EnaJoin app privacy

When you enroll a child in an activity at app.enajoin.enacast.com, the data controller is the town that organises the activity (its name is shown on the catalog page). If you enroll in activities of more than one town, each town is responsible for its own enrollments.

En Antena Produccions SL (tax ID B62608229), the company that provides EnaJoin, is the data processor (GDPR art. 28): it runs the app on the town’s behalf under a data processing agreement and does not use the data for anything else. Contact: hola@enacast.com.

About the guardian: name, email, phone (if you give it), preferred language and your password (stored only as a bcrypt hash, never in plain text).

About each child: name, birth date, support needs and image-rights consent (yes or no).

The child’s health data: the medical information and allergies monitors need to know. This is a special category of data (GDPR art. 9): it is stored only if you tick the explicit consent checkbox, which is separate from everything else, and you only need to write what monitors need to know.

About the enrollment: activity and session, the exact time of the request (for first-come order), status, waitlist position, the discount requested and the supporting document you upload (residence certificate or large-family card).

About the payment: amount, order reference and status. You pay on the Redsys page of the town’s bank: EnaJoin never sees or stores card data.

Technical data: your connection IP address, to limit login attempts and protect signup against bots (for example, checking whether it is a Tor exit node), and the server’s technical logs.

Bot check (Cloudflare Turnstile): to tell people from bots and prevent automated submissions and abuse, the signup, login and password reset forms (and the town hall staff login) use Cloudflare Turnstile, a security service from Cloudflare, Inc. When you open one of these forms, Cloudflare processes your IP address and technical data about your browser and device (such as the user agent and TLS fingerprint). It sets no cookies on our domains.

Running the enrollment, waitlist, discounts and payment, and sending you the service emails (confirmations, waitlist promotions, password resets). Legal basis: the exercise of the town’s public powers in providing the service (GDPR art. 6.1.e) and the relationship you enter into when enrolling (GDPR art. 6.1.b).

Telling monitors about the child’s health and allergies, so they can look after them safely. Legal basis: your explicit consent (GDPR art. 9.2.a), which you can withdraw at any time by editing the child’s profile.

Image rights: your choice is shown on the monitors’ list. Legal basis: your consent (GDPR art. 6.1.a).

Service security (attempt limits, the Cloudflare Turnstile bot check, technical logs). Legal basis: security measures necessary to provide the service and protect the data (GDPR art. 32), under the same basis as the service (GDPR art. 6.1.e).

No automated decisions are made about anyone: places are allocated in order of arrival, and discounts are reviewed by municipal staff.

You, in your account, and the authenticated staff of the town that organises the activity. Monitors get the printed session list, not access to the app.

En Antena’s providers (sub-processors), who handle the data only to provide the service:

· OVH (hosting of the app, database and documents), in a data centre in Frankfurt (Germany).

· Resend, Inc. (sending the service emails), a United States company certified under the EU-US Data Privacy Framework.

· Backblaze, Inc. (daily database backups), in a United States region. This is an international data transfer: we are reviewing it, together with the mechanism covering it (European Commission standard contractual clauses or the EU-US Data Privacy Framework), and our aim is to keep these backups inside the EU.

· Cloudflare, Inc. (Turnstile bot check on the signup, login and password reset forms): processes your IP address and technical browser data. It acts as a processor and, when it uses these signals to improve its bot detection, as an independent controller; it may process the data outside the European Union under its data processing terms. More information: Turnstile privacy addendum.

We also count visits to the app with Umami, a cookieless analytics tool we host ourselves on a server in Austria, which only gives us aggregate figures.

The public catalog pages set no cookies: your chosen language is kept in the address or in browser storage. When you log in, the app sets a single session cookie, strictly necessary to keep you logged in, which is removed when you log out or when it expires. The Cloudflare Turnstile bot check on the signup, login and password reset forms sets no cookies on our domains. We use no advertising or tracking cookies.

Account and children: until you delete them yourself in the app (you can delete each child or the whole account).

Paid enrollments: when you delete your account, enrollments already paid are kept anonymised, without your name or the child’s, so the town can account for the payments.

Discount documents: today they are kept on the server until deletion is requested; automatic deletion at season end is on the roadmap. You can ask the town or us to delete them.

Backups: the database is backed up daily and the 14 most recent copies are kept, so deleted data can remain in those copies for up to about two weeks.

You can view and correct your data and your children’s in the app, and delete it too: each child separately or the whole account.

To exercise any other right (access, rectification, erasure, restriction, portability, objection or withdrawal of consent), contact the town that organises the activity. You can also write to us at hola@enacast.com: we will help and, if needed, pass the request on to the town.

If you believe your data has not been handled properly, you can complain to the Catalan Data Protection Authority (apdcat.gencat.cat) if the town is in Catalonia, or to the Spanish Data Protection Agency (aepd.es).

The family account must be created by an adult who is the legal guardian of the children they add. Children do not have their own accounts.