Privacy Policy

Versión en español: Política de privacidad

Last updated: 19 September 2026

We only ask for the data we need, and we only use it for the purposes explained here. This Privacy Policy describes how SHERPA71 handles the personal data you share through this website, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). This policy is also available in Spanish; both versions have the same content.

1. Who is responsible for your data

Data controller: Rankof Sport Rankings LLC, trading as SHERPA71
Legal form: limited liability company (LLC) incorporated in the United States
Tax identification number: EIN 32-0790435 (US Employer Identification Number)
Establishment in Spain: Calle Sagasta 8, 28004 Madrid, Spain
Email: info@sherpa71.com
Data Protection Officer: not appointed, as it is not legally required for our activity. You can contact us about any data protection matter at the email address above.

Although Rankof Sport Rankings LLC is incorporated in the United States, it provides its services from its establishment in Madrid, and the processing described in this policy takes place in the context of that establishment's activities. That is why the GDPR (Article 3.1) and Spanish data protection law apply to it.

In this policy, "SHERPA71", "we" and "us" refer to Rankof Sport Rankings LLC, trading as SHERPA71.

2. What data we process and why

Enquiries through our contact form or by email

When you write to us through the contact form, we receive your email address, subject and message, and your name and telephone number if you give them, together with the page you sent it from, the date and time, and a record of the consent you gave (the text of the checkbox you ticked and when you ticked it). To help us detect spam and abuse, we also keep a shortened version of your IP address (with its last part removed) with your message. If you write to info@sherpa71.com, we receive your email address and whatever information you include in your message.

We use this data to answer your enquiry and, if you ask us for one, to prepare a proposal or quote.

If you become a client

If you hire us, we use your contact details and the information about your project to prepare, carry out and invoice the work we agree, and to meet our tax and accounting obligations.

Cookie consent records

When you accept, reject or customise cookies, the website keeps a record of your choice: a random identifier (the same one stored in the cms_consent cookie in your browser), the date and time, the version of our Cookie Policy, the categories you accepted or rejected, the option you used (Accept all, Reject all or your own selection), a shortened version of your IP address (with its last part removed) and a shortened description of your browser (user agent). We use this record only to be able to show that we asked for your consent and respected your choice.

Administration panel users

For the people authorised to manage this website, we keep their username, name, email address, role, password (stored only as a secure, irreversible hash) and the date of their last login. We use this data to give them secure access to the administration panel. Visitors to the website do not have user accounts.

Server access logs

Like any website, our hosting provider's servers automatically record technical data about each visit in access logs: your IP address, the date and time, the page requested, the referring page and your browser. We use these logs only to keep the website working and secure.

Website security

To protect our forms and the administration panel against spam and abuse, the website temporarily keeps an encoded identifier derived from your IP address and the number of attempts. This record expires one hour after the last attempt and is deleted automatically the next time the website checks it.

We do not sell your data, and we do not use it to build profiles or to make automated decisions about you.

3. Legal basis for processing

Enquiries: your consent, which you give by ticking the box on our contact form (Article 6.1.a GDPR); if you write to us directly by email, our legitimate interest in answering the messages we receive (Article 6.1.f GDPR). When you ask us for a proposal or quote, the steps taken at your request before entering into a contract (Article 6.1.b GDPR). We keep the shortened IP address based on our legitimate interest in protecting the website against spam and abuse (Article 6.1.f GDPR).
Clients: if you hire us, the performance of the contract (Article 6.1.b GDPR) and compliance with our tax and accounting obligations (Article 6.1.c GDPR).
Cookie consent records: compliance with a legal obligation (Article 6.1.c GDPR), as we must be able to demonstrate that you gave your consent (Article 7.1 GDPR and Article 22.2 LSSI-CE). For rejections, our legitimate interest in being able to show that we respected your choice (Article 6.1.f GDPR).
Administration panel users: the working relationship with the people who manage the website and our legitimate interest in keeping it secure (Articles 6.1.b and 6.1.f GDPR).
Server access logs: our legitimate interest in keeping the website available and secure (Article 6.1.f GDPR).
Website security: our legitimate interest in protecting the website and its users against spam and abuse (Article 6.1.f GDPR).
External media (Google Maps and Vimeo): your consent, given in the cookie banner or by pressing "Load map" or "Play video" (Article 6.1.a GDPR).

You can withdraw your consent at any time. This does not affect the lawfulness of the processing carried out before you withdrew it.

The name and telephone number are optional. Without an email address, a subject and a message, we cannot answer your enquiry.

4. How long we keep your data

Enquiries: for as long as we need to answer you and for up to 2 years after our last contact. If a business relationship follows, for as long as it lasts and, afterwards, for the periods required by law (for example, tax and commercial record-keeping obligations).
Clients: for as long as the contract lasts and, afterwards, for the periods required by tax and commercial law.
Cookie consent records: up to 3 years from the date of your choice.
Administration panel users: for as long as the person has access to the panel. The account is deleted when access is no longer needed.
Server access logs: up to 30 days; after that, the server's log rotation deletes them automatically.
Website security records: they expire one hour after the last attempt and are deleted automatically the next time the website checks them.

When these periods end, we delete the data securely, or keep it blocked only for as long as the law requires in order to deal with any possible claims.

5. Who we share your data with

We do not sell your data or pass it to third parties for their own purposes. The following service provider helps us run this website and our email. It acts as our data processor: it processes data only on our behalf and following our instructions, under a data processing agreement that meets Article 28 GDPR:

Profesional Hosting (profesionalhosting.com): hosting of this website and of our email service, which we use to receive and answer your messages, on servers in Spain.

Within SHERPA71, only the people who need your data to answer your enquiry can access it, under a duty of confidentiality. If you hire us, the members of our team and the specialist collaborators working on your project may access the data needed for that project, also under a duty of confidentiality. We will also disclose data to public authorities, courts or the tax authorities when the law requires it.

Google and Vimeo only receive data from you if you choose to load a map or a video. In that case, your browser sends it to them directly. SHERPA71 and each provider are joint controllers only for that collection and transmission; for everything they do with the data afterwards, Google and Vimeo are independent controllers under their own privacy policies. Our Cookie Policy lists the cookies these providers may set.

6. International transfers

This website, our email and the data you send us through them are hosted on servers in Spain, within the European Union, and are managed from our establishment in Madrid. We do not transfer the data you send us through our forms or by email to the United States or to any other country outside the European Economic Area (EEA).

The only international transfers that can take place when you use this website are these:

Google Maps and Vimeo: if you load a map or a video, Google LLC and Vimeo.com, Inc. may receive technical data, such as your IP address, in the United States. These transfers are covered by the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection, for companies certified under it, and otherwise by the Standard Contractual Clauses approved by the European Commission.

If you hire us and a specialist collaborator based outside the EEA needs to work on your project, we will only share with them the data needed for that work, and only with the safeguards required by the GDPR, such as a European Commission adequacy decision or the Standard Contractual Clauses approved by the Commission.

7. Your rights

You can exercise the following rights at any time, free of charge:

Access: find out whether we process your data and get a copy of it.
Rectification: correct data that is inaccurate or incomplete.
Erasure: ask us to delete your data.
Objection: object to processing based on our legitimate interest.
Restriction: ask us to restrict the processing of your data in certain cases.
Portability: receive the data you gave us in a structured, commonly used format, or have it sent to another controller.
Withdrawal of consent: at any time, for example by changing your cookie settings or by writing to us.

To exercise them, write to info@sherpa71.com with the subject "Data protection" and tell us which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for the information needed to confirm it. We will reply within one month. In complex cases, the GDPR allows us to extend this by two further months, and we will tell you if that happens.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the data protection authority of the EU country where you live or work. We would appreciate the chance to put things right with you first.

8. Minors

This website is not intended for children. If you are under 14, please do not send us any personal data: under Spanish law, people under 14 need the consent of their parents or guardians. If we find out that we have received data from someone under 14, we will delete it.

9. Accuracy of your data

Please make sure the data you send us is true and up to date. If you give us data about another person, you confirm that you have their permission and that you have told them about this policy.

10. Security

We apply technical and organisational measures appropriate to the risks involved, including:

encrypted connections (HTTPS) between your browser and the website;
hosting with a professional provider on servers in Spain;
access to the administration panel restricted to authorised people with individual accounts, passwords stored as secure hashes and limits on login attempts;
data files that cannot be accessed publicly from the internet;
protection of our forms against spam and abuse;
collecting only the data we need and deleting it when it is no longer necessary;
a duty of confidentiality for everyone who handles your data.

11. Changes to this policy

We may update this policy when our services, our tools or the law change. We will always publish the current version on this page with its update date.