Privacy policy
Plain language, not legal padding: what we ask for, what we use it for, and what you can do about it. This isn't a text drafted by a law firm — it's an honest baseline for a project still getting started. Before we charge clubs or scale up traffic, it needs a proper legal review (see the note at the bottom).
Who's behind this
Malaga Fiesta is run by one person, based in Málaga (Spain). There's no registered company behind the site yet — once there is, this section will carry the full legal name, tax ID and address. Until then, the one real contact is:
What we collect, and why
We only ask for data when you fill in a form. No account, no password, no user profile.
Getting your pass (guestlist)
Name, email, WhatsApp (optional), group size and which plan you pick.
What for: generating your personal QR pass so door staff can check your group in (they see your name and group size, never your email or WhatsApp). This is what makes the business model work — we bill the club per real customer delivered, verified by that same QR. You never pay extra for it.
Proposed retention: 12 months from sign-up, or until you ask us to delete it.
Save interest
Name, email or WhatsApp, what you're after (a club, an area, a type of plan), group size and timing (optional).
What for:letting you know once there's a reviewed option that matches. It's not a waitlist for a pass that already exists — the form itself says so.
Proposed retention: 6 months, or until we reach out or you ask us to delete it.
Submitting an event
Event details (name, venue, date, description, link to a public source) and your contact info (name, email, WhatsApp optional).
What for: reviewing it by hand and, if a source confirms it, publishing it. Your contact info is only used to follow up on that submission — it never gets published alongside the event.
Proposed retention: your contact details are deleted 6 months after we review the submission, published or not.
Analytics (Google Analytics / Firebase)
Page views, route, language, and which button or club you tapped — never your name, email or phone. Only turns on if you accept the analytics cookie.
Full detail in the cookie policy.
Honest note:the retention periods above are our commitment, not yet an automated deletion job — today it's cleared by hand when the date arrives or someone asks. Automating it is a real to-do, not something already built.
Legal basis
In draft: your consent, given by voluntarily filling in each form, is the basis for processing that data for the purpose described next to it. We never use your data for anything beyond what the form itself explains.
Who sees your data
- · The Malaga Fiesta team (today, one person).
- · Door staff see your name and group size when checking your pass in — never your email or WhatsApp.
- · Google Cloud / Firebase, as our database provider (Firestore, eur3 region) and, if you accept the analytics cookie, Google Analytics. They process data on our instructions — they don't decide what happens to it.
- · We never sell or share your data with third parties for commercial use.
Your rights
You can ask us at any time to access, correct or delete your data, limit how we use it, or take it elsewhere. Email hola@malagafiesta.com and we'll handle it by hand — there's no self-service panel for this yet. If you think we've handled it badly, you can complain to Spain's data protection authority (aepd.es).
Minors
Malaga Fiesta is built for adults — actual entry to any venue always depends on that venue's own policy. We don't knowingly collect data from anyone under 18; if we spot a sign-up that looks like one, we delete it.
Changes
If anything meaningful changes, we update this page and the review date at the top. We don't email you about minor wording tweaks.
This isn't a definitive legal document. It's an honest, clear baseline for an early-stage project, written to genuinely explain what we do with your data today. Before scaling up or charging third parties, this text needs review by a lawyer or a data-protection specialist.