Privacy policy

1. Controller

The controller is José Navarro Astiasarán, Spanish tax ID 73482428G, Arberoki 5, 31180 Zizur Mayor (Navarra, Spain), telephone +34 689 484 679, email josenav97@gmail.com.

2. Scope

This Privacy Policy applies when you browse the website, activate a magnet, access a private album, create or use a PIN, upload photos or videos, edit dates or descriptions, download content, use shared-gallery features, request PIN recovery, contact support or interact with administrative/security features.

3. Service philosophy

NFC Magnets is built for private memories. Album content is not intended to be public, sold to advertisers or used for advertising profiling. The service processes content to provide the album experience, protect access and maintain the platform.

4. Personal data concept

Photos, videos, descriptions, voices, faces, dates, filenames, location clues and metadata may identify people directly or indirectly and may therefore be personal data. Users should treat images and videos of third parties with the same care as any other personal data.

5. Data categories

• Identity and contact data: name or email if provided, support messages, PIN recovery information and the optional 10-year photo email preference.
• Album data: magnet key, status, album name, language, activation dates, accepted legal versions, batch or branding configuration.
• Legal-acceptance evidence: activation or PIN-access event, date and time, language, version and cryptographic hash of each legal document, exact checkbox wording, magnet/session identifiers, encrypted IP address, keyed IP hash and user agent.
• Authentication and security: hashed PIN, failed attempts, locks, sessions, access logs, IP address, user agent, timestamps.
• User content: photos, videos, descriptions, display dates, uploaded files, filenames and voluntary edits.
• Media technical data: mime type, extension, size, dimensions, duration, thumbnails, compressed versions and processing results.
• Metadata: capture dates or EXIF-derived information where technically available and used for display or organization.
• Support and legal data: communications, complaints, rights requests, takedown notices and evidence needed to handle them.
• Essential cookies/session data: language, session continuity, security and access state.

6. Source of data

Data may be provided by users, generated by the platform during use, extracted from uploaded files where technically available, assigned by an administrator or batch configuration, or received from a person making a support, privacy or takedown request.

7. Purposes

• activate, authenticate and maintain private albums;
• store, display, process, compress and generate thumbnails for media;
• allow uploads, downloads, deletion, descriptions, dates and album configuration;
• provide shared-gallery features where enabled;
• maintain security, detect misuse, prevent brute force and investigate incidents;
• provide support, PIN recovery, user communications and the optional 10-year photo email reminder if requested;
• comply with legal obligations and respond to lawful requests;
• defend rights, handle claims and preserve evidence where necessary;
• record and demonstrate the affirmative acceptance of the Terms and delivery of privacy information;
• remember essential preferences and improve technical stability.

8. Legal bases

• Contract or requested service: activation, album access, uploads, downloads, display, PIN operation and album management.
• Legitimate interest: security, abuse prevention, service diagnostics, fraud prevention, proof of electronic acceptance, defence of claims and continuity, after balancing those interests against user rights.
• Legal obligation: accounting, legal requests, consumer, data-protection or authority requirements where applicable.
• Consent: optional future features, non-essential communications or operations requiring explicit permission.
• Vital/public interests: only in exceptional cases where content indicates immediate serious harm and disclosure is legally justified.

9. Private photos and videos

Photos and videos are stored for private album use and served through controlled routes linked to the album. NFC Magnets does not intentionally make album content public. Any person with valid access credentials may view content, so users must protect credentials. Video is optional and may be enabled or disabled platform-wide and for each batch; when disabled, existing videos may remain stored but be hidden and unavailable through the interface.

If shared galleries are enabled, a connection requires a request and acceptance with the recipient album’s PIN. While connected, people with valid access to either album can view and download the shared photos and associated descriptions/display dates. The current shared gallery does not disclose uploaded videos. Unlinking stops in-service access but cannot erase copies already downloaded to another person’s device.

10. Third parties appearing in content

If users upload content featuring other people, the uploader selects the purpose, material and intended audience and is responsible for ensuring a lawful basis and respecting privacy, honour, image rights and intellectual property. Depending on the circumstances, the uploader may act within the personal/household exemption or may have their own duties as a controller. NFC Magnets remains responsible for processing it performs as platform operator. This distinction is especially important for minors, intimate contexts, vulnerable people and private events.

11. Children

The service is not directed at children. Content relating to minors should be uploaded only by parents, guardians or authorized persons and only where it is appropriate and lawful. NFC Magnets may delete or restrict content if it receives credible notice of unlawful processing involving minors.

12. Sensitive data

Users should avoid uploading health information, identity documents, financial data, passwords, exact addresses, school data, intimate images or other highly sensitive information unless strictly necessary and legally justified.

13. Storage and private areas

Album files are intended to be stored in private storage rather than public folders. The system may generate thumbnails, processed versions and temporary files to display or download content. Temporary files may be removed automatically.

14. Retention

• Album content is kept while the album remains active or until deletion is requested/performed.
• The optional 10-year photo email preference is kept while the album remains active or until the user changes the registered email or asks for deletion where applicable.
• Deleted content may remain marked as deleted for a limited time or until cleanup processes run.
• Security logs are kept as needed to protect the service and investigate incidents.
• Support and rights communications are kept while necessary to handle the request and possible liabilities.
• Legal-acceptance evidence is retained while needed to prove the electronic relationship and, after it ends, for applicable legal limitation periods or while a claim is pending. It is then deleted, anonymized or blocked as required.
• Legal or accounting data is retained for statutory limitation periods.

15. Deletion and blocking

When data is no longer necessary, it may be deleted, anonymized or blocked where legal retention is required. Immediate physical deletion cannot always be guaranteed due to backups, security logs, technical caches or legal-preservation duties.

16. Recipients

Data is not sold. It may be accessed by hosting, storage, infrastructure, maintenance, security, email, backup or technical providers acting as processors; by administrators strictly where necessary; and by authorities or courts when legally required. When an album connection is accepted, photos and their visible metadata are disclosed to people who authenticate into the connected album according to the sharing rules above; those recipients may save independent copies.

17. International transfers

If any provider processes data outside the European Economic Area, NFC Magnets will use the safeguards required by data-protection law, such as adequacy decisions, standard contractual clauses or other valid mechanisms.

18. Cookies

The website uses cookies or similar technologies that are necessary for session operation, legal-token protection, language preference and secure access. These cookies are not intended for advertising profiling. If non-essential cookies are introduced, information and controls will be provided where required.

19. Security

Measures may include hashed PINs, private storage, validation of file types, upload limits, session protections, throttling, failed-attempt controls, audit logs, sanitization of text inputs, security headers, private download routes, administrative access controls, application-level encryption of IP addresses in acceptance records and keyed hashes used for comparison without exposing the address directly.

20. No absolute security

No digital service can guarantee absolute security. Users should protect their PIN, avoid sharing private links, keep personal backups and notify NFC Magnets if they suspect unauthorized access.

21. Automated decisions

NFC Magnets does not make decisions producing legal or similarly significant effects based solely on automated processing. Technical validations may automatically reject files that exceed limits or present security risks.

22. Profiling and advertising

NFC Magnets does not use uploaded memories to build advertising profiles and does not sell album content to advertisers.

23. User rights

Users and affected persons may request access, rectification, erasure, objection, restriction, portability and withdrawal of consent where applicable by writing to josenav97@gmail.com.

24. Identity verification

To protect private albums, NFC Magnets may require reasonable identity, authority or ownership verification before disclosing, modifying or deleting data. Requests lacking sufficient proof may be refused or limited.

25. Requests from people appearing in photos or videos

A person appearing in content may request review or removal by providing sufficient information to identify the content and their rights. NFC Magnets may balance rights, verify identity, contact the album holder where appropriate and act according to law.

26. Complaints

Users may lodge a complaint with the Spanish Data Protection Agency (AEPD) if they believe their data-protection rights have been infringed, without prejudice to other remedies.

27. Required data

Some data is necessary to provide the service and document the electronic relationship, such as album identifiers, PIN data, session/security data and the legal-acceptance record. Uploaded files are voluntary, but they are necessary if the user chooses to use media features. If required data or the affirmative acceptance is not provided, activation or PIN access cannot be completed.

28. Administrator access

Administrative access is limited to what is reasonably necessary for configuration, support, moderation, legal compliance and security. Administrators should not access private content without a legitimate operational, legal or support reason.

29. Incident management

If a security incident affects personal data, NFC Magnets will assess the risk and, where legally required, notify the competent authority and affected persons within applicable timeframes.

30. Backups

Backups may exist for service continuity. Backup deletion may follow separate cycles. Users should not rely on NFC Magnets as their only backup of important memories.

31. Future features

If payments, online orders, messaging, advanced sharing, analytics or other features are added, this policy may be updated and additional information or consent mechanisms may be introduced where required.

32. Contact

Privacy questions and rights requests may be sent to José Navarro Astiasarán at josenav97@gmail.com or Arberoki 5, 31180 Zizur Mayor (Navarra, Spain).