PRIVACY AND COOKIES POLICY
keda.social
Version 1.1 — 24 October 2026
English translation of the Spanish original. If there is any discrepancy between the two versions, the Spanish version prevails, without prejudice to the rights granted to consumers by applicable law.
This policy governs the processing of personal data and the use of cookies on the keda.social website, the site announcing the launch of the KEDA app. It covers its two forms: the waiting-list registration form and the application form for the founding creators programme. It does not govern the KEDA app itself, nor the corporate website of ON PROJECT LABS, both of which have their own privacy policies.
1. Identity of the data controller
ON PROJECT LABS, S.L. (hereinafter, "ON PROJECT LABS" or "KEDA"), with tax ID B55466650 and registered office at Calle Sierra Nevada, 2, 18210 Peligros (Granada, Spain), is the controller of the personal data collected through the keda.social website (hereinafter, "the website").
You can contact us about any matter relating to this policy at hola@keda.social.
2. Data we collect and purpose of the processing
2.1. Waiting-list registration
Through the waiting-list form we collect the following data, which you provide voluntarily: email address, type of use (whether KEDA interests you as someone looking for plans or as someone who creates and organises them), the leisure interests or categories you prefer (for example, sport, dancing or reading), country and city. We also record the page of the website on which you fill in the form.
We process this data to manage your registration on the KEDA waiting list and to let you know when the app is available to you; to tailor that communication to the profile and interests you tell us about, for example so that we tell you first about the news most relevant to you; and to send you, with your consent, communications about the launch of KEDA and related news.
All the fields in the form are necessary in order to manage your registration; without them we cannot process it. When you submit it you tick an acceptance box, not ticked by default, with the following wording: “I have read and accept the Privacy and Cookies Policy, and I want to receive by email the KEDA launch announcement and other news about the app.”
2.2. Application to the founding creators programme
If you apply to the founding creators programme from the keda.social/fundadores page, we collect your name, your email address, the plans you organise or want to organise and how often, your previous experience organising, your city, the details of the first plan you would run on KEDA (title, day and approximate place) and the Instagram account or other contact method you give us. We also record the page from which you send the application.
We process this data to assess your application and to contact you about it. Every application is read by a person on our team: no decision is taken by automated means. The benefits of the programme are those described on that same page. If you are selected, what taking part involves — for example, appearing on the founders wall on the website or in KEDA stories — will be explained to you and, where needed, asked of you separately; it does not follow from sending the application.
All the fields are necessary in order to assess the application. When you submit it you tick a box, not ticked by default, with the following wording (in Spanish on the website): “I have read and accept the Privacy and Cookies Policy and I consent to Keda processing my data to assess my application to the founders programme and to contact me about it.”
2.3. How you reached the website (source data)
Together with your waiting-list registration or your application, we keep how you reached the website: the campaign tags that accompany the link you came in through — the parameters known as “UTM”, which show, for example, which campaign or which social network you come from —, the address of the page you entered on and that of the page you arrived from, known as the “referrer”. It tells us which campaigns and channels bring in registrations and applications, so we can decide which ones to keep investing in.
This data is not stored in your browser: it is read from the link when you arrive, kept only while the page is open and sent with the form if you complete it. Before sending it, we remove from it any click identifier added by advertising platforms (such as gclid, fbclid, ttclid or msclkid), so we keep no identifier that would allow those platforms to recognise you. We do not disclose it to any advertising platform.
2.4. Browsing the website
If you accept it in the cookie settings panel, we measure how many people visit the website and how they use it (analytics cookies) and whether our ads on Facebook and Instagram work (advertising cookies). We explain this in detail in section 9.
We do not transfer your email address to third parties, we do not disclose it to any advertising platform and we do not use it to build advertising audiences.
3. Legal basis for the processing
Waiting-list registration: your consent (art. 6.1.a GDPR) and, for sending electronic communications, the specific consent required by art. 21 of the Spanish Information Society Services Act (LSSI), both obtained together through the box described in section 2.1.
Application to the founding creators programme: your consent (art. 6.1.a GDPR), obtained through the box described in section 2.2.
Source data: our legitimate interest (art. 6.1.f GDPR) in knowing which campaigns and channels bring in registrations and applications. We consider it proportionate because it is limited to campaign tags and page addresses without click identifiers, nothing is stored in your browser and nothing is shared with any advertising platform. You can object by writing to hola@keda.social: we will delete that data from your registration or application without affecting anything else.
Analytics cookies and advertising cookies: your consent (art. 6.1.a GDPR), which we obtain separately for each category in the cookie settings panel. The installation of these technologies and access to information on your device are additionally governed by article 22.2 of the LSSI, which requires your prior consent.
As regards the Meta Pixel, ON PROJECT LABS and Meta Platforms Ireland Limited act as joint controllers within the meaning of article 26 GDPR, in respect of the collection of data on this website and its transmission to Meta. We have entered into the agreement that article requires with Meta, which allocates responsibilities as follows: we are responsible for obtaining your consent before activating the pixel and for informing you as we are doing here, and Meta is responsible for the subsequent processing it carries out with that data and for the exercise of your rights against it. You may exercise your rights against either of us, but you should know that we have no effective control over what Meta does afterwards.
You may withdraw your consent at any time, without this affecting the lawfulness of processing carried out beforehand.
4. Retention period
Waiting list: we keep your data while you remain on it, until you decide to create an account in the app or until you withdraw your consent. If 24 months pass from your registration without any interaction and without your having created a KEDA account, we will delete your data, unless you decide to keep your registration active.
Applications to the founding creators programme: if your application is not selected, we delete it 6 months after replying to you. If it is selected, we keep it while you take part in the programme. In both cases we delete it earlier if you withdraw your consent.
Source data: it follows the same period as the registration or application it accompanies, and disappears with it.
Google Analytics: browsing data is kept for the period we have configured in that service, which does not exceed 14 months.
Meta Pixel: the data Meta receives is subject to its own retention periods, which do not depend on us and which you can consult in its privacy policy. What is in our hands, and what we do, is stop sending it data as soon as you withdraw your consent to advertising cookies.
If you create an account in the KEDA app, your data as a user of the app becomes governed entirely by the KEDA app Privacy Policy, which corresponds to a separate processing activity: the data from your waiting-list registration or your application is neither transferred nor reused in your new account. To stop receiving waiting-list communications you can unsubscribe using the link included in each of our emails, or write to us at hola@keda.social.
5. Recipients and data processors
ON PROJECT LABS does not disclose your personal data to third parties outside the organisation, except where required by law. The data you send through the forms is received by an automation platform and distributed from there to the destinations described below. With all of these providers, which act as data processors, we have entered into the corresponding contract under article 28 GDPR:
Make — automation platform operated by Celonis SE, Theresienstraße 6, 80333 Munich (Germany), which receives the data sent from the website's two forms and distributes it to the spreadsheets and, in the case of the waiting list, to the email communications tool described below. The scenarios we use are hosted in Make's European region, so your data is stored and processed in the European Union, and the entity with which we have contracted the service is likewise domiciled in the European Union. This processing therefore does not in itself involve an international transfer of data. The processor contract we have entered into expressly provides that any onward transfer outside the European Economic Area is to be covered by the European Commission's Standard Contractual Clauses or by another safeguard permitted by law. Celonis SE holds an ISO/IEC 27001:2022 certificate whose scope expressly includes the Make service, valid until 16 March 2027. Make does not use your data for any purpose of its own and does not send anything to any advertising platform.
Google Ireland Limited — Gordon House, Barrow Street, Dublin 4 (Ireland), as the contracting entity for the European Economic Area. It provides two distinct services on this website: on the one hand, the spreadsheets (Google Sheets, within our corporate Google Workspace account) in which waiting-list registrations and applications are stored; on the other, web analytics (Google Analytics), the latter only if you accept analytics cookies in the cookie settings panel. Google may process data in the United States through Google LLC, which adheres to the EU-U.S. Data Privacy Framework and relies on Standard Contractual Clauses as a complementary safeguard. More information: https://policies.google.com/privacy/frameworks
The Rocket Science Group LLC d/b/a Mailchimp — 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 (United States), a company in the Intuit group. It handles sending the launch announcement and KEDA news to the people registered on the waiting list; it does not receive applications to the founders programme. As the entity is established in the United States, this processing does constitute an international transfer of data. It is covered, first, by Mailchimp's adherence to the EU-U.S. Data Privacy Framework, to which it is certified as a covered entity within the Intuit programme, and, in the alternative, by the European Commission's Standard Contractual Clauses, which its data processing addendum incorporates automatically should the Data Privacy Framework not cover the transfer or be invalidated. More information: https://mailchimp.com/help/mailchimp-european-data-transfers/
Vercel Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723 (United States). It provides the web hosting service for the keda.social site. Vercel Inc. adheres to the EU-U.S. Data Privacy Framework for transfers of personal data from the EEA. More information: https://vercel.com/legal/privacy-notice
Meta Platforms Ireland Limited — Merrion Road, Dublin 4 (Ireland), only if you accept advertising cookies. Unlike the providers above, Meta is not a data processor acting on our instructions but a joint controller on the terms set out in section 3: it also processes the data it receives for its own purposes. Meta may process data in the United States through Meta Platforms, Inc., which adheres to the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a complementary safeguard. More information: https://www.facebook.com/privacy/policy
6. Rights of data subjects
Anyone has the right to obtain confirmation as to whether ON PROJECT LABS is processing their personal data and, if so, to exercise the following rights:
Access to their personal data.
Rectification of inaccurate data.
Erasure of their data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
Restriction of the processing of their data.
Objection to the processing, including processing for direct marketing purposes and the processing of the source data described in section 2.3.
Data portability, in the cases provided for by law.
These rights may be exercised free of charge by email to hola@keda.social, attaching a copy of a document proving your identity. We will deal with your request within a maximum of one month. When you request erasure of your data, we will carry it out in every destination where it exists: the corresponding spreadsheet and, if you are on the waiting list, the email communications tool.
You are also informed of your right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with applicable law.
7. Accuracy of the data
The user declares that the data provided is accurate and undertakes to keep it up to date, notifying ON PROJECT LABS of any change.
8. Security measures
ON PROJECT LABS applies appropriate technical and organisational measures to guarantee the security, integrity and confidentiality of the personal data processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD). Access to the spreadsheets in which registrations and applications are stored is restricted to those people in the organisation who need to consult them.
9. Cookies Policy
The keda.social website uses the following cookies and similar technologies:
Technical or necessary: those essential for the website to work and for remembering your choice about cookies, which we keep in your browser's local storage. They do not require consent.
Analytics (Google Analytics): these allow us to know the number of visits and how the website is used. There are two cookies belonging to Google Ireland Limited: “_ga”, which distinguishes one user from another, and “_ga_<identifier>”, which keeps track of the session state, both with a duration of 2 years.
Advertising (Meta Pixel): these allow us to measure whether our ads on Facebook and Instagram work. They tell Meta which pages of the website you visit and, if you complete a form, that you have done so and from which page, together with an identifier that Meta assigns to your browser, your IP address and basic data about your device. We do not send Meta your email address or any other form data. There are two cookies belonging to Meta Platforms Ireland Limited: “_fbp”, which identifies your browser to Meta, and “_fbc”, which stores the identifier of the Meta ad you arrived from, if you arrived from one; their declared duration is 90 days. We do not use the pixel to build advertising audiences or to show you ads based on your visit.
Each category is accepted or refused separately: you can accept analytics cookies and refuse advertising cookies, or the other way round. Neither Google Analytics nor the Meta Pixel is loaded before you accept its category: its code is not downloaded, no cookie is installed and no data is sent. Neither of them goes through an intermediate tag manager. If you later withdraw your consent, we stop sending data and delete their cookies.
Before installing any non-essential cookie, we show you a panel that lets you accept or refuse them with the same ease and the same level of prominence for both options. You can open the “Cookie settings” at any time, from the footer of every page, to change your decision.
In addition, you can allow, block or delete cookies through your browser settings: Chrome, Firefox, Safari, Microsoft Edge.
For any questions about this cookies policy, you can contact us at hola@keda.social.
10. Relationship with the KEDA app Privacy Policy
This policy governs only the KEDA website described in section 1. It does not replace the KEDA app Privacy Policy, which governs the processing of the data of users registered in the app. These are separate processing activities, with different tools and different people managing them: there is no transfer or reuse of the data from your waiting-list registration or your application into your account in the app.
ON PROJECT LABS, S.L. — CIF B55466650 — Calle Sierra Nevada, 2, 18210 Peligros (Granada, Spain)