Privacy policy

1. In one sentence

The site itself collects nothing: no cookie, no tracker, no audience measurement. We only keep personal data when you give it to us: by subscribing to the newsletter, by writing to us, by signing up for a gathering, or by joining the ecosystem.

2. Who the data controller is

Registered office: Barcelona, Catalonia — Spain
Email address: contacto@musima.org
Tax number (NIF): Being assigned
Registration: Registration application under way with the Register of Associations of the Generalitat de Catalunya. The registration number and the NIF will be published on this page as soon as they are assigned. In the meantime, the association can be reached and identified through the details above.

No data protection officer has been appointed: the association falls under none of the cases that make one mandatory under article 37 of the GDPR. Requests are handled at the address given above.

The association’s registration with the Generalitat de Catalunya is under way. The NIF and the registration number will be added here as soon as they are assigned. That changes nothing about your rights: they apply from today, at the contact address given.

3. What we process, and what for

Data	Your email address and the date you signed up. Nothing else: no name, no individual open tracking, no profiling.
Purpose	Sending you the association’s news: upcoming gatherings, new writing. A handful of emails a year.
Legal basis	Your consent — article 6.1.a of the GDPR — given by ticking the box when you sign up. The box is never pre-ticked.
Retention	Until you unsubscribe, or after three years with no interaction on your part. Your address is then deleted.
Recipient	Brevo (see section 4).

Contact form

Data	What your message is about, your first name, your last name, your email address, your phone number, the message if you write one, the language of the page and the time you sent it.
Purpose	Answering you. And, only if you tick the second box, telling you about upcoming gatherings — that is a separate purpose, consented to separately, and refusing it changes nothing about the first. Signing up for a gathering is a separate case, described below.
Legal basis	Your consent for processing your message — article 6.1.a of the GDPR — and, for keeping your contact details, a second consent given separately. No box is ever pre-ticked.
Retention	Two years from our last exchange. Your details are then deleted, from our mailbox and from Brevo alike.
Recipients	Brevo, which carries the notification email and the acknowledgement, and which stores your details if you agreed to it (see section 4). Nobody else.
The particular bit	Sending goes through our own server, at our host. Your browser contacts no domain outside musima.org: nothing is loaded from Brevo while you fill the form in.

Signing up for a gathering

Data	The same as for the contact form, plus the gathering you are signing up for.
Purpose	Managing your participation: counting the seats, confirming the practical details, telling you about any last-minute change.
Legal basis	Managing the participation you yourself request — article 6.1.b of the GDPR. It depends on no box: signing up is asking to take part. The retention box still governs, separately, the use of your details to tell you about future gatherings.
Retention	In the gathering’s own list, until it has taken place and its follow-up is closed; your data is then removed from that list. If you also ticked the retention box, it stays in the contacts list under the conditions described above.
Recipient	Brevo, which records the sign-up in a list dedicated to the gathering, separate from the contacts list (see section 4).

The ecosystem form

Data	Your first and last name, your email address, your phone number if you give it, your profile (entrepreneur, professional, student…), what you can bring and what you are looking for, your project or organisation and your public links (Instagram, LinkedIn, website) if you give them, the language of the page, the date of sending and where the visit came from (QR code or web), with no cookie.
Purpose	Contacting you about MUSIMA’s activities and possible collaborations, and putting you in touch with other people, projects or organisations in the ecosystem. Public links are used to present you and put you in touch. The phone number is used only if you would rather be reached on WhatsApp.
Legal basis	Your consent — article 6.1.a of the GDPR — given by ticking the box on the form. The box is never pre-ticked.
Retention	Two years after our last exchange. Your data is then deleted, from our mailbox and from Brevo.
Recipient	Brevo, which records your details in a list of its own for the ecosystem, separate from the others (see section 4). Nobody else.

The host’s connection logs

Data	IP address, page requested, timestamp, browser type — recorded by the host, not by us.
Purpose	Serving the pages and protecting the site from attacks.
Legal basis	Legitimate interest in the security and proper running of the site — article 6.1.f of the GDPR.
Retention	A short period, set by the host. We have no access to these logs and draw no statistics from them.

Photographs of gatherings

Gatherings are sometimes photographed. Published images are published with the agreement of the recognisable people in them — legal basis: consent. If you appear in a photo and want it gone from the site, write to us: we take it down, without argument and without delay.

4. Who your data is passed to

We do not sell, swap or hand over any data. Only two providers are involved, each in a precise area:

Brevo	Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France. Carries the newsletter, the contact form's notification email and its acknowledgement, and stores, in separate lists, sign-ups for gatherings, the details of anyone who joins the ecosystem, and those of anyone who expressly agreed to be kept informed. Data hosted in the European Union. A processing agreement under article 28 of the GDPR governs this arrangement.
Cloudflare, Inc.	101 Townsend Street, San Francisco, CA 94107, United States. Hosts and distributes the site. It is a company established in the United States: any transfers outside the European Union are covered by the European Commission’s standard contractual clauses and, where applicable, by the EU—US Data Privacy Framework.

Brevo

Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France. Carries the newsletter, the contact form's notification email and its acknowledgement, and stores, in separate lists, sign-ups for gatherings, the details of anyone who joins the ecosystem, and those of anyone who expressly agreed to be kept informed. Data hosted in the European Union. A processing agreement under article 28 of the GDPR governs this arrangement.

Cloudflare, Inc.

101 Townsend Street, San Francisco, CA 94107, United States. Hosts and distributes the site. It is a company established in the United States: any transfers outside the European Union are covered by the European Commission’s standard contractual clauses and, where applicable, by the EU—US Data Privacy Framework.

5. Your rights

The General Data Protection Regulation and Spanish Organic Law 3/2018 (LOPDGDD) give you the following rights:

Access — to know whether we process data about you, and which.
Rectification — to have an inaccurate detail corrected.
Erasure — to have your data deleted.
Restriction — to ask for a processing operation to be frozen.
Objection — to object to processing based on legitimate interest.
Portability — to get your data back in a machine-readable format.
Withdrawal of consent — at any time, without justifying yourself, and without affecting what was done before. For the newsletter, the unsubscribe link is in every email; an email to us is enough too.

How to exercise them: write to contacto@musima.org. We answer within one month. No justification is asked of you, and a deletion request is acted on straight away. It is free.

If our answer does not satisfy you, you can turn to the Spanish supervisory authority: the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.

6. Cookies

This site sets no cookies. The detail — including the only value stored on your device and why there is no consent banner — is on the page about cookies.

7. Minors

The newsletter is not aimed at children under fourteen, the age set by article 7 of the LOPDGDD for consenting to the processing of their own data. If you notice that a minor has signed up without their guardians’ agreement, tell us: we will delete the address.

8. Security

The site is served over HTTPS only. It has no database, no user accounts and no storage space reachable from outside: the attack surface has deliberately been kept to a minimum. Access to the content management interface is restricted to authorised people in the association.

9. Updates to this policy

Last updated: 3 September 2026. If this policy changes substantially, the new version will be published on this page and newsletter subscribers will be told by email.