Privacy Policy

Privacy Policy

We operate in accordance with the principles set out below:

We undertake to comply with the statutory provisions on data protection and endeavor to always observe the principles of data avoidance and data minimization.

This Privacy Policy applies both to the Vocdoni App (app.vocdoni.io (fitxa berri batean irekitzen da)) and to the Vocdoni website (vocdoni.io (fitxa berri batean irekitzen da)).

The App includes additional processing activities related to registered users, administrators, and voting processes, while the Website is limited to general information and analytics purposes.

1. The Controller

2. For what purpose do we process your personal data?

When you visit our website, we only process minimal technical data (e.g., IP, browser, device type) necessary for its correct operation and analytics purposes.

We use Google Analytics (with anonymized IP addresses), Plausible.io and PostHog for analytics. Google Analytics and Plausible.io produce aggregated statistics. PostHog uses a randomly generated identifier which is pseudonymous rather than anonymous, and which we therefore treat as personal data. Google Analytics and PostHog are loaded only after you accept the cookie banner.

No personal data is collected for marketing purposes, and no profiling is performed.

We process your personal data to operate the Vocdoni App (hereinafter the «APPLICATION»), which provides secure, verifiable, and privacy-preserving voting and participation processes.

• (a) Administrators: process identification, contact, and authentication data to manage voting processes.
• (b) Voters: process credentials or access codes provided by their organization. Votes are recorded on the Vocdoni blockchain using cryptographic mechanisms ensuring anonymity.
• (c) Technical data: device, browser, and IP may be processed for security monitoring and fraud prevention, on the basis of our legitimate interest. Analytics are not covered by this item: they rely on your consent, as described in sections 3 and 9.

All processing follows the principle of data minimization: only the information strictly necessary to operate the service is collected. Sensitive data is stored in encrypted form to enhance confidentiality and protection.

3. Why can we process your personal data?

The processing of your data is legitimated on the basis of:

• Contractual necessity (Art. 6(1)(b) GDPR)
• Explicit consent (Art. 6(1)(a) GDPR) for optional features, including all analytics that store information on your device and the session recording described in section 9
• Legitimate interest (Art. 6(1)(f) GDPR) for security and fraud prevention

4. For how long will we keep your personal data?

• Data of registered users (administrators) and the data uploaded by them (e.g., membership lists) will be kept as long as they maintain their account and contractual relationship with Synergize SL, and thereafter during the applicable legal limitation periods.
• Voters' data remains within the organization's member list database and is never transferred outside of it. Credentials are used solely to generate an address that gives the right to vote and that is not linked to any personal data. Members' data will be retained for as long as the administrator maintains the member list or until the contractual relationship with Synergize SL comes to an end.
• Voters are obfuscated and stored on the blockchain in an immutable and permanent way, without any link to personal data.
• Analytics events are kept for 12 months. This period allows us to compare one year against the previous one, which is the purpose for which the data is collected.
• Session recordings in the Vocdoni App are kept for 30 days and are then deleted.

When data are no longer necessary for these purposes, they will be deleted with appropriate security measures for complete destruction.

5. To whom do we disclose your personal data?

Your personal data may be disclosed to:

• Public Administrations and authorities when legally required.
• Service providers that need access to personal data to deliver services to Synergize SL (e.g. payment processors, analytics). These providers act as processors under contracts that comply with Article 28.3 GDPR.

6. What are your rights as a registered user?

Your rights include the following, but are not limited to:

• Right to request information in accordance with Art. 15 GDPR
• Right to request rectification under Article 16 GDPR
• Right of deletion of your personal data, provided that further processing is not necessary for any of the reasons stated under Art. 17 GDPR
• Right to request the restriction of processing of your personal data for any of the reasons stated under Art. 18 GDPR
• Right of transmission of your data in a structured, commonly used, and machine-readable format.
• Right to revoke your consent at any time in accordance with Art. 7 (3) GDPR
• Right to file a complaint with the Spanish supervisory authority (www.aepd.es (fitxa berri batean irekitzen da)) if you consider that the processing does not comply with current legislation.

Contact information to exercise their rights:

Synergize SL. Jaume I, 65 (Local Esquerra) - 08470 Sant Celoni (Barcelona).
E-mail: dpo@vocdoni.org (fitxa berri batean irekitzen da)

7. Security measures

In accordance with the provisions of the current regulations on the protection of personal data, the CONTROLLER is complying with all the provisions of the GDPR and LOPDGDD regulations for processing the personal data for which they are responsible, and is manifestly complying with the principles described in Article 5 of the GDPR, by which they are processed in a lawful, fair and transparent manner in relation to the data subject and are appropriate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

Synergize SL guarantees that appropriate technical and organizational policies have been implemented to apply the security measures established by GDPR and LOPDGDD in order to protect the rights and freedoms of the users.

• All communications between the APPLICATION and servers are encrypted (HTTPS/TLS).
• Sensitive data (e.g. authentication credentials, membership lists) are stored in encrypted form.
• The design of the APPLICATION minimizes the collection of personal data, focusing on data strictly necessary for functionality.
• Votes are anonymized by design and recorded in the Vocdoni blockchain without any link to the voter's identity.

This Privacy Policy was released on 28 August 2026 and is effective as of that date. For more information on the guarantees of your privacy, you can contact Synergize SL at dpo@vocdoni.org (fitxa berri batean irekitzen da).

8. Data Protection Officer (DPO)

Synergize S.L. has appointed 4Dlegal S.L. as its Data Protection Officer (DPO) in accordance with Articles 37–39 of the GDPR.

You can contact the DPO at dpo@vocdoni.org (fitxa berri batean irekitzen da) regarding any questions, concerns, or requests related to personal data processing or the exercise of your data protection rights.

The DPO acts independently and reports to Synergize's senior management.

All communications received by the DPO are treated confidentially and will be responded to within one month, extendable by up to two additional months if necessary due to the complexity or number of requests.

9. Cookies and Tracking Technologies

Our website (vocdoni.io) and App (app.vocdoni.io) use a minimal number of cookies and tracking technologies:

Google Analytics – Used on vocdoni.io to collect aggregated statistics about website visits and usage. IP addresses are anonymized before storage. Google Analytics is provided by a third party, which sets its own cookies under its own privacy policy. It is loaded only after you accept the cookie banner.

Plausible.io – Used for privacy-friendly, cookie-free analytics on both the website and the App.

PostHog – Used on both vocdoni.io and app.vocdoni.io, and only after you accept the cookie banner. PostHog stores a randomly generated identifier in a cookie scoped to the vocdoni.io domain and its subdomains. Because the website and the App read the same identifier, we can tell that a visit to vocdoni.io and a later use of app.vocdoni.io come from the same visitor, which allows us to measure how people move between our website and our service. This identifier is pseudonymous: it does not identify you by name, but we treat it as personal data. It is not shared with any other website or third party. It is stored for 12 months. Data is hosted in the European Union and IP addresses are not collected.

Session recording – In the Vocdoni App only, and only for administrators and other authenticated users who have accepted the cookie banner, PostHog also records the session: the pages visited, clicks and movement on screen. All text and all form fields are masked. Masking is applied in your own browser, which means the masked content is never transmitted to PostHog and never leaves your device. The purpose is to identify and fix usability problems. Recordings are kept for 30 days and are then deleted; if a recording documents a specific problem it may exceptionally be kept while that problem is resolved, and in no case for longer than one year. Session recording is never active on the website vocdoni.io, is never active on voting pages, and voters are never recorded.

Consent record – A cookie named vocdoni-cookie-consent stores your choice on this banner. It is scoped to the vocdoni.io domain and its subdomains, so that a decision you make on the website applies in the App as well and you are not asked twice. It is stored for 12 months and records your choice, the date on which you made it, and the version of this policy in force at that time, identified by its revision date.

You can change or withdraw your choice at any time, with immediate effect on both vocdoni.io and app.vocdoni.io, through the Cookie settings link in the footer of every page, which reopens the banner. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out beforehand.

Cookies used:

Where the user support chat service is enabled, it sets additional cookies, which are described in section 9.1.

No marketing, profiling, or advertising cookies are used.

You may also disable cookies through your browser settings at any time, although the Cookie settings link described above is the more reliable way to withdraw consent, because it applies to both vocdoni.io and app.vocdoni.io.

10. Updates to this Policy

This Privacy Policy applies jointly to the Vocdoni App (app.vocdoni.io) and the Vocdoni website (vocdoni.io). It is reviewed periodically and whenever there are relevant legal, technical, or organizational changes affecting the processing of personal data.

Material updates will be communicated through the APPLICATION or by email to registered users and administrators.

Each version of the Policy will include its revision date and effective date.

Because this version introduces a new purpose - measuring the transition between our website and our service using a shared identifier - any cookie consent given before that date no longer covers all of the processing described here and has been invalidated. You will be asked for your choice again the next time you visit.

The current version was last reviewed on 28 August 2026.