Privacy policy
Plain language, not legal padding: what we ask for, what we use it for, and what you can do about it. This isn't a text drafted by a law firm — it's an honest baseline for a project still getting started. Before we charge clubs or scale up traffic, it needs a proper legal review (see the note at the bottom).
Who's behind this
Malaga Fiesta is run by one person, based in Málaga (Spain). There's no registered company behind the site yet — once there is, this section will carry the full legal name, tax ID and address. Until then, the one real contact is:
What we collect, and why
Getting a pass or saving interest needs no account: we only ask for data when you fill in that form. Separately there is a free, optional account, open to anyone who wants to say where they're going or manage a venue — detailed below.
Personal account and profile (optional)
To create the account: name, email and password. If you also build a public profile from your panel (not required): a username, your city, a short bio, your Instagram, a profile photo and, if you state one, a professional role (DJ, promoter rep…) — that role shows as what you say you are, never as something we verified, unless a real venue links you to it. Publishing the profile requires declaring you're over 18.
Why:having an account you can use to say «I'm going tonight» (see the card below) and, if you want, a public profile people can recognise. The password is handled by Firebase Authentication and we never see it. The profile is private by default — no public page exists until you decide to publish it.
Proposed retention: as long as the account exists.
Going out tonight
When you say you're going to a venue, event or caseta: your account, the place, the night (ISO, cut off at 06:00 — not the calendar day) and whether you want it counted publicly or privately.
Why:the «X going tonight» counter on each venue. We never show a figure below 5 people — showing «2 people are going» next to public profiles would point at where an identifiable person is about to be, and that isn't a counter. Your specific declaration (which place, which night) is visible only to you; there is never a public history of where you've been.
Retention: 30 days from the declared night — after that it deletes itself, so it never becomes a location record. You can withdraw it yourself sooner from /en/my-night.
Organisation and venue (if you run a business)
If you create an organisation: its name, type, description and, where you provide them, website, Instagram and phone. If you claim a venue, the evidence you send to show you represent it. If your venue uploads photos or proposes changes to its listing: the images and proposed text, reviewed before they go live.
Why: so a venue or organiser can prove who they are and manage their own information. We keep a record of the important actions (creating an organisation, a venue claim and its outcome, photo and listing approvals) so we can audit who did what.
Proposed retention: as long as the organisation exists, and up to 12 months after that for the audit record.
Getting your pass (guestlist)
Name, email, WhatsApp (optional), group size and which plan you pick.
What for: generating your personal QR pass so door staff can check your group in (they see your name and group size, never your email or WhatsApp). This is what makes the business model work — we bill the club per real customer delivered, verified by that same QR. You never pay extra for it.
Proposed retention: 12 months from sign-up, or until you ask us to delete it.
Share an interest
Name, email or WhatsApp, what you're after (a club, an area, a type of plan), group size and timing (optional).
What for: measuring real demand for what you're after. It's not a waitlist for a pass that already exists, and we don't promise an automatic notification — the form itself says so.
Proposed retention: 6 months, or until we reach out or you ask us to delete it.
Submitting an event
Event details (name, venue, date, description, link to a public source) and your contact info (name, email, WhatsApp optional).
What for: reviewing it by hand and, if a source confirms it, publishing it. Your contact info is only used to follow up on that submission — it never gets published alongside the event.
Proposed retention: your contact details are deleted 6 months after we review the submission, published or not.
Analytics (Google Analytics / Firebase)
Page views, route, language, and which button or club you tapped — never your name, email or phone. Only turns on if you accept the analytics cookie.
Full detail in the cookie policy.
Honest note: the retention periods above are our commitment, not yet an automated deletion job — today it's cleared by hand when the date arrives or someone asks. Automating it is a real to-do, not something already built.
Legal basis
In draft: your consent, given by voluntarily filling in each form, is the basis for processing that data for the purpose described next to it. We never use your data for anything beyond what the form itself explains.
Who sees your data
- · The Malaga Fiesta team (today, one person).
- · Door staff see your name and group size when checking your pass in — never your email or WhatsApp.
- · Google Cloud / Firebase, as our database provider (Firestore, eur3 region) and, if you accept the analytics cookie, Google Analytics. They process data on our instructions — they don't decide what happens to it.
- · We never sell or share your data with third parties for commercial use.
Your rights
You can ask us at any time to access, correct or delete your data, limit how we use it, or take it elsewhere. Email hola@malagafiesta.com and we'll handle it by hand — there's no self-service panel for this yet. If you think we've handled it badly, you can complain to Spain's data protection authority (aepd.es).
Minors
Malaga Fiesta is built for adults — actual entry to any venue always depends on that venue's own policy. Publishing your profile means declaring you're over 18; we don't check that against an ID, it's a declaration. We don't knowingly collect data from anyone under 18; if we spot a sign-up that looks like one, we delete it.
Changes
If anything meaningful changes, we update this page and the review date at the top. We don't email you about minor wording tweaks.
This isn't a definitive legal document. It's an honest, clear baseline for an early-stage project, written to genuinely explain what we do with your data today. Before scaling up or charging third parties, this text needs review by a lawyer or a data-protection specialist.