SponsorPrivacy notice
This is a translation. The Spanish version prevails.
This page explains what SponsorSheep does with the data of anyone who joins its network, whether through an event's form, through sponsorsheep.eu or by replying to SponsorSheep. There is a short version, the basic layer, shown next to the tick box, and this one, the additional layer, with all the detail (Article 13 GDPR and Article 11 LOPDGDD).
Basic layer
| Controller | Ottobaum OÜ, trading as SponsorSheep. If the person joins through an event's form, the event is joint controller for that collection |
|---|---|
| Purpose | Sending the person brand offers in the categories they choose, as often as they decide (until they say, one a month at most), and tailoring them to what they themselves tell us in the profile questions. Passing their contact details to a brand only if they accept an offer from that brand |
| Legal basis | The person's consent, given separately for the network, for each channel, for the profile questions and for each offer accepted |
| Recipients | No brand receives personal data except the brand whose offer the person accepts. Technical providers that process data on behalf of SponsorSheep. The data are stored in the EU; some providers are from the US, with the safeguards explained in the additional information |
| Rights | To access, rectify and erase the data, to object, to restrict processing, to port them, to withdraw consent and not to be subject to automated decisions, by writing to [email protected] or by replying BAJA to any message |
| Additional information | https://sponsorsheep.eu/privacidad |
Additional layer
1. Who the controller is
| Controller | Ottobaum OÜ, a private limited company registered in the Estonian Commercial Register, trading under the SponsorSheep brand |
|---|---|
| Registry code (Estonia) | 16536820 |
| Spanish non-resident tax ID (NIF) | N0411820D |
| VAT number | EE102577855 |
| Tax address | Ahtri tn 12, 10151 Tallinn, Estonia |
| Contact, including for data protection | [email protected] |
Articles 13.1.a and 13.1.b of the GDPR and Article 10 of the LSSI (Spanish Information Society Services Act).
2. The event's role
Anyone who signs up on sponsorsheep.eu joins directly: there is no event involved and SponsorSheep is the sole controller.
Anyone who joins the network through an event's form has, for that collection, two controllers: the event and SponsorSheep, who are joint controllers (Article 26 GDPR). The event puts the tick box in its registration form and receives compensation for sign-ups and for offers accepted by its community. SponsorSheep decides everything that happens after sign-up.
The essence of the arrangement between them, which Article 26.2 requires to be made available to the person:
- SponsorSheep provides the information, keeps the proof of consent, sends the offers, handles rights requests and is responsible for the security of the network.
- The event places the tick box unticked and without changing its wording, does not make registration conditional on ticking it, and forwards to SponsorSheep any request about the network it receives.
- The event does not receive the profile answers and does not know which offers each person accepts. It receives aggregate figures and its compensation.
- The person can exercise their rights against either of the two (Article 26.3 of the GDPR). The point of contact is [email protected].
The event registration data (name, category, payment, bib number and so on) belong to the event and are governed by its own policy. This notice covers only the SponsorSheep network.
3. What the data are used for and on what basis
| Purpose | What data | Legal basis |
|---|---|---|
| Belonging to the network: signing the person up, confirming their email or phone number and keeping proof of their consent | Name, email, phone, where they signed up (the event or the website), the role in which they attend events (competing, watching or cheering, volunteering, going with family or coaching), province, year of birth, sports, chosen categories, chosen channels, preferred channel, how many offers a month they want (they say so when replying to the first message), confirmation that they are 18 or over, date, time, IP address, country of connection, browser, language and version of the text accepted | Consent, Article 6.1.a of the GDPR. Proof of consent is kept because of the obligation to be able to demonstrate it, Articles 5.2 and 7.1 of the GDPR, in conjunction with Article 6.1.c |
| Profile questions: asking voluntary questions and keeping the answers in order to tailor the offers | The answers the person gives, item by item, with the date | Specific consent for the profile, Article 6.1.a of the GDPR |
| Sending offers: selecting who each offer suits and sending it through the chosen channel | Categories, channels, profile data, sending history | Consent per channel, Article 6.1.a of the GDPR and Article 21.1 of the LSSI |
| Passing the contact details to a brand, only when the person accepts its offer | Name, email, phone number and proof of acceptance | Specific consent for that offer and that brand, Article 6.1.a of the GDPR |
| Paying the event its compensation | Number of verified sign-ups and acceptances per event, without contact details | Legitimate interest in performing the contract with the event, Article 6.1.f of the GDPR, and accounting obligation, Article 6.1.c |
| Honouring opt-outs: preventing anyone who has opted out from rejoining through another event without asking again | An irreversible fingerprint (hash) of the email address and the phone number: a code from which neither the email nor the phone number can be recovered | Obligation not to process the data again for marketing after an objection, Article 21.3 of the GDPR, in conjunction with Article 6.1.c |
4. Profiling
SponsorSheep builds a profile of each person who ticked the questions box (Article 4(4) GDPR). The profile has three levels: sign-up, habits (which sport they do or follow, what they use, where they shop) and intent (what they plan to buy, their next competition).
What the person needs to know (Article 13.2.f of the GDPR):
- Every piece of data comes from the person. Nothing is inferred, bought or matched with other sources. What they do not answer does not exist in their profile.
- What it is for: deciding which offer suits them. The consequence is that they receive an offer or they do not. No different price is set and no service is refused, and the profile produces no legal effects on the person and does not significantly affect them. That is why it is not a decision under Article 22 GDPR.
- Every offer is reviewed by a person on the SponsorSheep team before it is sent.
- Brands do not see individual profiles. They only see groups of 50 people or more, without names or contact details.
- The person can object to the profile at any time and without giving reasons (Articles 21(2) and 21(3) GDPR). Their answers are then deleted and, if they wish, they keep receiving offers by category.
5. Rewards
SponsorSheep gives no rewards for joining the network or for answering. The benefits of each offer are provided by the brand making it. Anyone who does not answer loses nothing (Article 7.4 of the GDPR).
6. Whether providing the data is mandatory
No. Joining the network is optional and, when done through an event, changes nothing about the registration. Anyone who does not tick the box does not join the network. Only people aged 18 or over can join. Anyone who does not answer a question receives less tailored offers, and nothing else (Article 13(2)(e) GDPR).
7. Who receives the data
Brands. Only the brand whose offer the person accepts, and only their name, email and phone number. From that moment that brand is an independent controller of that data, and SponsorSheep contractually requires it to use the data only for that offer, not to share it with anyone or combine it with other data, and to delete it if the person asks. The brand categories are: nutrition and drinks; sportswear, footwear and sports technology; health and insurance; banking and finance; mobility and travel; and telecoms.
Events. They receive no network data: only aggregate figures.
Providers that process data on behalf of SponsorSheep (processors, Article 28 of the GDPR):
| Provider | What for | Where the data are stored |
|---|---|---|
| Cloudflare, Inc. | The website, the sign-up form and the store of sign-ups | In the EU: Cloudflare keeps that store on EU servers only |
| Tally BV | The forms of the events that use it | Belgium, EU |
| Meta Platforms Ireland Ltd. | WhatsApp messages, once activated | US, or the EU if Meta's local storage option is enabled |
| Resend (Plus Five Five, Inc.) | Confirmation and offer emails, once activated | US |
Authorities, when required by law.
8. Transfers outside the EU
Sign-ups are stored in the EU. Some providers in the table above are US companies or have their sub-processors there, and may access the data from there. In those cases, the transfer relies on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) if the provider has signed up to it, or on the Commission's standard contractual clauses (Articles 13.1.f, 45 and 46 of the GDPR).
9. How long the data are kept
| Data | Period |
|---|---|
| Profile and contact details | Until the person unsubscribes, or for up to 24 months without replying to any message or using any of their links, whichever comes first |
| Unconfirmed email or phone number | 30 days from sign-up |
| Proof of consent and of opt-out | While the person is in the network and, after that, set aside and unused (blocked, in legal terms) for three years at most, the period in which infringements lapse, solely to defend SponsorSheep against a claim (Article 32 LOPDGDD) |
| Erasure fingerprint of the email and phone number | While the network exists, so that the opt-out is honoured at every event |
| Contact file delivered to a brand | Deleted from SponsorSheep within 30 days of delivery |
| Data for paying events, without contact details | Six years, under the accounting obligation of Article 30 of the Spanish Commercial Code |
Article 13.2.a of the GDPR.
10. The person's rights
They can, at any time and free of charge (Articles 15 to 22 of the GDPR):
- access their data and know what is done with them;
- rectify them if they are wrong;
- erase them;
- restrict their processing;
- take them to another service, in a commonly used format (portability);
- object to receiving offers or to the profile, without having to give reasons;
- withdraw consent for a category, a channel, the profile or everything, without affecting what was done before (Article 7(3) GDPR).
How:
- by writing to [email protected];
- by replying BAJA (Spanish for "unsubscribe") to any message, by WhatsApp or by email. Unsubscribing also deletes their contact details and their answers; only the proof of consent and of the unsubscription is kept, as explained in section 9;
- with the unsubscribe link in any email;
- or through the event, which forwards it to SponsorSheep.
SponsorSheep replies within one month at most (Article 12(3) GDPR). It only asks the person to prove their identity if there are reasonable doubts about who is writing (Article 12(6) GDPR).
Opting out applies to the whole network: anyone who leaves no longer receives offers even if they register for another event in the network, unless they expressly ask again.
11. Complaining to the authority
If the person believes their rights have not been respected, they can lodge a complaint with the Spanish Data Protection Agency (AEPD), at www.aepd.es (Article 13.2.d and Article 77 of the GDPR). Before that, if they wish, they can write to [email protected].
12. Security
Sign-ups from the website are stored encrypted in a Cloudflare store limited to EU servers, which only SponsorSheep can access. Once moved into the network's database, the email and phone number are stored encrypted and separately from the profile, and are only opened to pass a contact to the brand whose offer the person accepted; the consent record cannot be changed or deleted; and every query by every brand is logged (Article 32 GDPR).
13. Changes to this notice
If anything changes that affects what the person consented to, SponsorSheep tells them before applying it and, if necessary, asks for their consent again.
Version 2, 2 October 2026.