Privacy Notice

Last updated: 24/10/2026

This is the full privacy notice of Afinidad Política. It explains who processes your data, which data, for what purposes, how you can limit its use and how you can exercise your rights. It is written to comply with the European Union’s General Data Protection Regulation (GDPR), which applies because the controller is established in Spain, and with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, published in the Official Gazette of the Federation on 20 March 2025), in particular its Article 15.

1. Data controller

Controller: Fadrique Garcia Font
Spanish tax ID (NIF): 41572677Q
Address: Carrer Alfabeguera 12, 07687 S'Illot, Manacor (Illes Balears), Spain
Email: contacto@afinidadpolitica.mx

2. Data we collect

At Afinidad Política we take your privacy very seriously. That is why we have designed the test to collect as little data as possible:

2.1. What we do NOT ask you for

To take the test, we do not ask you for:

Your first name, surname or any other data that directly identifies you
Your email address (we only have it if you write to us or subscribe to the newsletter)
Phone number
Postal address
Payment details

2.2. What we DO store when you take the test

Test answers (sensitive data): Your answers and, in the full test, the importance you give to each question, together with your result. They are stored with a random identifier, without any data that directly identifies you.
IP hash: A hash of your IP address made with a secret key (HMAC), which cannot be used to recover the address, to detect abuse. It is deleted after 12 months. The IP address is never stored in plain text in the test database; the technical logs of the server and of Cloudflare keep it for a few days for security purposes.
Browser: The identifier of your browser and operating system (user agent), to detect abuse and automated tests. It is deleted after 12 months.
Approximate state and city: They are inferred from your IP address when you start the test, using a geolocation database installed on our own server, so the IP address does not leave it for this purpose. The state is used for aggregated statistics; the city is deleted after 12 months.
Session data: A technical cookie keeps your progress in the test and the language you choose.
Age group (optional): When you start the test you can, if you wish, give your age group (for example, 25–34). We never ask for your exact age or your date of birth. It is only used for aggregated statistics by age group and does not appear in your result or in the sharing link.
Sex (optional): At the start of the test, on the same screen as your age, you can say whether you are a man or a woman, or choose “Prefer not to say”. It is only used for aggregated statistics (for example, where women and men think differently) and does not appear in your result or in the sharing link.
Party you would vote for (optional) (sensitive data): When you finish the test you can, if you wish, tell us which party you would vote for in the election to the Chamber of Deputies on 6 June 2027. This is a political opinion and enjoys special protection. It is used to show you how it compares with your result (only you can see this, and it never appears in the sharing link) and for internal statistics. It is never published, not even added to other people’s answers: this website is not an opinion poll and does not publish voting preferences.

Your answers and the party you would vote for reveal political opinions, which are sensitive personal data under both the GDPR (Article 9) and the LFPDPPP (Article 2, section VI). That is why the test does not ask for anything that identifies you and stores them dissociated from your identity: no name, no email, no account and no IP address in plain text.

2.3. Other data, only if you give it to us

Emails you send us: If you write to us, your email address and the content of your message, so that we can reply.
Newsletter: If you subscribe, your email address and the details of your consent, in a list kept separate from your answers. We explain this under “Election news newsletter”.

3. What we use your data for

We only use the data to:

Calculate and show you your result
Show you, and only you, the comparison between the party you would vote for and your result and produce internal statistics that are never published
Allow you to share your result and compare it with other people’s, via a link with a random code
Produce aggregated, anonymous statistics on the topics of the test
Prevent abuse and keep the site secure
Reply to your emails and messages and, if you subscribe, send you the newsletter
Improve how the site works using usage statistics, if you accept analytics cookies

The first five purposes are needed to provide the test you ask for. Usage statistics and the newsletter are optional: they only take place if you give your consent (in the cookie panel or with the newsletter checkbox), and refusing does not affect the test in any way.

Our commitment regarding your answers

Political opinions are sensitive data (Article 9 GDPR and Article 2, section VI LFPDPPP). That is why we publicly commit to the following:

We never sell your individual answers or pass them on to anyone (not to parties, candidates, campaigns, governments, companies or the media), except where required by law or a court order.
We never use your answers to personalize advertising or to create advertising segments or profiles.
We only publish aggregated data on the topics of the test (for example, how many people agree with a statement in each state), always with a minimum of one hundred tests per cell, which prevents anyone from being identified.
If you tell us which party you would vote for, that information is never published individually and does not appear in your sharing link. It is not published added to other people’s answers either.

4. Legal basis for processing

We process your data on the following legal bases:

Express consent (Articles 6(1)(a) and 9(2)(a) GDPR; Articles 7 and 8 LFPDPPP): Your answers reveal political opinions. Before starting the test, by ticking the consent box, you expressly consent to our processing them to calculate your result and produce aggregated, anonymous statistics; we store the date you did so as a record. The test cannot be started without ticking it. Your age group, your sex and the party you would vote for are only stored if you give them. You can withdraw your consent at any time by writing to contacto@afinidadpolitica.mx.
Consent (Article 6(1)(a) GDPR): To send you the newsletter if you subscribe (by ticking its checkbox), and for analytics and advertising cookies, only if you accept them in the consent panel.
Legitimate interest (Article 6(1)(f) GDPR): To prevent abuse and fraud on the platform (IP hash and browser) and to reply to the emails and messages you send us.
Performance of a contract (Article 6(1)(b) GDPR): To process the purchase of a report and deliver it to you.
Legal obligation (Article 6(1)(c) GDPR): To keep data on donations and report purchases for as long as the law requires.

5. How long we keep the data

After 12 months a daily process deletes the IP hash, the browser and the city. After that, the answers, the result, the approximate state and, if you gave them, the age group, the sex and the declared vote are kept without those data, so that your link keeps working and for statistical series; you can ask for them to be deleted at any time.

Newsletter: until you unsubscribe.
Emails and messages: for as long as necessary to deal with them.
Aggregated statistics, which do not allow anyone to be identified: may be kept indefinitely.

6. How you can limit the use of your data

Besides your rights (next sections), you have these simple options:

Do not answer the optional questions (age group, sex and the party you would vote for): the test works the same without them.
Reject analytics cookies, or withdraw your consent later, from the cookie policy.
Unsubscribe from the newsletter with the link in any email; this deletes your address completely.
Send us your sharing link and ask us to delete your result.

7. Who else processes your data

We do not sell or pass on your data. The following providers are involved in running the site:

Hetzner Online GmbH: Hosting of the site and the database, on servers located in Finland (European Union). Encrypted backups are kept in Germany.
Cloudflare, Inc.: Content delivery and security network through which all visits pass, including your IP address and the answers you submit. It keeps temporary copies of public pages, including shared results, for up to 24 hours. It also receives email sent to contacto@afinidadpolitica.mx and forwards it to Gmail. In addition, Cloudflare Web Analytics counts, without cookies and without identifying visitors, how many times pages are viewed and where visitors come from (referring site, country, browser); it does not store IP addresses for this.
Google: Only with your consent, Google Analytics receives your IP address (it is not stored) and the pages you view, but never the test questions, results, comparison or tie-break pages. The Google AdSense ad script is never loaded in the test, in your result, in shared results or in the comparison tool. With your consent, Google may share your full IP address with advertisers bidding to show the ads.
Gmail (Google): Email sent to contacto@afinidadpolitica.mx is forwarded to a Gmail account, from which we read and reply to it.
Brevo (France): Sends the site’s emails and our replies from contacto@afinidadpolitica.mx. To do so it receives your email address and the content of the message. It is a European Union company, based in France.

8. Transfers

Cloudflare and Google are based in the United States and participate in the EU–US Data Privacy Framework, which the European Commission considers to ensure an adequate level of protection for data transferred to that country. If payments (Stripe, based in the United States and participating in the same framework) or donations (Ko-fi, based in the United Kingdom, which has an adequacy decision from the European Commission) are ever activated, the same will apply.

For the purposes of the LFPDPPP, we do not transfer your data to third parties: the providers listed above either process it on our behalf, as processors (“personas encargadas”, Article 2, section XII), or act as independent controllers of the data you give them directly when you use their services (Ko-fi, PayPal, Stripe, Instagram). If a transfer requiring your consent were ever needed, we would ask for it first, as required by Article 35.

9. Your sharing link

Your result has its own link with a random code. Anyone with your link will see your result and how closely you match the parties, but never your age, your sex or the party you would vote for. The link does not expire; if you want us to delete it, send it to us.

If you voluntarily subscribe to the email notifications, ticking the consent checkbox, we store your address, the language, and the date and version of the consent text you accepted. Your email address is stored in a separate list, with no link to your test answers, and is only used to send you those notifications. All mailings are identical for the whole list: we never segment by ideology. You can unsubscribe using the link in any email; unsubscribing deletes your address completely.

11. Your rights

Under the GDPR and the LFPDPPP, you have the right to:

Access: Find out what data we hold about you.
Rectification: Correct inaccurate data.
Erasure (cancellation): Request the deletion of your data.
Restriction: Ask us to restrict the processing.
Portability: Receive your data in a structured format.
Objection: Object to the processing of your data.
Withdraw consent: Withdraw it at any time, without affecting the lawfulness of processing carried out before.

Because the data is pseudonymous (we do not store your IP address, only a keyed hash that cannot be used to recover it), we may not be able to locate your specific answers. If you wish to exercise your rights, contact us at contacto@afinidadpolitica.mx.

12. How to exercise your ARCO rights

In Mexico, the rights of access, rectification, cancellation and objection are known as ARCO rights. To exercise them, or to revoke your consent:

Write to contacto@afinidadpolitica.mx with your name and an address or other means where we can reply, a description of the data and of the right you wish to exercise, and anything that helps us find the data (for example, your sharing link). If you ask for access or for data linked to your email address, we may ask you to confirm that the address is yours.
We will tell you our decision within a maximum of 20 business days of receiving your request and, if it is upheld, we will apply it within the following 15 business days (Article 31 LFPDPPP).
Exercising these rights is free of charge (Article 34 LFPDPPP).
Revoking your consent works the same way, through the same address, and has no retroactive effect (Article 7 LFPDPPP).

13. Cookies and tracking technologies

We use technical cookies and, only if you accept them, analytics cookies from Google Analytics, which collect browsing data (pages viewed, device, approximate location). The cookie policy explains which cookies are set, what data they collect, what they are for and how to disable them, including from your browser.

14. Security

We implement technical and organizational measures to protect your data:

Encrypted connection via HTTPS/SSL
Hashing of IP addresses with a secret key (HMAC) and scheduled automatic deletion
Restricted access to the database
Regular backups

15. Minors

This test is intended for people aged 16 or over. We do not knowingly collect data from anyone under 16.

16. Changes to this privacy notice

We may amend this privacy notice. Any change will be published on this page with the date of the update at the top, and if it affects the newsletter in any substantial way, we will also tell subscribers by email.

17. Contact and complaints

For any privacy queries, contact us at contacto@afinidadpolitica.mx.

You can also lodge a complaint with the Agencia Española de Protección de Datos (AEPD), the Spanish data protection authority, which is the lead supervisory authority because the controller is established in Spain.

In Mexico, the authority responsible for the LFPDPPP is the Secretaría Anticorrupción y Buen Gobierno. If you are not satisfied with our reply to an ARCO request, or if you do not receive one in time, you can file a data protection request with it (Article 40 LFPDPPP).