> LEGAL // PRIVACY
Privacy policy
Last updated: October 11, 2026
This is what personal data we handle on leboiteux.com, why, for how long and what you can do about it. No small print: if anything is unclear, write to info@leboiteux.com.
Template drafted for Spain (GDPR, LOPDGDD and LSSI-CE). Fill in the details in square brackets and have a professional review it before the site goes live.
1. Who is responsible
- Controller: [Full name or company name of the owner], acting as Le BØ1T3UX.
- Tax ID: [Tax ID].
- Address: [Full postal address].
- Contact and privacy email: info@leboiteux.com. Bookings: info@leboiteux.com.
2. What data we use, why, and on what legal basis
| What | Data | Purpose | Legal basis |
|---|---|---|---|
| Fan account | Email, password (stored with Argon2id: nobody can read it), name or alias and phone if you give them, notification preferences. | Create and run your account, give you exclusive content and presales. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Marketing messages | Email, phone and the channels you choose (email, WhatsApp or SMS). | Tell you about dates, presales and new music. | Your consent, which you can withdraw at any time (Art. 6(1)(a) GDPR and Art. 21 LSSI). |
| Bookings and contact | Name, email, phone, subject and message (for bookings, also date, city, event type and budget). With each message, the IP, approximate location and device you write from. | Reply to you, prepare a quote, keep the conversation going (in your fan area or through the private link we send you) and stop abuse. | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). |
| First-party analytics (only if you accept) | Visitor ID, visit number, pages, time and scroll, clicks, music and videos played, forms started (never what you type), IP, approximate location (country, region, city, provider), device, OS, browser, language, time zone and where you came from (links and campaigns). | Understand how the site is used, improve and personalise it (welcome back, latest mix, dates in your city). If you sign up, this history is linked to your account. | Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI). |
| Precise location | Your device's coordinates, only if you tap “Events near me” and allow it. | Sort dates by distance and, if you accepted analytics, know where people listen from. | Your consent (the browser permission). |
| Security | Sign-in log (IP, device, date and whether it worked), failed attempts and bot protection (Cloudflare Turnstile). | Protect your account and the site from unauthorised access and abuse. | Legitimate interest in security (Art. 6(1)(f) GDPR). |
| Consent records | Date, your choice, policy version, region and a hashed fingerprint of the IP (never the IP itself). | Be able to prove what you agreed to and when. | Legal obligation (Arts. 6(1)(c) and 7(1) GDPR). |
If you don't accept analytics, we only count visits anonymously and in aggregate (page, country, device type and source), with no cookies, without storing your IP and with no way of knowing who you are.
3. Advertising and social networks
Only if you accept marketing cookies do we load the Meta (Instagram and Facebook), Google (Analytics and Ads) and TikTok pixels. They receive the pages you view and actions such as signing up, requesting a booking or clicking on tickets, along with their cookie identifiers. That lets them show you dates and presales on your socials and tells us whether ads work.
To make those measurements reliable we also send those actions from our server to Meta (Conversions API), with your email and phone turned into an irreversible fingerprint (SHA-256 hash). Each platform also handles data under its own privacy policy.
4. Who we share data with
We never sell your data. These providers see it only to provide their service, under contract:
- Web hosting and database: [hosting provider, e.g. Vercel] and [database provider].
- Email delivery: Resend.
- Bot protection: Cloudflare (Turnstile).
- Internal alerts to the team: Telegram, only if we switch it on (it receives the name, email and text of the messages you send us).
- Website error tracking: Sentry, only if enabled (technical details of the error, without your name or email).
- IP location: worked out on our own server with the MaxMind GeoLite2 database; MaxMind receives nothing.
- Marketing, only with your permission: Meta, Google and TikTok.
- Authorities, when the law requires it.
5. Transfers outside the European Economic Area
Some of these providers are in the United States. Transfers rely on the EU-US Data Privacy Framework where the company is certified and, otherwise, on the European Commission's standard contractual clauses.
6. How long we keep data
- Fan account: for as long as you keep it. Deleting it also deletes the visit history of the browsers you signed in with.
- Analytics: the visitor cookie lasts 13 months from your first visit. After the configured retention period 13 months, IP addresses are anonymised.
- Sign-in and security logs: [12 months].
- Bookings and contact: as long as needed to handle the request and then [2 years] in case of claims.
- Consent records: while the data is used and for the limitation periods of any liability.
7. Your rights
You can ask to access, correct or erase your data, object to or restrict its use, take it with you (portability) and withdraw consent at any time, without affecting what was done before. From your fan area you can download your data and delete your account instantly; for anything else, email info@leboiteux.com saying what you need.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority where you live.
8. Minors
You must be at least 14 to sign up (Art. 7 LOPDGDD). Club and festival events may require you to be of legal age under their own terms.
9. Security
The site runs over HTTPS, passwords are stored with Argon2id, sessions use protected (HttpOnly) cookies that you can close from your area, sign-in attempts are limited and there is bot protection.
10. Changes to this policy
If we change anything important we'll publish it here with the new date; if it affects cookies, we'll ask for your permission again.
