Data Protection

Privacy Policy

This policy explains how personal data is processed in connection with the Nothing Else Records website, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

Controller

Ali Benmoussa El Omari, acting as a natural person.

Address: Vallfogona de Balaguer, Lleida, Spain.

Privacy contact: [email protected]

No Data Protection Officer has been designated. None of the three criteria of Article 37(1) GDPR apply to this controller: (a) the controller is not a public authority or body; (b) the core activities do not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale (the website does not run analytics, tracking, profiling or behavioral advertising); (c) the controller does not process special categories of personal data under Article 9 GDPR or data relating to criminal convictions under Article 10 GDPR on a large scale.

Data we process

Two categories of data are processed:

  • Contact data. The content of messages you voluntarily send to [email protected], including your email address and any information you choose to include.
  • Infrastructure data. Technical logs generated automatically when you visit the website: IP address, user agent, request path, response code and timestamp.

Outside the “Friends” promotional game (see its section below), the website does not offer forms, newsletters, accounts, checkout or any other mechanism that would collect additional data.

Purposes and legal basis

Contact data is processed to read and reply to your message. Infrastructure data is processed to deliver the website, protect it from abuse and keep it available.

Contact data is processed under Article 6(1)(a) GDPR — consent manifested through your voluntary act of sending a message after access to this Privacy Policy linked from the footer. Alternatively, Article 6(1)(f) GDPR — the legitimate interest of the publisher in receiving, reading and responding to public communications directed to a clearly published contact channel. Infrastructure data is processed under Article 6(1)(f) GDPR — the legitimate interest of the controller in delivering, securing and maintaining the website against abuse. Where a legal obligation applies (for example, a supervisory-authority request), Article 6(1)(c) GDPR is the applicable basis.

Additionally, on the first visit to the website from the root URL, Cloudflare communicates to the system the country code associated with your IP address (header cf-ipcountry) for the sole purpose of automatically serving the most likely Spanish or English language version. The country code is not stored in any record held by the controller; it is used only in the memory of the request and is discarded when the response is served. Legal basis: Article 6(1)(f) GDPR — legitimate interest in offering the language version expected by the user. You may override this automatic detection at any time by clicking the language selector; your choice will then be persisted through the technical cookie lang_pref (see the Cookie Policy).

“Friends” promotional game

The “Friends” promotional game, when active, collects data to manage your participation. This section, together with the general sections of this policy (processors, international transfers, retention and rights), contains the full detail of that processing. The contest rules are available at the contest rules page.

Controller: Ali — Nothing Else Records.

Data: your email (required); your first and last name (optional, only if you give them); your preferred language (Spanish or English), so we write to you in your language; your confirmation of being over 16; your consent (text version and date) and your game progress. Nothing else — no IP, no tracking, no profiling.

Why your name? Optional. If you give it, we use it to recognise you across the riddles, to personalise the emails we send you, and — only if you tick the optional box — the label’s news.

Purpose: to send your game reward and the next riddles; and, only if you tick the optional box, news from the label.

Legal basis: Article 6(1)(b) GDPR (performance of what you request by claiming your reward) for the core participation data; and Article 6(1)(a) GDPR — consent — for the optional label news, which you may withdraw at any time.

Recipients: game data is stored in the database of the processor Scaleway (Scaleway SAS — Serverless SQL Database and Transactional Email, Paris region “fr-par”, European Union): data at rest stays in the EU. Each request is processed — and database access accelerated — through the processor Cloudflare, Inc. (U.S., global network), which entails an international transfer covered by the EU-U.S. Data Privacy Framework and, as a fallback safeguard, the Standard Contractual Clauses. You may request a copy of the safeguards at [email protected].

Retention: until you unsubscribe or ask us to erase your data — one click is enough. If you do not confirm your email, we delete your record after 30 days. After an erasure we keep, blocked for 3 years, only the minimal record proving your consents (a hash of your email — not your email in the clear —, the text version and the date), as required by law.

Unsubscribe and erasure: participation is confirmed by double opt-in (a confirmation email with a signed link, valid for 24 hours). Every news email includes its own unsubscribe link; the reward email additionally includes an erasure link for your data; and any right can also be exercised by writing to [email protected].

Anti-abuse protection: the form uses Cloudflare Turnstile to tell people and bots apart; the verification is processed by the processor Cloudflare, Inc. The technical cookies Cloudflare may use in that verification are detailed in the Cookie Policy.

Your rights: access, rectify, erase, restrict, object, port your data and withdraw consent at any time.

No IP, no tracking. The only proof of consent is the date, the version of this text and your email confirmation.

Providing your data is voluntary

Under Article 13(2)(e) GDPR: providing your data when you contact us is entirely voluntary. The only consequence of not providing it is that we will not be able to respond.

Information received through infrastructure providers

Under Article 14 GDPR: when you visit this website, Cloudflare — our hosting and security provider — automatically processes technical data including your IP address, user agent, request path and timestamp, for delivery, security and abuse prevention. This information is not supplied by you directly but collected via the infrastructure required to serve the site. It is handled under Cloudflare’s own privacy policy (cloudflare.com/privacypolicy) and may, depending on the service configuration, also be made available to the controller through operational logs or dashboards used to secure and operate the site.

Recipients (processors)

Three processors access data on our behalf, under Art. 28 GDPR contracts:

  • Cloudflare, Inc. — hosting, content delivery, TLS termination and security (Cloudflare Pages). It processes infrastructure data described above. U.S., global network: international transfer covered by the EU-U.S. Data Privacy Framework and, as a fallback safeguard, the Standard Contractual Clauses.
  • Google LLC — Google Workspace email for the [email protected] mailbox. It processes contact data when you email us.
  • Scaleway SAS — database and transactional email for the “Friends” game (Serverless SQL Database and Scaleway TEM, Paris region “fr-par”, European Union). Game data at rest stays in the EU.

Data is not sold, rented or shared for unrelated commercial purposes.

International transfers

This website is served through Cloudflare Pages (Cloudflare, Inc., San Francisco, CA, United States). Technical and security logs, including the visitor’s IP address, may be processed by Cloudflare in data centers located both inside and outside the European Economic Area, including the United States.

Cloudflare is self-certified under the EU–U.S. Data Privacy Framework (DPF), the UK Extension to the EU–U.S. DPF, and the Swiss–U.S. DPF. For transfers outside the frameworks, Cloudflare relies on the European Commission’s Standard Contractual Clauses (SCCs) as set out in its Data Processing Addendum.

Emails sent to [email protected] are processed by Google Workspace (Google LLC, Mountain View, CA, United States), which is also self-certified under the EU–U.S. Data Privacy Framework and relies on Standard Contractual Clauses where applicable.

References:

A copy of the applicable safeguards can be requested via the contact email above.

Retention

  • Contact emails: kept for up to 12 months from the last exchange, then deleted unless a legal obligation or live legal claim requires longer retention.
  • Cloudflare infrastructure logs: standard Cloudflare HTTP request log retention applies (3-7 days by default in absence of Logpush configuration, per Cloudflare Logs documentation). The controller does not operate Logpush to external storage. After Cloudflare’s automatic deletion, no further copy is retained.
  • Mailbox backups: retained for a maximum of 90 days as part of Google Workspace backup cycles.
  • “Friends” game data: until the participant unsubscribes or requests erasure. Unconfirmed records (no double opt-in) are automatically deleted after 30 days.
  • Game consent log (after an erasure): kept blocked for 3 years, limited to the email hash, the consented text version and the date, for the sole purpose of proving consent.

Automated decision-making and profiling

This website does not carry out automated decision-making or profiling as defined in Article 22 GDPR.

Audience measurement

No web analytics or audience-measurement tool is used — neither Cloudflare Web Analytics, nor Google Analytics, nor any equivalent. The site does not track its visitors. Should it become necessary to measure site performance in the future, this would be done from aggregated server-side logs, which do not access or store information on your device, and this policy would be updated accordingly.

Your rights

Under GDPR Articles 15 to 22 and LOPDGDD, you may exercise the following rights free of charge by writing to [email protected]:

  • Access — confirm whether we hold data about you and obtain a copy.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion where legally applicable.
  • Restriction — limit processing in the cases foreseen by law.
  • Objection — object to processing based on legitimate interest.
  • Portability (Article 20 GDPR) — applicable when processing is based on consent or on a contract and carried out by automated means. For the “Friends” game data those conditions DO apply: you may exercise portability in full and we will provide your data in a structured, commonly used, machine-readable format. For contact emails read manually and technical infrastructure logs, the conditions of Article 20.1 GDPR do not apply; however, upon request we will likewise provide a machine-readable copy of the data the controller retains.

You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at aepd.es if you consider that your rights have not been properly addressed.

Changes to this policy

This policy may be updated to reflect changes in the website, its providers or applicable law. Substantive changes will be reflected in the last-updated date below.

Last updated: 7 August 2026 (version 2: full “Friends” game processing detail — data, retention periods, unsubscribe and erasure, anti-abuse protection, third processor Scaleway and portability).