PRIVACY AND COOKIES POLICY
keda.social
Version 1.0 — 25 September 2026
English translation of the Spanish original. If there is any discrepancy between the two versions, the Spanish version prevails, without prejudice to the rights granted to consumers by applicable law.
This policy governs the processing of personal data and the use of cookies on the keda.social website, the informational portal announcing the launch of the KEDA app. It does not govern the KEDA app itself, nor the corporate website of ON PROJECT LABS, both of which have their own privacy policies.
1. Identity of the data controller
ON PROJECT LABS, S.L. (hereinafter, "ON PROJECT LABS" or "KEDA"), with tax ID B55466650 and registered office at Calle Sierra Nevada, 2, 18210 Peligros (Granada, Spain), is the controller of the personal data collected through the keda.social website (hereinafter, "the website").
You can contact us about any matter relating to this policy at hola@keda.social.
2. Data we collect and purpose of the processing
Through the waiting-list form available on the website we collect the following data, which you provide voluntarily: email address, type of use (whether KEDA interests you as someone looking for plans or as someone who creates and organises them), the leisure interests or categories you prefer (for example, sport, dancing or reading), and city.
In addition, when you access the website we process your IP address in order to work out approximately which city you are visiting from, for the sole purpose of pre-selecting it in the city selector on the page and showing you plans from that area rather than generic content. The inference is approximate, it does not identify your exact location, and you can change the city freely. It is resolved by our hosting provider from the headers of your own request: your IP address is not sent to any third party, no external geolocation service is involved, and we store neither the IP address nor the inferred city — they are used at the moment of the visit to decide what to show you and are then discarded.
We also use the Meta Pixel and the Meta Conversions API, measurement and advertising tools provided by Meta Platforms Ireland Limited, the company responsible for Facebook and Instagram in the European Economic Area. They are only activated if you accept advertising cookies in the settings panel. When you do, information about your visit is sent to Meta: the pages you view, the actions you take on the site — in particular, whether you complete the waiting-list form —, an identifier Meta assigns to your browser, your IP address and basic details about your device. Part of that information is sent from your browser and part directly from our server through the Conversions API, but in both cases it depends equally on your consent: if you do not give it, nothing is sent by either route.
If you have completed the form and accepted advertising cookies, the data sent to Meta also includes your email address, transformed beforehand by a cryptographic hash function. That transformation prevents the address from being read at a glance, but it does not make it anonymous data: its very purpose is to allow Meta to recognise you if you use Facebook or Instagram with that same email address, so in legal terms it remains personal data of yours, and we are telling you so plainly.
We process this data for the following purposes:
To manage your registration on the KEDA waiting list and to let you know when the app is available to you.
To tailor that communication to the profile (seeker/creator) and the interests you tell us about, for example so that we tell you first about the news most relevant to you.
To send you, with your consent, communications about the launch of KEDA and related news.
To show you content from your area, pre-selecting in the city selector the city inferred from your IP address.
To measure the effectiveness of our advertising campaigns on Facebook and Instagram: to know how many people reach the site from an advert and how many of them complete the waiting-list form.
To show you KEDA adverts on Facebook and Instagram if you have visited the website, and to avoid showing them to you once you have registered.
To know which advert you arrived from, so as to attribute your registration to the corresponding campaign and decide which campaigns to keep investing in. For this we keep, alongside your registration, the advertising source identifier that accompanies the link in the advert.
All the fields in the form are necessary in order to manage your waiting-list registration on the terms described here; without them we cannot process it.
When you submit the form you tick an acceptance box, not ticked by default, with the following wording: “I have read and accept the Privacy and Cookies Policy, and I want to receive by email the KEDA launch announcement and other news about the app.”
There is no additional box: we do not transfer your email address to third parties for inclusion in their own advertising lists, nor do we use it to build advertising audiences out of the waiting list. What happens with Meta is limited to what is described above and depends solely on your accepting advertising cookies, a decision you can change at any time from the cookie settings panel.
3. Legal basis for the processing
Your consent (art. 6.1.a GDPR) for registration on the waiting list, and your specific consent for sending electronic communications under art. 21 of the Spanish Information Society Services Act (LSSI), both obtained together through the box described in section 2.
Our legitimate interest (art. 6.1.f GDPR) in inferring your approximate city from your IP address, for the sole purpose of showing you content from your area. Since neither the IP address nor the inferred city is stored, and no information is accessed on your device, this processing requires no consent and does not depend on the cookie panel. You can object by writing to hola@keda.social and, in any event, change the city yourself at any time.
Your consent (art. 6.1.a GDPR) for advertising cookies and similar technologies, including the Meta Pixel and the Conversions API, which we obtain through the cookie settings panel. The installation of these technologies and access to information on your device are additionally governed by article 22.2 of the Spanish Information Society Services Act, which requires your prior consent.
Our legitimate interest (art. 6.1.f GDPR) in keeping, alongside your registration, the advertising source identifier that accompanies the link in the advert, for the sole purpose of knowing which campaigns work. You can object by writing to hola@keda.social, without this affecting your registration on the waiting list.
As regards the Meta Pixel and the Conversions API, ON PROJECT LABS and Meta Platforms Ireland Limited act as joint controllers within the meaning of article 26 GDPR, in respect of the collection of data on this website and its transmission to Meta. We have entered into the agreement that article requires with Meta, which allocates responsibilities as follows: we are responsible for obtaining your consent before activating the tool and for informing you as we are doing here, and Meta is responsible for its subsequent processing of that data and for the exercise of your rights against it. You may exercise your rights against either of us, but you should know that we have no effective control over what Meta does afterwards.
You may withdraw your consent at any time, without this affecting the lawfulness of processing carried out beforehand.
4. Retention period
We keep your data while you remain on the KEDA waiting list, until you decide to create an account in the app or until you withdraw your consent. If 24 months pass from your registration without any interaction and without your having created a KEDA account, we will delete your data, unless you decide to keep your registration active.
Neither the IP address nor the city inferred from it is kept anywhere. The only city we store is the one you type or confirm in the waiting-list form, as one more of its fields.
The data sent to Meta through the Pixel and the Conversions API is subject to Meta's own retention periods, which do not depend on us and which you can consult in its privacy policy. What is within our power, and what we do, is to stop sending it data as soon as you withdraw your consent to advertising cookies.
The advertising source identifier we keep alongside your registration follows the same period as the registration itself and disappears with it.
If you create an account in the KEDA app, your data as a user of the app becomes governed entirely by the KEDA app Privacy Policy, which corresponds to a separate processing activity: the data from your waiting-list registration is neither transferred nor reused in your new account. To stop receiving waiting-list communications you can unsubscribe using the link included in each of our emails, or write to us at hola@keda.social.
5. Recipients and data processors
ON PROJECT LABS does not disclose your personal data to third parties outside the organisation, except where required by law. The data you send through the form is received by an automation platform and distributed from there to the destinations described below. With all of these providers, which act as data processors, we have entered into the corresponding contract under article 28 GDPR:
Make — automation platform operated by Celonis SE, Theresienstraße 6, 80333 Munich (Germany), which receives the data sent from the website form and distributes it to the two destinations below. The scenario we use is hosted in Make's European region, so your data is stored and processed in the European Union, and the entity with which we have contracted the service is likewise domiciled in the European Union. This processing therefore does not in itself involve an international transfer of data. The processor contract we have entered into expressly provides that any onward transfer outside the European Economic Area is to be covered by the European Commission's Standard Contractual Clauses or by another safeguard permitted by law. Celonis SE holds an ISO/IEC 27001:2022 certificate whose scope expressly includes the Make service, valid until 16 March 2027. Make does not use your data for any purpose of its own.
Google Ireland Limited — Gordon House, Barrow Street, Dublin 4 (Ireland), as the contracting entity for the European Economic Area. It provides two distinct services on this website: on the one hand, the spreadsheet (Google Sheets, within our corporate Google Workspace account) in which the waiting-list registration is stored; on the other, web analytics (Google Analytics) and tag management (Google Tag Manager), the latter only if you accept analytics cookies in the cookie settings panel. Google may process data in the United States through Google LLC, which adheres to the EU-U.S. Data Privacy Framework and relies on Standard Contractual Clauses as a complementary safeguard. More information: https://policies.google.com/privacy/frameworks
The Rocket Science Group LLC d/b/a Mailchimp — 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 (United States), a company in the Intuit group. It handles sending the launch announcement and KEDA news to the people registered on the waiting list. As the entity is established in the United States, this processing does constitute an international transfer of data. It is covered, first, by Mailchimp's adherence to the EU-U.S. Data Privacy Framework, to which it is certified as a covered entity within the Intuit programme, and, in the alternative, by the European Commission's Standard Contractual Clauses, which its data processing addendum incorporates automatically should the Data Privacy Framework not cover the transfer or be invalidated. More information: https://mailchimp.com/help/mailchimp-european-data-transfers/
Vercel Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723 (United States). It provides the web hosting service for the keda.social site. Vercel Inc. adheres to the EU-U.S. Data Privacy Framework for transfers of personal data from the EEA. More information: https://vercel.com/legal/privacy-notice
Meta Platforms Ireland Limited — Merrion Road, Dublin 4 (Ireland). Unlike the above, Meta is not a processor acting on our instructions but a joint controller on the terms set out in section 3: it also processes the data it receives for its own purposes. Meta may process data in the United States through Meta Platforms, Inc., which adheres to the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a complementary safeguard. More information: https://www.facebook.com/privacy/policy
6. Rights of data subjects
Anyone has the right to obtain confirmation as to whether ON PROJECT LABS is processing their personal data and, if so, to exercise the following rights:
Access to their personal data.
Rectification of inaccurate data.
Erasure of their data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
Restriction of the processing of their data.
Objection to the processing, including processing for direct marketing purposes and processing based on our legitimate interest.
Data portability, in the cases provided for by law.
These rights may be exercised free of charge by email to hola@keda.social, attaching a copy of a document proving your identity. We will deal with your request within a maximum of one month. When you request erasure of your data, we will carry it out in the two destinations where it exists: the spreadsheet in which the waiting-list registration is stored and the email communications tool.
You are also informed of your right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with applicable law.
7. Accuracy of the data
The user declares that the data provided is accurate and undertakes to keep it up to date, notifying ON PROJECT LABS of any change.
8. Security measures
ON PROJECT LABS applies appropriate technical and organisational measures to guarantee the security, integrity and confidentiality of the personal data processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD). Access to the spreadsheet in which the waiting-list registration is stored is restricted to those people in the organisation who need to consult it.
9. Cookies Policy
The keda.social website uses its own and third-party cookies for the following purposes:
Technical or necessary cookies: essential for the website to work. They do not require consent.
Analytics cookies (Google Analytics, managed through Google Tag Manager): these allow us to know the number of visits and usage patterns of the website, in order to improve its content and reach. They are only installed after obtaining your consent.
Advertising cookies and similar technologies (Meta Pixel): these allow us to measure the effectiveness of our campaigns on Facebook and Instagram and to show you KEDA adverts on those platforms. They are only installed after obtaining your consent, and they are independent of the analytics ones: you can accept one and refuse the other. There are two: “_fbp”, which identifies your browser to Meta, and “_fbc”, which stores the identifier of the specific advert you arrived from. Both belong to Meta Platforms Ireland Limited and their declared duration is 90 days.
The inference of your city from your IP address described in section 2 is not carried out by means of cookies and does not involve storing information on your device, so it does not depend on the cookie settings panel; you can object to it as indicated in section 3.
Before installing any non-essential cookie, we show you a settings panel that lets you accept or refuse analytics cookies with the same ease and the same level of prominence for both options. You can access a "Cookie settings" panel at any time to change your original decision.
By accepting advertising cookies you also accept that, if you complete the form, we will tell Meta that you have done so, together with your email address protected by a hash function. That is what allows Meta to know which adverts work. No other data from the form is disclosed to it: not your interests, not your type of use, not your city.
Two further points about these cookies. The first is that the Meta Pixel is not loaded at any time before you accept it: its code is not downloaded, no cookie is installed and no data is sent. The second is that part of the information from the Conversions API leaves our server rather than your browser, so blocking cookies from the browser would not be enough to prevent it; that is why we have made it conditional on the same box in the panel, and if you do not accept it nothing is sent from our server either.
In addition, you can allow, block or delete cookies through your browser settings: Chrome, Firefox, Safari, Microsoft Edge.
For any questions about this cookies policy, you can contact us at hola@keda.social.
10. Relationship with the KEDA app Privacy Policy
This policy governs only the KEDA marketing website described in section 1. It does not replace the KEDA app Privacy Policy, which governs the processing of the data of users registered in the app. These are separate processing activities, with different tools and different people managing them: there is no transfer or reuse of the data from your waiting-list registration into your account in the app.
ON PROJECT LABS, S.L. — CIF B55466650 — Calle Sierra Nevada, 2, 18210 Peligros (Granada, Spain)