Privacy policy

1. Data controller

Controller: a natural person operating as a self-employed professional (autónomo) under Spanish tax number (NIF) 77545311Y, owner and editor of Archivo Bélico (archivobelico.com). The address for the service of notices is provided on request at the contact address below.

Data protection contact: contacto@archivobelico.com. No Data Protection Officer has been appointed, as none of the cases in Article 37 GDPR applies.

2. Data processed and its source

Contact form: name, email address and the content of the message, provided voluntarily by the person concerned.

Collaboration proposal form: name, email address, topic or proposal and message, together with an irreversible pseudonym of the IP address, used solely to limit the number of submissions and prevent automated abuse. The pseudonym is an HMAC-SHA256 code computed with a secret key known only to the server: it is not reversible encryption, the IP cannot be recovered from it, and the IP itself is never stored. No registration is required to send a proposal.

Technical connection data: the IP address is read from the technical headers added by the hosting provider's delivery network ("cf-connecting-ip" or, failing that, "x-forwarded-for"). It is used to compute the anti-spam pseudonym described above and, only temporarily and in server memory, to limit access attempts to the private area (a 15-minute lockout after 5 failed attempts); it is not stored in the database. The hosting provider may keep its own technical logs under its own policy.

Protection against automated traffic: so that bot visits are not counted and forms cannot be submitted automatically, the server checks on the fly, without storing them, the approximate country supplied by the delivery network ("cf-ipcountry"), the browser identifier ("user-agent"), the language declared by the browser and the origin of the request. In the browser, without sending these signals anywhere, the site checks that there has been a genuine interaction and that the page has been visible for a few seconds before a visit is counted. Legal basis: legitimate interest in the security of the site and the accuracy of its statistics (Article 6(1)(f) GDPR).

No special categories of data (Article 9 GDPR) are processed, and no data is collected from sources other than the person concerned.

3. Children

The site and its forms are not aimed at children under 14 (Article 7 of Spanish Organic Law 3/2018). If you are under that age, please do not send personal data without the authorisation of your parents or legal guardians. Data found to have been received from a child without that authorisation will be deleted.

4. Purposes of processing

1) To handle and reply to enquiries, suggestions or corrections sent through the form or the contact address.

Messages and pitches are saved in the admin panel and a copy is sent to the publisher at contacto@archivobelico.com for handling. Notifications include the name, email address, content and, for pitches, the topic; they do not include the IP pseudonym or bot-protection signals.

2) To assess collaboration proposals, communicate with the person submitting them and, if a proposal is accepted, publish the content and credit its authorship. Nothing is published automatically: every proposal goes through manual editorial review.

3) To limit the number of submissions per sender in order to prevent spam and automated abuse.

4) To keep the site secure, prevent improper access and retain minimal technical logs.

5) To measure internally and in aggregate which pages are most visited, only where the visitor has accepted this in the cookie notice. This measurement builds no profiles and does not identify visitors.

6) To comply with applicable legal obligations.

No automated decision-making or profiling with legal effects on users takes place.

5. Legal basis (Article 6 GDPR)

Consent of the person concerned (Art. 6(1)(a)) for handling messages sent through the contact form, for assessing collaboration proposals and for internal page-view measurement. On the forms it is given by ticking the box accepting this policy, which is never pre-ticked; without it, nothing is recorded. Consent may be withdrawn at any time without retroactive effect.

Legitimate interest of the controller (Art. 6(1)(f)) for site security and the prevention of abuse and automated submissions, after balancing it against users' rights.

Performance of a collaboration relationship (Art. 6(1)(b)) where a proposal is accepted and data must be processed to publish the content and credit its author.

Compliance with legal obligations (Art. 6(1)(c)) where retention or disclosure is required by law.

6. Retention periods

Contact messages are kept for the duration of the exchange and, afterwards, for a maximum of twelve months, unless a legal obligation or a possible claim requires longer.

Collaboration proposals that are not accepted are kept for a maximum of twelve months from receipt. Where a proposal is accepted, the data needed to credit authorship is kept for as long as the content remains published.

The IP pseudonym used for anti-spam control is stored with the proposal and deleted with it. Counters of access attempts to the private area exist only in memory and expire after 15 minutes.

Deletion is automatic: whenever a message or proposal is received, or reviewed from the admin panel, the system removes records older than twelve months. Any message or proposal can also be deleted earlier at the request of the person concerned.

This automatic deletion applies to the admin panel, not the email inbox. The publisher must also delete emailed copies in line with the periods above and when fulfilling an erasure request.

7. Recipients and processors

Data is not disclosed to third parties except where required by law or by a competent authority. No disclosure takes place for commercial or advertising purposes.

Providers acting as processors: the web hosting and deployment provider, the database and storage provider, Resend for sending form notifications and the receiving mailbox provider. Access is limited to providing the service and must be governed in accordance with Article 28 GDPR; it is not disclosure for their own or advertising purposes.

The site's typefaces are served from its own domain: loading a page opens no connection to Google Fonts or to any other third-party service that would receive your IP address.

8. International transfers

Some infrastructure providers may process data outside the European Economic Area. Where they do, transfers rely on European Commission adequacy decisions or on standard contractual clauses, with any additional safeguards required.

9. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated decisions, and may withdraw consent previously given.

To do so, send a request to contacto@archivobelico.com stating the right you wish to exercise and including a means of verifying your identity. Requests are answered within one month at most.

If you believe your rights have not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

10. Security measures

Appropriate technical and organisational measures are applied under Article 32 GDPR: HTTPS traffic encryption, access control to the private area with credentials never stored in plain text (only as a cryptographic digest), signed sessions that expire and are revoked on sign-out, rate limiting on access attempts, IP pseudonymisation, automatic deletion once retention periods expire, and minimisation of the data collected.

11. Changes to this policy

This policy may be updated to reflect legal changes or new processing activities. The version in force is always the one published on this page.

12. Contact

For any question about this document: contacto@archivobelico.com.