Privacy Policy

At 28, we collect only the information reasonably necessary for the community to function securely. Depending on how you interact with 28, this may include:

• First and last name
• Email address
• Phone number
• Address or information necessary to validate residency
• Professional information, in the case of service providers
• Reviews, ratings, comments, or other information that you voluntarily publish through the platform

Certain technical information may also be generated when you access or use our services, including:

• Device type, browser, and operating system
• Date, time, and access logs
• Platform usage and pages visited
• Technical information necessary to operate and secure the service
• Cookies or similar technologies, where applicable
• Information processed through Vercel Analytics for statistical purposes and to understand and improve use of the Service

Residency verification is an essential element of 28.

We process the information reasonably necessary to confirm that access to the private platform is limited to verified residents through our controlled invitation system.

We do not require residents to provide identity documents, financial information, or real-time location information for this purpose.

Personal data may be processed to:

• Verify eligibility and residency
• Manage invitations and access to the private community
• Create and maintain user accounts
• Authenticate users
• Manage provider profiles
• Facilitate reviews, ratings, and other community features
• Operate, maintain, and secure the platform
• Prevent misuse or unauthorized access
• Provide support and respond to requests
• Comply with applicable legal obligations

On specific occasions, we may contact you by email or WhatsApp where reasonably necessary for the management of the community or in response to a request you have made.

We do not sell or rent personal information or provide personal information to third parties for their own advertising purposes.

Depending on the processing activity, we process personal data on one or more of the following legal bases:

• The provision of the Service and the relationship established when you request or use access to 28
• Taking steps at your request before providing access to the Service
• Our legitimate interests in operating, protecting, moderating, and maintaining a secure private community
• Compliance with applicable legal obligations
• Your consent, where consent is specifically required by law

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

To operate 28, we use specialized technology providers that may process limited personal data on our behalf.

These providers are used only where reasonably necessary to provide, host, secure, communicate through, or maintain our services.

These technology providers process information subject to their respective contractual and data protection obligations.

We do not authorize these providers to use personal information received from us for their own independent advertising purposes.

We seek to use infrastructure and data-processing arrangements appropriate for users located within the European Union.

Some technology providers or their subprocessors may nevertheless process certain information outside the European Economic Area.

Where personal data is subject to an international transfer, appropriate safeguards required under applicable data protection legislation will be used where necessary.

28 is designed as a private community.

• Resident profiles are not publicly visible.
• Provider profiles may be visible to verified residents of the community.
• Reviews and ratings published through the platform are visible exclusively within the private environment where applicable and only to verified residents.
• Information submitted privately for verification purposes is not displayed to other residents or service providers.
• VEINTIOCHO (28) may moderate, restrict, or remove content that violates applicable law or community standards.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Account information may generally be retained while your account remains active.

You may request deletion of your account and associated personal information at any time, subject to information that we are legally required or otherwise lawfully permitted to retain.

Inactive accounts may be periodically removed.

Information submitted through enquiries or access requests will be retained only for as long as reasonably necessary to process the request and maintain appropriate records.

Under the GDPR, you may have the right to:

• Access personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data
• Object to certain processing
• Request restriction of processing
• Receive certain personal data in a portable format
• Withdraw consent where processing is based on consent

You may exercise your rights by contacting us at:

We may need to verify your identity before fulfilling certain requests in order to prevent unauthorized access to personal information.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD).

28 may use cookies and similar technologies that are technically necessary for the operation, authentication, and security of the Service.

We also use Vercel Analytics to understand general usage and performance of the Service.

Where any technology requires consent under applicable law, we will request that consent before using it.

Additional information regarding cookies may be provided through our Cookie Policy where applicable.

Given the private nature of 28, protecting community information is a fundamental part of the Service.

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, or misuse.

These measures include controlled access to the platform, authentication mechanisms, access restrictions, and technical controls designed to limit access to information.

No internet-based system can guarantee absolute security.

We may disclose personal information where required to do so by applicable law, regulation, court order, or a lawful request from a competent public authority.

Where legally permitted, we will seek to limit any disclosure to the information reasonably necessary to comply with the applicable requirement.

VEINTIOCHO (28) does not sell, rent, or commercialize residents' personal data.

Our technology providers process information only as necessary to provide their respective services and subject to applicable contractual and legal requirements.

We may update this Privacy Policy from time to time to reflect changes to the Service, our technology providers, our processing activities, or applicable legal requirements.

The current version will always be made available through our website or Service.