provider for application and database hosting, as well as storage for user-uploaded files (e.g., avatars). The processing is carried out entirely within the European Union.
• Fastmail Pty Ltd (ACN 142 646 580), located at PO Box 234, Collins St West 8007, Australia, as the provider for sending transactional emails (account verification, password recovery, and account notices).

Outside the cases described and those where a legal obligation requires it, Lignina SA does not transfer or communicate personal data to third parties.

Sending transactional emails through Fastmail Pty Ltd involves a data transfer to Australia, a country that does not have a general adequacy decision from the European Commission applicable to this provider. This transfer is carried out under the Standard Contractual Clauses approved by the European Commission pursuant to Article 46.2.c of Regulation (EU) 2016/679, which offer adequate safeguards for the rights of data subjects.

The user may request additional information regarding the safeguards applied by writing to privacidad@lignina.com.

The hosting of the application, database, and files is provided by UpCloud Oy, headquartered in Finland, so this processing does not involve an international transfer.

Personal data is kept as long as the account remains active. An account is considered inactive if no logins are recorded for twenty-four consecutive months. From that moment, the following procedure applies:

• A first warning email is sent advising that the account will be deleted within thirty days if no action is taken, along with instructions to reactivate it or, if preferred, to download the data beforehand.
• Seven days before the scheduled deletion date, a second reminder email is sent.
• After thirty days, the account and all associated data are completely and irreversibly deleted: profile, credentials, first and last name, date of birth, country, sex, email, books, reading statuses, reviews, lists, social relationships, uploaded files (avatars and similar), and associated technical records. No anonymized copies are retained.

During that thirty-day grace period, the user can log in and expressly disable the scheduled deletion from their account dashboard. Deactivation requires an explicit confirmation action: mere access does not cancel the deletion, in order to prevent accidental extensions of effectively abandoned accounts.

Notwithstanding the above, the user can request the immediate deletion of their data at any time by exercising their right to erasure (Article 17 of the Regulation), without having to wait for the inactivity period.

Under Regulation (EU) 2016/679, the user has the right to:

• access their personal data and obtain information about the processing;
• rectify inaccurate or incomplete data;
• erase the data when they are no longer necessary or any of the other legal conditions apply;
• object to processing based on legitimate interest under the terms indicated above;
• request the restriction of processing in the cases provided for by law;
• receive their data in a structured, commonly used, and machine-readable format (portability).

These rights can be exercised by writing to privacidad@lignina.com, indicating the right to be exercised and including a copy of an identifying document when necessary to prove identity.

If the user considers that the processing of their personal data does not comply with regulations, they have the right to file a complaint with the Spanish Data Protection Agency, as the competent supervisory authority, at https://www.aepd.es.

The platform requires a minimum age of sixteen to register. Lignina is not directed at minors under that age and does not knowingly collect their data. If an account belonging to a person under sixteen were detected, we would proceed with its deletion. Parents or legal guardians who detect an improper registration can write to privacidad@lignina.com to request immediate deletion.

The platform only uses strictly necessary cookies for the operation of the service, especially to maintain the authenticated user's session. This type of cookies is exempt from the prior consent obligation. No third-party analytical, advertising, or tracking cookies are used.

Lignina SA may update this Privacy Policy when necessary. The date of the last update is shown at the beginning of the document. When changes substantially affect the rights of users, they will be communicated with reasonable advance notice by email or through a prominent notice on the platform.

For any questions regarding this Privacy Policy or the processing of personal data, you may write to us at privacidad@lignina.com.