Privacy

Version 1. In effect from To be confirmed: publication date

This page explains what happens to your details if you send an enquiry through this site, and what you can ask for afterwards. It describes this site only, and it describes what the site actually does rather than what a notice of this kind usually says.

Data

Who holds it

The controller for everything described on this page, meaning the person or company that decides what happens to it, is:

WIFYX
C sa venda des coloms 9, Ibiza, 07800, Spain
1mkmnrd@gmail.com

Write to that address about anything on this page, including a request to see what is held about you or to have it deleted.

What the form collects

The enquiry form on the front page is the only place this site asks you for anything. It collects exactly this:

Name: Required. Between 2 and 80 characters.
Email address: Required, and it has to be an address that can receive a reply, because the reply is sent to it.
Type of enquiry: Required. One of three: Booking, Press or Management.
Event date: Required when the type is Booking. Left out otherwise.
City or venue: Required when the type is Booking. Left out otherwise.
Message: Required. At least 10 characters and at most 4000.
Your tick on the consent box: Required. The fact that you gave it is recorded with the enquiry.
The time it arrived: Added by the site, not by you.

Two more values travel with the form. The first is how many seconds the page had been open when you pressed send. The second is a decoy field that is kept out of sight and stays empty unless a robot fills it in. Both exist only to reject automated submissions. If one of them is failed and any other field is wrong as well, nothing is stored at all. If one of them is failed but every other field is valid, the enquiry is kept as an unpublished record, together with which of the two checks caught it, instead of being thrown away. That is deliberate: a real person using a password manager or a form filler trips these checks too, and silently losing their enquiry would be the worse outcome. Held records are not published anywhere and are read only in order to answer them.

Nothing else is asked for. No phone number, no postal address, no date of birth, no payment detail, and there is no account to create.

What happens to an enquiry

Your enquiry is saved in this site’s own database first, as a private record, before any email is attempted. That order is deliberate. If a mail server later refuses the message, the enquiry is still on record instead of lost.

The record is private in the strict sense. It is never published, it is left out of the site’s own search, and it is not offered through the site’s public data interface. Reading it requires signing in to the site’s administration with the right permissions.

Once it is saved, the enquiry is emailed to 1mkmnrd@gmail.com. That email is sent from an address on this site's own domain, never from yours. Your name and your email address are put in the reply field of the message, so that pressing reply answers you directly.

Two failures are handled openly rather than quietly. If the database refuses the record, the text of the enquiry is written to the server’s error log instead, so that it is not lost. If the email cannot be sent, the record stays where it is and the page tells you on screen that your enquiry was saved but not passed on.

Keeping the form usable

The form accepts five enquiries an hour from one internet connection. To count them, the site stores a single number in its own database under a key worked out from your IP address. The number is the count and nothing else. Your IP address is not stored with your enquiry, it is not written next to it, and it is not included in the email that goes on to the management inbox.

Being straight about that key: it is derived from your address rather than being the address itself, which makes it harder to read back, but it is not anonymous. It is treated here as data that still relates to you. It is discarded within an hour of your last enquiry and it is never joined up with the enquiry record.

Why this is allowed

For the enquiry itself the basis is your consent, given by ticking the box on the form. That is Article 6(1)(a) of the GDPR. You can withdraw it at any time, and if you do, the record is deleted.

Where your enquiry is about a booking, dealing with it is also a step taken at your own request before any agreement is made, which is Article 6(1)(b).

For the hourly counter described above the basis is legitimate interests, Article 6(1)(f). Without it the form fills up with robot submissions and real enquiries get buried in them.

You are never asked for special category data, such as health, beliefs or anything about your background. Nothing on this site profiles you and no decision about you is made automatically.

How long it is kept

The enquiry record on this site: Kept while your enquiry is being dealt with, and for one year after that, then deleted.
An enquiry held back by one of the two checks above: Kept as an unpublished record on the same terms as any other enquiry, one year after it is dealt with, then deleted. Ask and it goes sooner.
The hourly counter: Discarded within an hour of your last enquiry.
The copy that arrives by email: Held in the management inbox under that mail provider’s own retention. Google, and it is deleted within a month of the year being up
An error log entry, in the rare case one was written: Held for as long as the hosting company keeps server logs. Hostinger does not publish a fixed period for its server logs. Its policy says information is kept for as long as is necessary to run the service and to meet its legal obligations.

Deleting an enquiry record is done by hand. Nothing on this site deletes it on a timer, so if you would rather yours went sooner than the period above, ask, and it will be removed.

Who else can see it

Two companies are involved because they have to be, and nobody else is involved at all.

Hostinger, the company that runs the server and the network in front of this site. Every request to any page passes through it, and it keeps its own server logs, which include IP addresses. The company is HOSTINGER, UAB, registered in Lithuania under code 302710386, at Švitrigailos str. 34, LT-03230 Vilnius. The terms it processes data under are published in its data processing addendum at hostinger.com/legal/dpa.
The provider of the management inbox that receives the email copy of your enquiry. Google, because the inbox is a Gmail account

Beyond those two, nobody. Your details are not sold, not swapped, not passed to a promoter, an agency or a label, and never added to a mailing list. There is no advertising anywhere on this site.

Whether any of this is stored or reached from outside the European Economic Area depends entirely on the two companies above. The emailed copy sits in a Google account, and Google processes data outside the European Economic Area under its own terms. Hostinger states that some of its servers sit outside the European Economic Area, naming the United States, Brazil, Singapore and Indonesia, and that where personal data leaves the EEA it relies on standard contractual clauses.

Players, fonts and cookies

The music and video players on this site do not load until you press play. Until you press it, no request is made to YouTube, Spotify, SoundCloud, Mixcloud or Apple, and none of them is told that you are on this page. What you see before you press play is drawn by this site.

Once you do press play, the platform you chose receives your IP address and your browser details, and it may set its own cookies. From that moment its own privacy notice covers what it does, not this one. The YouTube player is loaded in its no cookie form. Their notices are here: YouTube, Spotify, SoundCloud, Mixcloud and Apple Music.

The two typefaces used on this site are served from this site. Nothing is requested from Google Fonts, so no font request hands your address to Google.

There is no analytics on this site. No visit counter, no tracking pixel, no advertising tag, no session recording, no fingerprinting and no profiling. Nobody is counting you.

Browsing this site sets no cookies. Signing in to the site’s administration does set the cookies WordPress needs to keep a session open, which affects only the people who run the site.

Keeping it safe

The site is served over HTTPS, so what you type into the form is encrypted on its way to the server. Enquiry records are private and need an administration account to read, and those accounts belong only to the people who run the site.

Rights

Your rights

Under the GDPR you have all of the following, and using any of them costs nothing.

Access: Ask for a copy of what is held about you, and for an explanation of what is being done with it.
Rectification: Have anything inaccurate corrected, or anything incomplete filled in.
Erasure: Have it deleted. For an enquiry sent through the form this is always honoured, because the only reason it is held is that you asked for an answer.
Restriction: Ask that it be kept but not used, while a question about it is being sorted out.
Objection: Object to anything being done on the basis of legitimate interests.
Portability: Receive what you supplied in a common format you can take somewhere else.
Withdrawing consent: Withdraw it at any time, without giving a reason. That does not undo what was already done while it stood, but the record goes.
Complaining: Take it to a data protection supervisory authority. See below.

How to use them

Write to the contact in the first section and say plainly what you want. There is no charge and you do not need to give a reason unless the right itself calls for one. You will get an answer within one month. If the request turns out to be complicated that period can be extended, and you will be told that it has been, and why.

You may be asked for enough information to be sure the details are yours and not somebody else’s. That is the only reason identity is ever checked.

For an enquiry you sent through the form, the quickest route is to reply to the answer you received and ask for your details to be deleted.

If you want to complain

If you are unhappy with the answer you get, you can complain to the data protection supervisory authority in the country where you live, where you work, or where you think the problem happened. You are free to go straight there, although raising it here first is usually faster.

Changes to this notice

If this notice changes, the new version replaces this one on this page and the date at the top of the page changes with it. There is no archive of earlier versions.

Go to the enquiry form