Privacy policy

Data controller

• Controller: Frank García (NIF 44312831L)
• Address: Calle Lentisco, 20, Almatriche Alto, 35018, Las Palmas de Gran Canaria, España
• Contact and rights-exercise email: hola@cineflownexus.com

No Data Protection Officer has been appointed, as it is not mandatory under art. 37 GDPR. You can send any privacy query to the email above.

What data we process, why, and the legal basis

1. Waitlist sign-up

Data: your email address. Purpose: manage your sign-up, send the confirmation email and notify you when access opens. Legal basis: your consent (art. 6.1.a GDPR), given via a voluntary, non-pre-ticked checkbox.

2. Security and abuse prevention

Data: partial/truncated IP address, browser identifier (user-agent) and referrer, collected by our server. Purpose: protect the form and prevent fraudulent use (rate-limiting and bot detection via a honeypot field). Legal basis: legitimate interest (art. 6.1.f GDPR). We have balanced this interest against your rights: the processing is necessary and proportionate (truncated, minimal data, not linked to your email and not directly identifying you), so it prevails without harming your rights. You may object to it.

3. Proof of consent

Data: technical record that you accepted the processing (timestamp and checkbox state). Purpose: demonstrate that consent was validly given (accountability, art. 7.1 GDPR). Legal basis: compliance with a legal obligation (art. 6.1.c GDPR).

4. Web analytics (only if you accept)

Data: site usage information collected by Google Analytics 4 and Microsoft Clarity (page views, interactions, device data and, in Clarity, pseudonymised session replay and heatmaps). Purpose: measure and improve the site. Legal basis: your consent (art. 6.1.a GDPR), requested in the cookie notice and revocable at any time. If you do not accept it, these tools are not loaded. See the Cookie Policy.

No special categories of data are processed (art. 9 GDPR). No profiling or automated decision-making with legal or similar effects takes place (art. 22 GDPR).

International data transfers

If you accept analytics cookies, using Google Analytics 4 and Microsoft Clarity entails an international data transfer to the United States, where Google LLC and Microsoft Corporation are based.

Both entities are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and additionally apply Standard Contractual Clauses as a further safeguard (art. 46 GDPR).

However, we inform you that the United States may not offer a level of protection equivalent to the European Economic Area and that, despite these safeguards, there is a risk that US public authorities may request access to your data. For this reason these tools are only activated with your explicit consent, which you can withdraw at any time from the cookie settings panel. Otherwise, the rest of your data is hosted and processed on servers located in the European Union.

Who do we share your data with?

We do not share your data with third parties, except where legally required. To provide the service we rely on the following data processors, with whom the contracts required by art. 28 GDPR have been signed:

• Hosting provider for the site and database, with servers in the European Union.
• Outbound email (SMTP) provider, in the European Union, to send the confirmation email.
• Error-monitoring provider (Sentry), processing in the European Union, to detect and fix technical faults.
• If you accept analytics cookies: Google Ireland Ltd. / Google LLC (Google Analytics 4) and Microsoft Corporation (Microsoft Clarity), under the international transfers section.

We do not sell your data or share it with advertisers.

How long do we keep your data?

• Email address: until the purpose is fulfilled (access launch) or until you ask to be removed, whichever comes first. After launch, if you do not confirm you wish to stay on the list, your email is deleted within a maximum of 6 months.
• Technical security data (truncated IP, user-agent, referrer): for the time strictly necessary for security, up to a maximum of 12 months, after which it is deleted or anonymised.
• Proof of consent: for the duration of the processing and, after removal, blocked during the legal limitation periods.
• Analytics data: according to each tool's retention periods stated in the Cookie Policy.

Security of your data

We apply technical and organisational measures appropriate to the risk (art. 32 GDPR): encrypted communications (HTTPS/TLS), restricted access to the server and database, backups and storage in the European Union. If a security breach with a high risk to your rights occurred, we would inform you and notify the AEPD under arts. 33 and 34 GDPR.

Your rights

• Access, rectification, erasure (right to be forgotten), objection (including processing based on legitimate interest), restriction and portability.
• Withdraw consent at any time, without affecting the lawfulness of prior processing (art. 7.3 GDPR). Withdrawing is as easy as giving it.
• Not be subject to automated decisions: no profiling is carried out.

How to withdraw consent

• Launch notice: clicking the unsubscribe link in each email, or writing to hola@cineflownexus.com.
• Analytics: reopening the "Cookie settings" panel from the site footer and choosing "Reject".

How to exercise your rights

By writing to hola@cineflownexus.com stating the right you wish to exercise. To identify you it is enough to write from the address you signed up with; only in case of reasonable doubt could we ask for additional verification (art. 12.6 GDPR). We will reply within a maximum of one month (extendable to two in complex cases, art. 12.3 GDPR). Exercising your rights is free.

Complaint to the supervisory authority

If you believe the processing does not comply with the rules, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, e-office https://sedeagpd.gob.es. We would appreciate it if you first let us know at hola@cineflownexus.com so we can try to resolve it.

Providing your email is necessary to sign up; without it we cannot process your registration. You agree that the data is accurate.

Minors and changes

This site is not directed at children under 14. If we learned that a child under that age provided their data without the consent of their parent or guardian, we would delete it. We may amend this policy to reflect legal or processing changes; if changes are substantial, we will inform you and, where appropriate, obtain your consent again.