Last updated: [DATE OF PUBLICATION] · Version: [1.0]
Your privacy matters to us. This Privacy Policy explains, in clear language, what personal data MAGHREB NOW collects when you read our blog, subscribe to our newsletter, create an account or contact us; why we collect it; who helps us process it; how long we keep it; and how you can exercise your rights. It complies with the EU General Data Protection Regulation 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).
Key points at a glance
- We collect only the data we need to run the blog, the newsletter and your account.
- We do not sell your data and we do not use it for advertising profiles.
- We do not use analytics or advertising cookies. See our Cookie Policy.
- The newsletter is only sent if you confirm your subscription (double opt-in). You can leave with one click.
- Our website, database and CRM run on our own server. We use carefully selected providers for hosting, email, security and backups, listed below.
- You can access, correct or delete your data, or object to its use, at any time by writing to [PRIVACY CONTACT EMAIL].
1. Who is responsible for your data
Data controller: [LEGAL NAME OF THE COMPANY OR SOLE TRADER]
Tax ID (NIF/CIF): [TAX IDENTIFICATION NUMBER]
Registered address: [FULL REGISTERED ADDRESS]
Privacy contact: [PRIVACY CONTACT EMAIL, e.g. privacy@maghrebnow.com]
General contact: info@maghrebnow.com
Data Protection Officer: [NOT APPOINTED, AS NOT REQUIRED BY ARTICLE 37 GDPR AND ARTICLE 34 LOPDGDD — REVIEW IF ACTIVITY GROWS / OR NAME AND CONTACT OF THE DPO]
2. What this policy covers
This policy applies to maghrebnow.com and to the services available today: the blog, the newsletter, member accounts and the contact forms. If we launch new services (for example community spaces or paid memberships), we will update this policy before they start.
3. The data we process and why
The table below summarises each processing activity. More detail follows after the table.
| Activity | Data | Purpose | Legal basis | How long we keep it |
|---|---|---|---|---|
| Reading the blog | IP address, browser and device information, pages requested, date and time | Deliver the website, keep it secure, detect and block attacks | Legitimate interest in providing a secure website (Art. 6.1.f GDPR) | Server and security logs: up to [30] days. IP bans: while active, up to 1 year, or permanently for repeated serious abuse |
| Account registration and use | Name, username, email, password (stored encrypted), profile photo and profile fields you choose to fill in, account settings, registration date, IP at registration | Create and manage your account and provide the member features | Performance of a contract: these Terms (Art. 6.1.b GDPR) | While the account is active. Deleted or anonymised within [30] days of closing it, except backups |
| Login security and two-factor authentication | Login attempts, IP address, date and time, two-factor settings when enabled | Protect accounts against unauthorised access and brute-force attacks | Legitimate interest in security (Art. 6.1.f GDPR) | Activity log: 30 days. Security logs and evidence of attacks: up to [30] days |
| Comments and User Content | Content you publish, username, date and time, IP address when posting | Publish your contributions and moderate the Platform | Performance of a contract (Art. 6.1.b GDPR) and legitimate interest in moderation (Art. 6.1.f GDPR) | While published, or until you delete them or close your account |
| Newsletter | First name, last name (optional), email, date, time, IP and form used to subscribe, text of the consent accepted, confirmation date, unsubscribe date, email opens and link clicks | Send the newsletter and measure its performance | Your consent (Art. 6.1.a GDPR) | Until you unsubscribe. Proof of consent and of unsubscription: [3 years] afterwards, to demonstrate compliance |
| Contact form | Name, email, topic, subject, message, organisation (optional), acceptance of the Terms and this policy, date, time and IP | Answer your message and keep a record of the conversation | Your request and our legitimate interest in replying (Art. 6.1.b and 6.1.f GDPR) | [12 months] after the conversation is closed, unless needed for a legal claim |
| Service emails | Email address, delivery status, date and time | Send account confirmations, password resets, security notices and replies | Performance of a contract and legitimate interest (Art. 6.1.b and 6.1.f GDPR) | Email delivery logs: 14 days |
| Protection against bots | Information collected by Google reCAPTCHA (see section 6) | Stop spam and automated abuse on login, registration, password reset and forms | Legitimate interest in protecting the Platform (Art. 6.1.f GDPR) | Processed by Google according to its own policies |
| Backups | Copy of the website and database, which may include all the data above | Recover the service after an incident | Legitimate interest in business continuity and security (Art. 6.1.f and Art. 32 GDPR) | Rolling backups: [14] days on our server and in encrypted cloud storage, plus versioned copies for up to [30] days |
| Legal obligations and claims | Data strictly necessary in each case | Comply with requests from authorities and defend legal claims | Legal obligation and legitimate interest (Art. 6.1.c and 6.1.f GDPR) | For the applicable limitation periods |
3.1 Newsletter in more detail
When you subscribe, we save the information above in FluentCRM, a customer relationship tool installed on our own server (it is not a third-party cloud service). We then send you an email to confirm your subscription (double opt-in). Until you confirm, you will not receive the newsletter.
Our newsletter emails contain a small invisible image and links with tracking parameters. They tell us whether an email was opened and which links were clicked. We use this information only in aggregate to improve the newsletter, and to keep our list healthy (for example, removing addresses that never open our emails after a long time). If you click a link in our emails, our website may save a cookie that recognises you as a subscriber so you can manage your preferences without logging in. See the Cookie Policy.
You can withdraw your consent at any time using the unsubscribe link in every email or by writing to us. Withdrawing consent does not affect processing carried out before.
3.2 Data you must give us
Fields marked as required in our forms are necessary to provide the service you ask for. If you do not provide them, we will not be able to create your account, send you the newsletter or answer your message. Optional fields are clearly marked.
3.3 Where your data comes from
We obtain your data directly from you, from your use of the Platform and from the technical information your browser sends automatically. We do not buy data or obtain it from data brokers.
3.4 No automated decisions with legal effects
We do not take decisions about you based only on automated processing that produce legal effects or similarly significantly affect you. Our security systems automatically block IP addresses that show clearly abusive patterns (for example scanning for vulnerabilities or many failed logins). These blocks are temporary, are reviewed by an administrator and can be lifted on request.
4. Who has access to your data
We do not sell or rent your data. Your data is processed by our own team and by the service providers listed below, who act as data processors under contracts that require them to protect it and use it only on our instructions (Article 28 GDPR).
| Provider | Service | Data involved | Location |
|---|---|---|---|
| Hostinger International Ltd. | Virtual private server (VPS) hosting the website, database and CRM, server snapshots and email mailboxes and SMTP sending | All data stored on the Platform, and emails we send and receive | [DATA CENTRE LOCATION OF THE VPS, e.g. EU]. Company in Cyprus (EU) |
| Google Ireland Ltd. (Google LLC) | reCAPTCHA v3, protection against bots on login, registration, password reset and forms | IP address, browser and device data, behaviour on the page, cookies from Google | EU and United States |
| Cloudflare, Inc. | DNS for our domain. [CONTENT DELIVERY NETWORK, SECURITY PROXY AND MEDIA STORAGE (R2) — WHEN ACTIVATED] | IP address, technical data of requests, [MEDIA FILES] | Global network. Company in the United States |
| Amazon Web Services EMEA SARL | [ENCRYPTED BACKUPS IN AMAZON S3 AND EMAIL DELIVERY WITH AMAZON SES — WHEN ACTIVATED] | Backups of the website and database, emails we send | [AWS REGION, e.g. eu-south-2 (Spain) or eu-west-3 (Paris)] |
| [AI ASSISTANT PROVIDER, e.g. Anthropic] | AI-assisted technical administration of the website by our administrators. It may access data stored on the Platform only when needed for maintenance tasks | [DATA ACCESSED DURING MAINTENANCE] | [LOCATION] |
| [OTHER PROVIDERS, e.g. accountant, legal advisers] | [SERVICE] | [DATA] | [LOCATION] |
The software we use to run the Platform (WordPress, BuddyBoss, Fluent Forms, FluentCRM, FluentSMTP and our own security tools) is installed on our server. The companies that create this software do not receive your personal data through it.
We may also disclose data to public authorities, courts or law enforcement when the law requires it.
5. International transfers
Some of our providers are based in, or may access data from, countries outside the European Economic Area, in particular the United States. When this happens, we make sure the transfer is protected by an adequate safeguard:
- the European Commission adequacy decision for the EU-U.S. Data Privacy Framework, for companies certified under it (such as Google, Cloudflare and Amazon Web Services); and/or
- the Standard Contractual Clauses approved by the European Commission, together with additional measures where necessary.
You can ask us for more information about these safeguards by writing to [PRIVACY CONTACT EMAIL].
6. Google reCAPTCHA
We use Google reCAPTCHA v3 on the login, registration, password reset and account activation pages, and on our newsletter and contact forms. reCAPTCHA checks whether an action is being performed by a human or by an automated program. To do this, Google analyses information such as your IP address, the time spent on the page, mouse movements and browser data, and may read or set cookies from google.com. This information is processed by Google under its own Privacy Policy and Terms of Service. We use reCAPTCHA because we have a legitimate interest in protecting the Platform and our users from spam, fraud and automated attacks.
7. Security
We apply technical and organisational measures appropriate to the risk, including:
- encrypted connections (HTTPS) across the whole Platform;
- passwords stored using strong one-way encryption (hashing), never in plain text;
- two-factor authentication for administrators and access limited to people who need it;
- a firewall, automated blocking of abusive IP addresses and protection against brute-force attacks;
- an activity log of administrative actions and login attempts;
- regular software updates and security reviews;
- regular backups, kept encrypted, with restoration tests.
No online service can be completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the Spanish Data Protection Agency within 72 hours and, where required, inform you without undue delay.
8. Your rights
You have the right to:
- Access: know whether we process your data and get a copy of it.
- Rectification: correct inaccurate or incomplete data. You can update most of your data from your account settings.
- Erasure: ask us to delete your data when it is no longer needed or you withdraw your consent.
- Restriction: ask us to limit the processing of your data in certain cases.
- Portability: receive the data you gave us in a structured, commonly used format, or have it sent to another controller.
- Objection: object to processing based on our legitimate interest, including for reasons related to your particular situation.
- Withdraw consent: at any time, without affecting processing carried out before.
- Not to be subject to automated decisions with legal or similarly significant effects.
To exercise your rights, write to [PRIVACY CONTACT EMAIL] or to our registered address, saying which right you want to exercise. If we have reasonable doubts about your identity, we may ask for information to confirm it, but only what is strictly necessary. We will reply within one month. This period may be extended by two more months for complex requests, in which case we will tell you why. Exercising your rights is free.
If you believe we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the data protection authority of your country of residence in the EU. We would appreciate the chance to resolve your concern first.
9. Minors
Our services are not aimed at children. You must be at least [16] years old to create an account or subscribe to our newsletter. Under Article 7 of the LOPDGDD, people under 14 cannot consent to the processing of their data without the authorisation of their parents or guardians. If we learn that we hold data of someone below the minimum age without valid authorisation, we will delete it. If you believe this has happened, please contact us.
10. Links to other websites
Our articles may link to other websites or include embedded content (for example videos or social media posts). Those sites have their own privacy policies, and we are not responsible for how they process your data. Embedded content may collect data about you as if you had visited the other site directly.
11. Changes to this policy
We may update this Privacy Policy to reflect changes in the law, in our services or in the providers we use. We will publish the new version on this page with its date. If the changes are significant, we will inform Members and Subscribers by email or with a notice on the Platform before they take effect.
12. Contact
For any question about this policy or your personal data:
[LEGAL NAME OF THE COMPANY OR SOLE TRADER]
[FULL REGISTERED ADDRESS]
Privacy contact: [PRIVACY CONTACT EMAIL]
General contact: info@maghrebnow.com
See also our Terms of Service, Cookie Policy and Disclaimer.