Privacy policy

This is a courtesy translation. The binding version is the Spanish one; in the event of any discrepancy between the two, the Spanish version shall prevail.

1. Data controller

The controller of the personal data collected through this website is Francisco Javier Paños Madrona (tax ID 20040726K), with address at Apartado de Correos 73
46730 Grao de Gandia. For any data protection matter you can write to info@phoenixvega.com.

2. What data we process, what for and on what basis

Not every section described here is always switched on: only the data of those that exist at any given time is processed. Unless stated otherwise, you provide the data yourself when you use each feature. Providing it is voluntary: the fields marked as required in each form are those strictly needed to deal with what you are asking for and, if you do not provide them, it will not be possible to answer your request, enter a prize draw or process your support, as the case may be.

2.1 Contact form

Your name, your email address, the subject if you give one and the content of the message. Purpose: to deal with and answer your request. Legal basis: handling your request and steps taken at your request prior to a possible relationship (art. 6.1.b GDPR). Messages that the anti-spam filters consider automated never reach the inbox: they are held, together with their IP address and browser, in order to review possible false positives and fine-tune the filters (legitimate interest, art. 6.1.f GDPR).

2.2 Notebook comments

If you comment on an entry: the name you give (it is published), your email address if you give one (optional, not published, used only so that the author can reply to you), the text of the comment, the language, and a technical fingerprint of your connection (an irreversible value derived from the IP address, together with the browser type) to prevent abuse. Comments are moderated before publication. Legal basis: your consent when you send it (art. 6.1.a GDPR) and the legitimate interest in moderating and preventing abuse (art. 6.1.f GDPR).

2.3 Prize draws

If you enter a draw: your name, your email address, the language and a technical fingerprint of the connection (as with comments). The email address is used to confirm your entry (we send you a link) and to notify the winner; on confirming, you receive an entry number and a receipt with which you can verify the draw. The result is published in a verifiable way without personal data: only entry numbers and the fingerprint of the list, never names or email addresses. If you tick the newsletter box, your address is also added to the newsletter list (see 2.6). Legal basis: performance of the draw rules you accept when entering (art. 6.1.b GDPR) and, for the newsletter list, your consent (art. 6.1.a GDPR). The rules of each draw set out its conditions.

2.4 Patronage (support with rewards)

If you leave your support: your name (optional), your email address, the amount, a message if you wish, the language and a technical fingerprint of the connection. Only if you choose a physical reward, also the delivery details (name, address, postcode, town and country), which are deleted as soon as the reward is marked as sent. Your name appears on the thank-you wall only if you expressly authorise it. Payment takes place on the payment platform (see section 4), which acts as an independent controller; here only the reference is recorded in order to match the payment. Legal basis: performance of what you request (art. 6.1.b GDPR) and, for the wall, your consent (art. 6.1.a GDPR).

2.5 Service enquiries

If you ask for information or a quote about a service: your name, your email address, the message, a reference link if you provide one, the language and a technical fingerprint of the connection. Purpose: to assess and answer your enquiry. Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR).

2.6 Newsletter list

If you sign up for news, with the form on the «News» page or by ticking the box in a giveaway: your email address, your name if you give one, the language and where the sign-up came from. Purpose: to email you notices of new songs, giveaways and other news about the project. You only join the list after confirming your address with the link we send you. To be able to prove that you gave your consent, alongside the sign-up we keep the date, the exact sentence you ticked and a technical fingerprint of the connection (a value derived from the IP address, not the address itself); if you unsubscribe, also the date and the means. The emails are sent from our own mail server, without external mailing platforms, and state that they are advertising and who sends them. Legal basis: your consent (art. 6.1.a GDPR), which you may withdraw whenever you want, free of charge and with one click: with the unsubscribe link in every email, with your email program's «Unsubscribe» button, or by writing to info@phoenixvega.com.

2.7 Our own statistics, without cookies

The site counts its own visits without tracking cookies or any external provider. For each visit it records: the page, the date and time, the reading time, the language of the interface and that of the browser, the type of device, the browser and operating system family, the referring page if the browser reports it, the campaign parameters of the link used to arrive, if it carries them (utm_source, utm_medium, utm_campaign), and the approximate country, calculated on our own server from the IP address with a local database (GeoLite2); the IP address is not stored. The only identifier is an irreversible derived value that changes every day, so it is not possible to follow the same person from one day to the next or to identify them. The same technique is used to measure likes, how often a work is shared, clicks through to the music platforms and the shop, clicks on the donation buttons, responses to the notice suggesting a change of language, listening to the site's radio (by segments, without identifying the listener), page performance (speed metrics) and the pages that do not exist which someone reaches. Legal basis: the controller's legitimate interest (art. 6.1.f GDPR) in knowing, with minimal data and without identifying anyone, which content is of interest and whether the site is working properly.

2.8 Site security

For security reasons, the server records certain data about connections that try to abuse the site: requests to paths typical of automated scanners, failed attempts to log in to the administration panel (with the email address that was tried), submissions blocked by the anti-spam filters, and browser reports about content the site does not authorise to load. For those connections it records the IP address, the browser type, the date and time, the path requested and the approximate country and city, calculated on our own server with a local database, without sending the address to any third party. For messages from the contact form blocked by the anti-spam filters, the message itself is also kept (name, email address, subject and text), so that it can be reviewed in case it was legitimate. With that data the site automatically blocks anyone who persists in probing it or guessing passwords. Legal basis: the controller's legitimate interest (art. 6.1.f GDPR) in keeping the service running and protecting the systems and the data of all users. This information is not used for any other purpose.

2.9 Third-party analytics and media content (only with your consent)

Only if you accept the corresponding category in the cookie panel: audience measurement with Google Analytics 4 (if configured) and loading of the YouTube or Spotify players. Legal basis: your consent (art. 6.1.a GDPR), which you may withdraw whenever you wish from the preferences panel. It is described in the cookie policy.

3. For how long

• Contact messages: while the communication is being dealt with and, afterwards, a maximum of two years, unless the relationship is still active or there is a legal obligation to keep them.
• Comments: while the commented entry is published, or until you ask for their removal. Those rejected in moderation are deleted after thirty days.
• Prize draws: entries not confirmed by email are deleted after seven days; the rest, until sixty days after the draw is delivered (or cancelled), long enough to deal with complaints. The published result contains no personal data.
• Patronage: support that is never paid for expires after fourteen days; delivery details are deleted when the reward is marked as sent; sixty days after the support is closed, the identifying data is anonymised (the amount remains, for accounting purposes, and the name on the wall only if you authorised it).
• Service enquiries: while the enquiry is being assessed and dealt with and, afterwards, a maximum of two years, unless a contractual relationship follows.
• Newsletter list: for as long as you stay on the list. If you do not confirm your sign-up with the link we send you, your data is deleted within three days at most. When you unsubscribe you stop receiving emails at once; thirty days later, your email address is replaced by an irreversible fingerprint and your name is deleted. That record, which only serves to prove when you gave and withdrew your consent should there be a complaint, is deleted three years after you unsubscribe.
• Our own statistics: two years, in aggregate form and without identifying anyone.
• Security logs: one year.
• Backups: the site's encrypted backups keep a snapshot of the data for a limited time, no longer than three months. When a piece of data is deleted, it disappears from the site immediately and from the backups when that period expires.
• Third-party analytics: according to the provider's period (in Google Analytics 4, a maximum of fourteen months).

4. Who your data is shared with

No data is passed on to third parties except where legally required. The following providers are involved in running the service:

• Hosting and email provider: servers within the European Economic Area (EEA), acting as a processor.
• Approximate geolocation: carried out on our own server with a local database (GeoLite2, from MaxMind). Your IP address is not sent to MaxMind or to any other third party.
• Payment platforms (PayPal, Stripe or another one indicated at the time): if you make a donation or leave support, payment takes place on their website and they process your payment data as independent controllers, under their own policies. This site neither receives nor stores your card or account details.
• Google LLC (Google Analytics 4 and YouTube): a US entity certified under the EU–US Data Privacy Framework, which provides an adequate level of protection. It acts only with your consent.
• Google (Google Drive, backups only): the site's backups are stored in a Drive account belonging to the controller so that the site can be restored if the server fails. They leave the server already encrypted and, without the key — which is not stored in Drive — they are not readable by anyone else, not even by Google. The same transfer framework described in the previous point applies.
• Spotify AB (audio players): a Swedish entity established in the EEA. It acts only with your consent.

5. Automated decisions

The site automatically blocks connections that probe attack paths or that repeatedly fail the administration panel password, and sets aside messages that the anti-spam filters score as automated. These are security measures with no legal effects on you: a block expires on its own the first few times —a few hours, then longer if it happens again—; once that escalation runs out, it no longer expires on its own and is reviewed by hand, the same as a set-aside message; if you believe something of yours has been blocked or set aside by mistake, write to info@phoenixvega.com. No profiling is carried out.

6. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@phoenixvega.com, stating the right you are exercising and reasonably proving your identity. You may also withdraw at any time any consent you have given, without affecting the lawfulness of processing prior to its withdrawal. If you believe your rights have not been properly dealt with, you may lodge a complaint with the Spanish Data Protection Agency.

7. Data security

The controller applies technical and organisational measures that are reasonable and proportionate to the risk in order to protect the data against loss, alteration or unauthorised access: encryption of communications, panel access with two-factor authentication, anti-spam filters, automatic blocking of hostile connections, a policy that limits what content the browser may load, and encrypted backups kept off the server. No measure offers absolute security, but due diligence is applied and the measures are reviewed whenever necessary.