GUAY Pasatiempos Privacy Policy

Version 1.0 · Effective 28 September 2026

1. Who is the data controller

The controller of the personal data described in this policy is:

• Owner: WEBSITESYSEO S.L. The tax ID (NIF) and company registration details are set out in the GUAY Pasatiempos Legal Notice.
• Registered address: Calle Antonio Rosón 1, 27002 Lugo (Spain).
• Email: info@websitesyseo.com, which is also the channel for any query about your data and for exercising your rights.
• Telephone: +34 982 990 610.
• Service: GUAY Pasatiempos, the games section of GUAY.news, on the website at guay.news/pasatiempos/ and within the GUAY.news apps for iOS and Android (the "Games").

We have not appointed a Data Protection Officer because we are not required to do so under Article 37 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Article 34 of Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), as explained in the general GUAY.news Privacy Policy.

2. What this policy applies to

This policy explains how we process your data when you use the Games: word search, sudoku, Quiz Guay, La Guay-labra, the daily challenge, the leaderboards, badges, streaks and public player profiles. It supplements the general GUAY.news Privacy Policy, which applies to anything not covered here (for example, browsing the newspaper, the newsletter or the shop). As regards the games, this policy prevails, being specific.

Our principles are the same as in the rest of the newspaper: to process as little data as possible, not to build advertising profiles, not to sell or share data for third-party marketing, not to use tracking cookies and not to train artificial intelligence models with your data.

3. What data we process and where it comes from

3.1. If you play as a guest

If you play without an account (levels 1 to 5), we do not store any of your personal data on our servers. Your progress is saved only on your device, in the local storage of the browser or the app (section 14). Our server only receives the technical data essential to deliver the game to you (like any website), which is processed in accordance with the general GUAY.news Privacy Policy, and, to apply request limits against abuse, a cryptographic hash of your IP address that is kept for a very short time.

3.2. If you create a player account

We process the following data, which you provide or which is generated when you play:

• Account data: player name (public and unique), email address, password, if you use one, stored only as a hash (an irreversible cryptographic digest, never in clear), avatar chosen from a predefined list (we do not upload photos of you), language, sign-up date and confirmation that you are 14 or older.
• Progress and achievements: levels completed, scores, stars, badges, streaks, positions on the leaderboards and, where applicable, places in the winners' record.
• Game data: game and level, start and end date and time, times, hints used, mistakes, answers, seed or board identifier, cryptographic signature (HMAC) of the game, result of the anti-cheat checks and, in Quiz Guay, which questions you have seen (so as not to repeat them).
• Technical and security data: the IP address, which we only store as a salted hash (a cryptographic digest combined with a secret value, from which the IP cannot be recovered) for anti-cheat and request limits; session tokens, of which we only store the hash; and the platform you play from (web, Android or iOS).
• Record of acceptances: version of the terms and rules accepted, date and time, IP address and user agent (browser or app and operating system) at the time of acceptance, and the source (website or app). This is the only place where we keep the full IP address, because of its evidential function.
• Magic link emails: if you choose to sign in without a password, we send you a single-use, short-lived sign-in link; we store its hash, its expiry and whether it has been used.
• Communications: the messages you send us (error or cheating reports, review requests, exercise of rights) and our replies.
• Reviews and penalties: if a game is flagged or a case is opened, the notes of the human review, the decision, its reasons and, where applicable, your request for review.

We do not process special categories of data (health, beliefs, etc.), we do not ask for your real name, date of birth, telephone number or location, we do not use advertising identifiers and we do not combine your game data with data from other sources to build profiles.

4. What we use your data for and on what legal basis

4.1. Managing your account and letting you play

Purpose: to create and maintain your account, authenticate you (with a password or magic link), save and synchronise your progress across devices, calculate your scores, manage the leaderboards, the winners' record, badges and streaks, display your public profile, avoid repeating questions and send you service communications.

Legal basis: performance of the contract you accept when you register, that is, the GUAY Pasatiempos Terms and Conditions (Article 6(1)(b) GDPR). Without this data we cannot provide the service with an account.

4.2. Anti-cheat, security and request limits

Purpose: to verify game signatures, detect non-human times and anomalous patterns, apply request limits, prevent fraud, unauthorised access and automation, review flagged games and, where applicable, apply the penalties provided for in the Participation and Prize Rules.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR), and that of other players, in fair leaderboards and a secure service. Balancing test: we use data already generated by playing, the IP address only as a salted hash, we keep the details for only 90 days, the automated system does not penalise by itself and a person always reviews; players reasonably expect a game with leaderboards to have anti-cheat controls. We consider that your rights do not override this interest, but you may object (section 11).

4.3. Aggregated statistics and improving the games

Purpose: to learn, on an aggregated basis, which games and levels are used most, which questions turn out to be too easy or too hard and where there are errors, in order to improve the games and balance their difficulty.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) in improving the service. Balancing test: the statistics are compiled with aggregated data, without identifying anyone in the results, without cookies and without third-party analytics tools, and individual game data is deleted after 90 days; the impact on your privacy is minimal. You may object.

4.4. Proof of your acceptance and defence against claims

Purpose: to prove that you accepted the terms and rules, which version and when, and to defend ourselves against possible claims.

Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR) where the rules require us to be able to prove consent or the information provided (for example, Article 7(1) GDPR and the rules on electronic contracting and consumer protection) and, in other cases, our legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).

4.5. Optional communications

Purpose: to send you, if you ask, game news, daily challenge reminders or streak alerts.

Legal basis: your consent (Article 6(1)(a) GDPR), which is optional, is requested with an unticked box and may be withdrawn at any time from your profile or with the unsubscribe link in each email, without affecting the lawfulness of previous processing. Push notifications, if you enable them in the app, also require your operating system's permission.

4.6. Cooperation with the authorities

Purpose: to respond to requests from courts, the Public Prosecutor's Office and law enforcement agencies and to report unlawful activities.

Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR) and, where appropriate, our legitimate interest in protecting the service and players (Article 6(1)(f) GDPR).

5. What is public and how to protect yourself

Leaderboards and player profiles are public by nature. Anyone, with or without an account, can see:

• your player name and your avatar;
• your badges and your streaks;
• your positions and points on the daily, weekly, monthly, annual, per-game and overall leaderboards, and in the winners' record;
• your public profile, at guay.news/pasatiempos/jugador/<your name>/, with a summary of the above.

We never show your email, your IP address, your detailed games or any other account data.

How to avoid being identified: do not use your real first name and surname or data that could locate you (town, year of birth, school, usernames on other networks) as your player name. You can change your name from your profile, within the limits of the Participation and Prize Rules. If you want to stop appearing, you can delete your account: your results will remain as "Deleted player". If you are a minor, we especially recommend that you use a pseudonym.

Public profiles may be indexed by search engines. If you want yours not to be indexed or you have any concern about its visibility, write to us.

6. How long we keep your data

• Account data, progress and achievements: while your account is active.
• Detailed logs of each game (times, hints, mistakes, answers, seeds, signature, IP hash): 90 days. After that we only keep the results you need (points, stars, levels, badges) and aggregated data that does not identify you.
• Quiz Guay questions seen: while the account is active, so as not to repeat them.
• IP hash for request limits: for the control window, which is minutes or hours; the one associated with games is deleted with them after 90 days.
• Session tokens: their hash is kept until you sign out or it expires. Magic links expire quickly, can only be used once and their record is deleted shortly after expiry.
• Flagged games and penalty files: for the duration of the review and, if there is a penalty, until six months after it is notified (the period for requesting its review) or until any pending claim is resolved.
• Inactive accounts: if you do not sign in or play for 23 months, we warn you by email; if it remains inactive, the account is deleted 24 months after the last activity.
• Winners' record: when an account is deleted (at your request or due to inactivity), your results on closed leaderboards and in the record are anonymised and appear as "Deleted player", without any data that identifies you.
• Record of acceptances: while the account is active and for up to 5 years after it is closed, blocked and only for defence against claims.
• Consent for optional communications: until you withdraw it and, thereafter, proof of the consent for the limitation period of possible liabilities.
• Backups: kept encrypted or protected with restricted access and overwritten on a 14-day cycle, so deleted data disappears from them within that period at most.

Where the law requires us to keep any data for longer, we will keep it blocked, available only to the authorities and the courts, in accordance with Article 32 of the LOPDGDD.

7. Who we share your data with

We do not sell or disclose your data to third parties, except where required by law (for example, following a court order or a request from law enforcement agencies). To provide the service we use providers that process data on our behalf, as processors, under a contract complying with Article 28 GDPR and only following our instructions:

• Hosting provider for the website and the database where accounts and games are stored.
• Email provider, to send magic links, service notices, inactivity warnings and, if you have asked for them, optional communications.
• Notification services of Apple and Google, only if you enable push notifications in the app.

Artificial intelligence providers: we use them only to help us generate questions and game content from news already published on GUAY.news. We do not send them any player data: no names, emails, games or answers. The questions generated are reviewed by the team before being published.

The specific identity of the hosting and email providers and their location are set out in the general GUAY.news Privacy Policy. The app stores (Apple App Store and Google Play) process app download data as independent controllers, under their own policies.

8. International transfers

We try to ensure that your player data is processed within the European Economic Area. If any provider processed data outside it, we would do so only with the safeguards in Chapter V GDPR (an adequacy decision, such as the EU-US Data Privacy Framework for certified providers, or the European Commission's standard contractual clauses). Details of each provider and the safeguards applied are set out in the general GUAY.news Privacy Policy. As stated, AI providers do not receive player data.

9. Automated decisions and the anti-cheat system

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.

The only relevant automated processing is automatic cheat detection. It works as follows:

• the system checks the HMAC signature of each game, the times (comparing them with reasonable minimum human times), the sequence of answers and activity patterns, and the number of requests per IP hash;
• if it finds something anomalous, it only flags the game as pending review; meanwhile, that game does not add points;
• a member of the team always reviews the flagged game before deciding. If it is valid, its points are added; if not, the measures in the Participation and Prize Rules apply;
• no penalty (cancellation of points, exclusion from leaderboards, suspension or blocking) is applied without that human review.

You have the right to obtain human intervention, to express your point of view and to contest the decision. You can do so by writing to info@websitesyseo.com. We will explain to you, in understandable terms, the criteria that led to the game being flagged, without revealing details that would allow the system to be circumvented.

The automatic calculation of scores and positions applies public rules that are the same for everyone and is a necessary consequence of the game you have chosen; it does not have legal or significant effects on you either.

10. Minors

To create a player account you must be at least 14 years old, the age from which you can consent yourself to the processing of your data under Article 7 of the LOPDGDD. The registration form asks you to confirm that you are 14 or older.

Children under 14 may only have an account with the consent of their parents or legal guardians, who must request it by writing to info@websitesyseo.com; we may ask for reasonable information to verify that the person consenting holds parental responsibility or guardianship. Without that consent they can play as guests, without us storing any of their personal data on our servers.

If we detect that an account belongs to a child under 14 without that consent (for example, because their parents tell us or because of the content of the account itself), we will suspend the account, notify the associated email and, if consent is not proven within a reasonable period, delete their data, anonymising their results as in any deletion. If you are a parent or guardian, you can ask us at any time for access to or deletion of the data of your child under 14.

If you are between 14 and 17, remember that your player name and your results are public: use a pseudonym. We will not ask you for more data than any other player.

11. Your rights

You may exercise the following rights at any time, free of charge:

• Access: to know what data of yours we process and obtain a copy.
• Rectification: to correct inaccurate or incomplete data. You can change your email, player name and avatar yourself from your profile.
• Erasure: to ask us to delete your data. You can delete your account directly from your profile, with the "Delete account" option, or ask us by email.
• Objection: to object to processing based on legitimate interest (anti-cheat, statistics), on grounds relating to your particular situation. Please note that if you object to anti-cheat processing, we may not be able to keep you on the leaderboards, because it is a condition for them being fair.
• Restriction: to ask us to suspend the processing of your data while its accuracy or your objection is being checked, among other cases.
• Portability: to receive the data you have provided to us and your progress data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Withdraw the consent you have given for optional communications, without affecting the lawfulness of prior processing.
• Not to be subject to automated decisions and to obtain human intervention, under section 9.

To exercise them, write to info@websitesyseo.com from the email associated with your account, stating your player name and the right you wish to exercise. If you write from another email address, we may ask you for additional information to verify your identity. We will reply within one month, which may be extended by two further months in complex cases, in which case we will inform you of the extension.

12. Complaint to the supervisory authority

If you consider that we have not properly dealt with your rights or that the processing of your data does not comply with the rules, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, through its electronic office at www.aepd.es. We would be grateful if you wrote to us first so that we can try to resolve it.

13. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including:

• all communications between your device and our servers are encrypted using HTTPS;
• passwords are stored only as a hash with a robust algorithm, never in clear, and we cannot see them;
• session tokens and magic link tokens are stored only as a hash, so that a database leak would not allow them to be used;
• IP addresses are stored as a salted hash, except in the record of acceptances;
• games are signed with HMAC to detect tampering;
• access to the data is limited to the team members who need it, with access logs;
• backups are encrypted or protected and rotated every 14 days.

If a personal data breach occurred that posed a risk to you, we would notify the AEPD within 72 hours and, where the risk is high, inform you without undue delay, in accordance with Articles 33 and 34 GDPR.

14. Local storage on your device

The Games do not use tracking, advertising or analytics cookies. They only store on your device, using the browser's local storage (localStorage) or the app's storage, the information essential for them to work:

• gp.token: your session identifier, so that you do not have to sign in on every page;
• your guest progress (levels, scores and settings), if you play without an account;
• offline games pending synchronisation, in the app, and your game preferences (sound, theme).

This storage is strictly necessary to provide the service you request and is exempt from consent under Article 22.2 of Spanish Law 34/2002 (LSSI). It is not shared with third parties or used to track you. You can delete it from your browser or app settings; if you do, your session will be closed and guest progress and unsynchronised games will be lost. You will find more information in the GUAY.news Cookie Policy.

15. Changes to this policy

We may update this policy when the games, the providers or the rules change. Each version has a number and a date, shown at the top. If the change is relevant (for example, a new processing operation or a new recipient), we will notify you with reasonable notice by email or in the Games themselves and, where the change requires your consent, we will ask for it. You can consult previous versions by asking us. This policy should be read together with the GUAY Pasatiempos Terms and Conditions and the Participation and Prize Rules.

This policy is available in Spanish and English. In the event of any discrepancy, the Spanish version prevails.