Privacy policy

This policy explains what personal data we collect on thehanfrisquartet.com, what we use it for and what rights you have, under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

Data controller

• Controller: Associació Musical Hanfris
• Tax ID (CIF): G-65784241
• Address: Carrer Tetuan, 20, 08302 Mataró (Barcelona)
• Email: thehanfrisquartet@gmail.com

What data we process and why

Booking requests

When you write to us through the booking form we collect your name, your email address and, if you give them to us, your phone number, the date and place of the performance and whatever you tell us in your message. We use them to reply to you and, where appropriate, to prepare and manage the booking.

• Legal basis: your consent, which you give by sending the form (art. 6.1.a GDPR), and steps taken at your request before entering into a contract (art. 6.1.b GDPR).
• Retention: as long as needed to handle the request. If no booking follows, we delete them within a year at most; if there is one, we keep them for as long as legal, accounting and tax obligations require.

Emails you send us

If you write to us directly by email, we use your address and the content of your message to reply to you, on the same legal basis and for the same period as booking requests.

Access to the admin dashboard

The people authorised to manage the website sign in with their email address and a single-use link. We store their address, the link (encrypted) and a record of their sessions (identifier, browser and dates) to identify them and protect access.

• Legal basis: our legitimate interest in keeping the website secure (art. 6.1.f GDPR).
• Retention: sign-in links expire after 15 minutes and sessions after 30 days.

Spam protection

The forms use ALTCHA, a check your browser solves with a small calculation, with no cookies, no tracking and no third-party services. It helps us stop automated submissions (legitimate interest, art. 6.1.f GDPR).

Technical data

Like any website, the server may log technical data about visits (IP address, browser, page requested and time) to keep it working and secure. We keep it for a short time and do not use it to identify anyone, unless it is needed to investigate an attack or the law requires it.

Who we share data with

We do not pass your data on to anyone, except where the law requires it. To run the website we rely on providers that process it only on our behalf and under contract: website and database hosting, and email. Booking requests reach us at a Gmail account, run by Google, which may process data outside the European Economic Area with the safeguards the GDPR provides (the EU-US Data Privacy Framework and standard contractual clauses).

If you press “Watch the video” on a show page, your browser connects to YouTube, owned by Google, which receives your IP address and the technical details of the connection under its own privacy policy. Until you press it, the page sends YouTube nothing.

Your rights

You can exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: correct it if it is inaccurate.
• Erasure: ask us to delete it.
• Objection to and restriction of processing.
• Portability: receive it in a structured format.
• Withdraw the consent you have given, without affecting earlier processing.

Write to us at thehanfrisquartet@gmail.com or by post to Carrer Tetuan, 20, 08302 Mataró (Barcelona), saying which right you wish to exercise. We will reply within one month. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Children

The website is not aimed at children under 14. If you are under 14, please do not send us personal data without your parents’ or guardians’ consent.

Security

We apply technical and organisational measures to protect the data: encrypted connections, access restricted to authorised people, and sign-in links and sessions stored so that they could not be reused if someone obtained them.

Changes

We may update this policy if the way we handle data changes. The date of the latest version is at the top of the page. If the change is significant, we will announce it on the website.