Privacy policy

The controller of the personal data described in this policy is the owner of DrinkMasterPro:

Controller	TODO_PROPIETARIO: full legal name of the site owner.
Tax ID	TODO_PROPIETARIO: tax identification number (NIF / NIE / CIF).
Address	TODO_PROPIETARIO: publishable postal address.
Contact email	TODO_PROPIETARIO: working contact email address.
Activity	Publishing cocktail recipes in four languages, with affiliate links to barware. Free site, no sign-up.

A Data Protection Officer is not mandatory for this activity, but deciding not to appoint one is recorded as an open item in docs/legal-checklist.md.

This site has no user accounts, no comments and no payment gateway. It therefore collects no phone numbers, postal addresses or bank details from anyone. The only form is the cocktail guide download, and it asks for your email address and, optionally, your first name. What happens is the following:

• Your email and first name, if you subscribe. Only if you type your address, your name (optional) and tick the consent box. They are used to send you the guide you asked for and, afterwards, the newsletter, which may greet you by name. They are stored together with the language of the page you subscribed from and the consent date, and processed through Brevo as a data processor. You can unsubscribe from any email in one click.
• Aggregate visit analytics. I use a self-hosted Umami installation at u.prozacdigital.com to count visits and see which pages are useful. Umami uses no cookies and does not identify people: it stores an anonymous session identifier in the browser's localStorage, with no name, no email and no IP tied to a profile. Analytics are limited to things like the page viewed, the language, the device type, the referring site and the approximate country.
• Email if you write to me. If you send a message to request a correction, exercise your rights or ask a question, I will process your email address and the content of the message for the sole purpose of answering you.
• Affiliate link clicks. When you click an Amazon affiliate link, analytics record that a click happened, together with the page and language it came from. Your identity is not recorded. From that click onwards, Amazon processes data under its own policy.
• Technical server logs. The hosting provider and its content delivery network record the IP address and technical data of each request in order to serve the site and defend it against attacks.
• Typefaces. The site's fonts are served from this same domain rather than from an external service, so no data is sent to a third party for that reason.

No advertising profiles are built and no automated decisions with legal effects on you are taken.

Processing	Legal basis (art. 6 GDPR)
Aggregate, anonymous visit analytics	Legitimate interest in measuring and improving the site (art. 6(1)(f)). The identifier is anonymous and is not combined with other data.
Answering your email	Your consent when you write to me and, where relevant, legitimate interest in handling complaints (art. 6(1)(a) and 6(1)(f)).
Recording affiliate clicks	Legitimate interest in measuring whether the recommendations are useful and in managing the affiliate relationship (art. 6(1)(f)).
Technical and security logs	Legitimate interest in keeping the site available and protected from abuse (art. 6(1)(f)).

You may object to processing based on legitimate interest (art. 21 GDPR). How to do so is explained in the rights section.

• Analytics: aggregate visit data is kept while it remains useful for measuring site performance, and always in aggregate form.
• Email: for as long as needed to handle your enquiry and, afterwards, only while necessary to evidence that it was answered properly.
• Technical logs: for whatever short period the hosting provider applies for security and diagnostics.
• Click records: aggregated, with no personal identifier.

Personal data is not kept for longer than the purposes above require.

I do not sell, rent or hand over your personal data to third parties for commercial purposes. The third parties that may be involved are:

Third party	Why	What it receives
Cloudflare, Inc. Cloudflare Pages + CDN	Hosting and delivery of the site	IP address and technical request data, as a processor
Analytics provider u.prozacdigital.com (self-hosted Umami)	Counting visits in aggregate	Anonymous browsing data and the session identifier; no cookies
Amazon amazon.com and amazon.es, depending on the page language	Destination of an affiliate link when you click one	Only on click: your IP and whatever your browser sends. From then on it is an independent controller
Brevo email service provider	Sending you the cocktail guide and the newsletter, if you subscribe	Your email address, your first name if you provide one, the language of the page you subscribed from and the consent date, as a data processor

I do not carry out international transfers of identifiable personal data myself. Note that Cloudflare and Amazon are providers established outside the European Union, and that their own processing is governed by their policies and contractual safeguards.

If advertising, tracking pixels or newsletters are added later, this table and this policy must be updated before they go live.

You may exercise at any time the rights granted to you by the GDPR and by Spanish Organic Law 3/2018 (LOPDGDD):

• Access: to know whether data about you is processed and what it is.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have data deleted when it is no longer necessary.
• Objection: to object to processing based on legitimate interest, including analytics.
• Restriction: to have processing limited while a complaint is resolved.
• Portability: to receive the data you provided in a reusable format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to TODO_PROPIETARIO: working contact email address. stating which right you are exercising and how the data concerned can be located. I will answer within one month at the latest.

If you believe your rights have not been handled properly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), the competent supervisory authority in Spain.

The site is served over HTTPS, has no user database and stores no credentials. The surface where personal data could appear is therefore very small: aggregate analytics and any email you choose to send me.

This site is aimed at adults of legal drinking age in their own country, because its content is about alcoholic drinks. It is not aimed at children and no children's data is knowingly collected.

Your personal data is not sold, rented, traded or shared with data brokers or advertising networks. The site carries no advertising and no behavioural tracking pixels, and no profile of your browsing is built or enriched with third-party data.

The only money this site earns comes from affiliate commissions on qualifying Amazon purchases, and those commissions are calculated by Amazon from the click itself, not from a profile I hold about you.