Privacy Policy

Data Controller

El Mundo Fagotero is a personal educational project about the bassoon, managed individually and without its own legal entity. The data controller’s details are:

Field	Details
Controller	Gabriel (El Mundo Fagotero)
Email	contact@elmundofagotero.com
Website	https://elmundofagotero.com

Personal data processed

The Site does not have registration forms or user account systems. The data we may process is as follows:

• Contact data: email address and content of messages received through the Site’s mailto links.
• Notifications (push alerts): only if you turn them on from the menu or the Notifications page, we store the subscription your browser creates (the address assigned by its push service and the keys used to encrypt the messages), the chosen topics (scores, blog, shop), the language and the sign-up date. We do not store your name, email, IP address or any other identifier, and the subscription is only used to send you the alerts you asked for. We also count, anonymously and in aggregate, how many sign-ups, unsubscriptions, alerts sent and opens there are each day by topic and language, without linking them to any device.
• Affiliate link clicks: we anonymously count which product is clicked, on which page and from which element. No cookies are used and neither the IP address nor any identifier is stored, so this data cannot identify anyone and is not personal data.
• Use of the scores: in the same anonymous way, we count which score is downloaded, opened on MuseScore or played on video. No cookies or identifiers are used either.
• Searches: also anonymously, we store the text typed into the site’s search boxes (scores, shop…), whether it found any result and on which page it was searched, to learn which content is of interest and what is missing. No cookies or identifiers. Please do not type personal data into the search boxes.
• Prompts to turn on notifications: we anonymously count how many times they are seen and clicked, on which page, the type of device and browser (worked out in your browser, without storing its full identification) and whether turning them on worked. No cookies, no IP address and no identifier.
• Page visits: we use Cloudflare Web Analytics to count page views, which site visitors come from (for example, Google), country, device and browser type, and loading speed. It uses no cookies or local storage, does not store the IP address and does not create an identifier to track your browsing across visits: it only provides aggregated counts.
• Google searches: Google Search Console shows us, in aggregated form, which searches the Site appears for on Google and how often it is clicked. These are Google’s statistics, not data about Site visitors.
• Technical connection data: our hosting provider (Cloudflare) processes the IP address transiently to serve the pages and protect the Site against attacks. We do not use this data to analyse your browsing.
• Cookies: as detailed in the Cookie Policy.

Purpose and legal basis for processing

Purpose	Legal basis
Responding to enquiries and messages sent by email	Legitimate interest of the controller (Art. 6.1.f GDPR)
Serving the Site securely (hosting)	Legitimate interest of the controller (Art. 6.1.f GDPR)
Measuring visits anonymously and in aggregate to improve the content (Cloudflare Web Analytics)	Legitimate interest of the controller (Art. 6.1.f GDPR)
Sending push alerts about new content on the chosen topics	Consent of the data subject (Art. 6.1.a GDPR), given per topic and withdrawable at any time from the menu, the Notifications page or the browser settings

Retention period

• Email messages are kept for as long as necessary to handle the enquiry and, at most, 2 years from the last contact.
• The push alert subscription is kept until you turn it off or until your browser’s push service marks it as expired (for example, if you clear the Site’s data or uninstall the app); it is then deleted automatically.
• Anonymous counts of visits, clicks, searches, alerts and prompts to turn on notifications are kept in aggregated form; as they are not personal data, no retention period applies.

Recipients of data

Data may be shared with the following third parties:

• Cloudflare, Inc. (web hosting, cookie-free visit measurement and storage of push alert subscriptions), as data processor, under the EU–US Data Privacy Framework (DPF). See Cloudflare’s privacy policy.
• Your browser’s push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge on Windows), only if you turn notifications on: it receives the encrypted alert and delivers it to your device. It is chosen by your browser, not by the Site, and is governed by each company’s privacy policy.
• Amazon (Associates affiliate programme), via Amazon’s own tracking cookies when the user clicks on an affiliate link. The Site does not transmit any personal data to Amazon: prices are retrieved from our server. If a product has no photo of its own, its official image may be shown, which the browser downloads directly from Amazon’s servers (as with any web request, they receive the IP address).

No other data transfers are made to third parties, except where legally required.

Rights of the data subject

In accordance with Articles 15 to 22 of the GDPR and the LOPDGDD, the user has the right to:

• Access their personal data held by us.
• Rectify inaccurate or incomplete data.
• Erase their data when, among other grounds, it is no longer necessary for the purposes for which it was collected (“right to be forgotten”).
• Restrict the processing of their data in the cases provided for in Article 18 of the GDPR.
• Object to the processing of their data based on legitimate interest.
• Data portability in a structured, commonly used and machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, send an email to contact@elmundofagotero.com stating the right you wish to exercise and attaching a copy of your identity document.

You also have the right to lodge a complaint with the competent supervisory authority: the Spanish Data Protection Agency (AEPD): www.aepd.es.

International data transfers

Technical connection data may be processed by Cloudflare, Inc., based in the United States, under the guarantees of the EU–US Data Privacy Framework (DPF), approved by the European Commission through an Adequacy Decision of 10 July 2023. Push alert subscriptions are stored in a Cloudflare database located in the European Union.

If you turn notifications on, your browser’s push service (Google, Mozilla, Apple or Microsoft) may process the subscription outside the European Economic Area. Each company applies the safeguards set out in its privacy policy (such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses).

Security

The Site uses the HTTPS protocol to encrypt all communications between the user’s browser and the servers. The owner applies appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data, in accordance with Article 32 of the GDPR.

Changes to this policy

The owner reserves the right to modify this Privacy Policy to adapt it to new legislation or case law. Changes will be published on this page. We recommend reviewing it periodically.