Privacy Policy
Last updated: 8 October 2026
This policy explains what personal data Passion Ibiza Radio collects through passionibizaradio.com, why, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law (LOPDGDD).
Who is responsible for your data
The data controller is Passion Ibiza Radio. For anything about your personal data, contact us through our contact form.
What we collect and why
We only collect what we need for each purpose below. If you do not provide information marked as required in a form, we cannot handle that request.
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Your account (staff, DJs, customers, affiliates) | Name, email address, password (stored only as a secure hash), role, profile details you add | Contract (Art. 6(1)(b) GDPR) | While your account exists; deleted on request |
| Ticket orders and guest lists | Name, email, phone (optional), event, tickets, order status, guest names | Contract; legal obligation for accounting (Art. 6(1)(b), (c)) | Orders and invoices for as long as Spanish tax and commercial law requires (generally six years) |
| DJ mix and track submissions | Name, artist name, email, genre, social profile links, description, your audio file and photo | Steps you ask us to take before an agreement; legitimate interest in reviewing music (Art. 6(1)(b), (f)) | Accepted submissions while relevant to our programming. The audio of declined submissions is deleted after a limited period; the submission record is kept for our records |
| Enquiries (contact, boat rental, driver, party planning, VIP guest list) | Name, email, phone and the details you write in the form | Steps you ask us to take before an agreement; legitimate interest in answering you (Art. 6(1)(b), (f)) | As long as needed to handle the enquiry and any follow-up, then deleted |
| Newsletter and marketing emails | Email, name if given, your consent record and topics you choose | Your consent, confirmed by email (double opt-in) (Art. 6(1)(a)) | Until you unsubscribe; the consent record is kept to prove consent |
| Affiliate programme referrals | Affiliate code, random visitor ID, landing and referring page, browser type, IP address in hashed (non-reversible) form | Legitimate interest in crediting affiliates (Art. 6(1)(f)); see Cookies | Referral cookies 90 days; referral records while needed for affiliate accounting |
| Security, fraud and abuse prevention | IP address, browser information, Cloudflare Turnstile bot-check signals, server logs | Legitimate interest in protecting the site and our users (Art. 6(1)(f)) | Short-lived; server logs are rotated regularly |
| Visitor statistics | Pages viewed, referring site, browser and device type, country (derived from your IP address, which is not stored); no cookies and no cross-site tracking | Legitimate interest in understanding how the site is used (Art. 6(1)(f)) | Aggregated statistics only; Cloudflare keeps the underlying data for a limited period |
| Backups | An encrypted copy of our database | Legitimate interest in recovering from failures (Art. 6(1)(f)) | Daily copies 35 days, weekly 90 days, monthly about 13 months |
We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
Who we share it with
We use the following service providers, who process data on our behalf under data-processing agreements, or as independent controllers for their own services:
- Stripe: Card payments. Card details go directly to Stripe; we never see or store them. (privacy policy)
- Mailchimp (Intuit): Newsletter and marketing emails, only if you opt in. (privacy policy)
- Cloudflare: Delivering the website securely (CDN, protection against attacks), protecting login, password reset and forms from bots (Turnstile), cookie-free visitor statistics (Web Analytics), and storing our encrypted backups in the EU. (privacy policy)
- RadioKing: Streaming the live radio and showing the track that is playing. (privacy policy)
- Spotify: Playing DJ playlists embedded on our pages. (privacy policy)
- Hosting and email delivery providers: Running our servers and delivering the emails the site sends (for example order and password-reset emails).
We may also disclose data where the law requires it (for example to tax authorities or in response to a court order), or to protect our rights. If the business is sold or reorganised, data may pass to the new owner under this policy.
International transfers
Some providers above (for example Stripe, Cloudflare, Mailchimp and Google) may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.
Cookies and similar technologies
We do not use advertising or analytics cookies. Our visitor statistics (Cloudflare Web Analytics) work without cookies and without identifying you. We use:
- auth_session: keeps you signed in. Strictly necessary; set only when you log in; removed when you log out or it expires.
- passion_referral and passion_visitor: set only when you arrive through an affiliate’s link, so the affiliate is credited if you submit a demo. Kept for 90 days.
- Cloudflare Turnstile: on login, password reset and some forms, a check runs in your browser and reads browser and device signals to tell people from bots. Cloudflare does not use these signals for advertising.
- Cloudflare: may set short-lived security cookies (such as __cf_bm) to protect the site from automated abuse.
- Browser storage: a small flag in session storage so a referral is only recorded once per visit.
You can block or delete cookies in your browser settings. Blocking the session cookie means you cannot stay signed in.
Embedded players and maps
When you play the radio, your browser connects to RadioKing; when you open an embedded playlist, it connects to Spotify; venue, restaurant and beach pages show a Google Maps map. Those services receive your IP address and browser information, may set their own cookies, and apply their own privacy policies (for Google Maps: policies.google.com/privacy).
How we protect your data
The site is served only over HTTPS. Passwords are stored as one-way hashes. Access to the admin dashboard is limited to authorised staff. Backups are encrypted before they leave our server. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the authorities of a breach where the law requires.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our use of it, including at any time to direct marketing;
- receive data you gave us in a portable format;
- withdraw consent at any time (for example by using the unsubscribe link in our emails), without affecting earlier processing.
To exercise them, contact us through our contact form. We may ask you to confirm your identity and will reply within one month. You also have the right to complain to the Spanish data-protection authority, the Agencia Española de Protección de Datos (aepd.es).
Children
Our services are not directed at children. In Spain, people under 14 cannot consent to the processing of their data online, so we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will update this page when our practices change and show the date of the latest version above. If a change is significant, we will tell you by email or on the site.
