Privacy policy

This policy explains what information mariamoreno.music collects, what it is used for and what rights visitors have. It is drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD).

In short: this website uses no analytics cookies, stores no IP addresses and cannot recognise anyone from one day to the next. The sections below explain exactly how.

1. Data controller

Controller: Pending: name or company name
Tax ID: Pending: Tax ID
Registered address: Pending: address
Email: Pending: contact email

2. Website usage statistics

In order to know which content is of interest and to detect errors, this site measures its own traffic. The measurement is first-party: it is performed by the same program that serves the website, the data is stored in its own database and nothing is sent to Google Analytics or to any other third-party service.

For each visit the following is recorded:

The page visited and the language it was served in.
The approximate country and city, as estimated by the content delivery network.
The operating system and the type of device (desktop, mobile or tablet).
The referring page, when the visit arrives from an external link.
How long the page remained visible, and any external, download, email or telephone links that were clicked.
The server response code, in order to locate pages that fail.

And, above all, this is what is not done:

The IP address is not stored anywhere, neither in full nor truncated. It is used for an instant in memory to compute an irreversible code and is then discarded.
That code contains the current date, so it changes every 24 hours. After midnight the same person produces a different code and can no longer be linked to yesterday's. The deliberate trade-off is that when the dashboard says “unique visitors” it means unique *per day*.
No analytics cookie is installed, no browser local storage is used and no fingerprinting techniques are applied.
Precise location is not recorded. Of the location data supplied by the content delivery network, only country and city are read; latitude, longitude and postcode arrive and are discarded.

For all of the above, this measurement cannot identify any individual or track anyone across different days, and therefore requires no prior consent.

Anyone who wishes to may subscribe to receive news. The form asks for four pieces of information and there are no hidden ones:

Name, to address the messages.
Email address, which is where they are sent.
Country and city, to know where the artist is being followed from and to be able to announce the tour by area.

The sign-up date, the confirmation date and the language of the page it was done from —which is the language used to write afterwards— are also recorded.

Country and city are not used to segment mailings or to build profiles. The newsletter goes out the same to everyone; that information is only looked at in aggregate, to know where there are more interested people. Using it to send different messages by area would require fresh, separate consent.

Subscription uses double opt-in: after completing the form, a message with a link is sent, and the address is not added until that link is clicked. This prevents anyone from subscribing someone else. That link expires after 48 hours; if it is not used, the request lapses.

Every mailing includes an unsubscribe link that takes effect immediately and requires no explanation, as well as the technical header that makes programs such as Gmail or Outlook offer their own unsubscribe button.

To stop anyone using the form to flood someone else's inbox, the number of sign-ups that can be requested from the same origin in one hour is limited. No IP address is stored for this: an irreversible code that also changes daily is computed from it —exactly as with the statistics— and it is that code that is recorded.

4. Administration panel access

People authorised to manage content have an account with their first name, surname, email address and a password that is always stored encrypted, never in plain text. To protect those accounts against brute-force attacks, failed sign-in attempts are recorded temporarily together with the IP address they came from.

5. Legal basis for each processing activity

Usage statistics: the controller's legitimate interest in understanding how their own site performs (Art. 6(1)(f) GDPR), in a form that identifies no one and that by design has minimal privacy impact.
Newsletter: the express consent of the data subject (Art. 6(1)(a) GDPR), given by ticking the box on the form and then confirming it by clicking the link in the email, and withdrawable at any time.
Sign-up limit per origin: legitimate interest in preventing the form from being used to send unwanted mail to third parties and in protecting the domain's reputation (Art. 6(1)(f) GDPR), using an irreversible code that identifies no one.
Administration accounts and access logs: performance of the relationship with authorised persons and legitimate interest in system security (Art. 6(1)(b) and 6(1)(f) GDPR).

6. How long data is kept

Usage statistics: a maximum of 24 months, after which the records are deleted.
Newsletter subscription: for as long as the subscription remains active. On unsubscribing, the email address is replaced with a one-way code and the name and city are erased; all that remains is the record that an unsubscribe happened and when, which is what makes it possible to prove it was honoured.
Unconfirmed requests: if the confirmation link is not clicked within 48 hours, the request lapses and no subscription ever comes into being.
Failed sign-in attempts: only as long as needed for the temporary lockout to serve its purpose.
Sign-up log per origin: a few hours, just long enough for the limit to work. It is then deleted automatically.
Administration accounts: for as long as the authorisation to manage the site lasts.

7. Who the data is disclosed to

Data is not sold, transferred or shared with third parties for commercial purposes. Only the providers required for the website to work are involved; they act as processors and solely on the controller's instructions:

LucusHost S.L., which hosts the site and its database on servers located in the European Union.
Cloudflare, Inc., which provides content delivery and attack protection. In doing so it processes connection data, including the IP address, under the safeguards laid down in Chapter V GDPR for international transfers.
The outgoing mail provider contracted with the hosting service, in order to send newsletter messages and subscription confirmations.

Data may also be disclosed to public authorities where there is a legal obligation to do so.

8. Rights of data subjects

Anyone may request access to their personal data, its rectification or erasure, the restriction of or objection to its processing and its portability, as well as withdraw any consent given without affecting the lawfulness of prior processing. It is enough to write to [Pending: contact email](mailto:Pending: contact email) stating which right is being exercised.

An honest caveat about the statistics: because no IP address is stored and the visitor code changes daily, those records cannot be traced back to any particular person. In practice there is nothing to find or delete in them, because there is no way to tell which ones are yours (Art. 11 GDPR). Rights can be exercised normally over the newsletter subscription and over administration accounts.

If you believe the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

The site is always served encrypted over HTTPS. Passwords are stored using irreversible hashing functions, database queries use prepared statements, forms are protected against forged submissions and access to the administration panel is limited in the number of attempts.

10. Changes to this policy

This policy may be updated to reflect changes to the site or to the applicable rules. The version in force is always the one published on this page.

Last updated: 13 August 2026.