Flowave / Privacy policy

Privacy policy

We respect your privacy. Here is what data we process, why, and how you can exercise your rights, no fluff.

Data controller

  • Controller: Flowave Creative Crew [COMPLETAR: name or company name]
  • Tax ID (NIF/CIF): [COMPLETAR: the owner’s NIF or CIF]
  • Address: [COMPLETAR: street, number and postcode], Las Palmas de Gran Canaria, Spain
  • Privacy contact: info@flowave.es

What data we process and why

Contact form. When you write to us from the website we process the data you enter: name, email, project type, approximate date (optional) and the content of your message.

  • Purpose: to handle your enquiry and reply to you.
  • Legal basis: your consent (Article 6.1.a GDPR), which you give by ticking the box and submitting the form. You can withdraw it at any time.
  • Retention: while we handle your enquiry and, if it becomes a project, for the duration of the contract and the legal (tax and accounting) retention periods. If nothing comes of it, we delete the email 12 months after the last communication.
  • How it reaches us: by email through Resend to our Google Workspace inbox (see “Who else accesses your data”).

Exotic Generation waitlist. If you join the waitlist for the next edition from an Exotic Generation event page, we process the data you enter: name, email, Instagram (optional), country, the category you compete in, the pack you are interested in and, if you write one, your message (optional).

  • Purpose: to email you about the next edition and its photo and video packs. This is a commercial communication, which is why we ask for a specific checkbox.
  • Legal basis: your consent (Article 6.1.a GDPR and Article 21 of the Spanish LSSI), given by ticking the box and submitting the form. You can withdraw it at any time by replying to any of our emails or writing to info@flowave.es.
  • Retention: until we have told you about the next edition and, at most, 24 months after you signed up, or earlier if you unsubscribe. If you book a pack, for the duration of the contract and the legal retention periods.
  • Recipients: [COMPLETAR: are the waitlist data shared with the Exotic Generation organisers? Variant A: they are not shared, and the text reads “We do not share your data with the event organiser.” Variant B: they are shared only if the person accepts a second checkbox, and the text reads “Only if you accept the second checkbox, we share your name, email and category with the Exotic Generation organisers (the organiser’s legal name and country) so they can inform you about the next edition. They process that data as controllers under their own policy.” Choose one, delete this marker and, for B, add the second checkbox to the form]
  • Adults only: the waitlist and Exotic Generation events are for people aged 18 or over. If we detect data from minors, we delete it.
  • How it reaches us: by email through Resend to our Google Workspace inbox (see “Who else accesses your data”).

Spam protection. The forms use Cloudflare Turnstile to check you are a person. To do so, Cloudflare may process technical data such as your IP address and browser details. This verifier only loads on the contact page and on the Exotic Generation event pages that have a waitlist (on those, only once you start filling in the form), and is not used for advertising.

Browsing data. When you visit the website, Cloudflare (our hosting and content delivery network) temporarily logs technical data such as your IP address, browser and requested pages to serve the site and protect it from attacks and abuse; Turnstile, the forms’ anti-spam check, also processes your IP and browser data. The legal basis is our legitimate interest in the security and operation of the service (Article 6.1.f GDPR). We measure visits with Cloudflare Web Analytics, an aggregated analytics service that does not use cookies or build profiles.

WhatsApp and email. If you contact us through WhatsApp or email, we process your data only to reply to you, under the privacy terms of each service.

Participants and audience of the events we stream. When we record or stream an event as its official media crew, we process the image and voice of performers, judges, organisers and audience, and we publish each performer’s stage name, country and category in the streaming chapters (also in the structured data read by search engines, so you can find your performance).

  • Purpose: to document and share the event, let each performer find and share their performance, and show examples of our work.
  • Legal basis: the performance of the organiser’s assignment and our legitimate interest in documenting a public event (Article 6.1.f GDPR), with the image authorisations collected by the organiser at registration or ticket purchase. To use your image as an example of our packs we ask for your express written consent. [COMPLETAR: confirm that there is a signed image release from each performer who appears in the pack examples (template in docs/legal/cesion-imagen-modelo.md)]
  • Source of the data: the event organiser (running order) and our own recording.
  • Retention: while the event is published on this website. Full recordings are kept as an archive of the work done.
  • Download folders: the folders with each event’s photos and videos are managed by Flowave and the event organiser. If you want us to remove or limit anything in them, write to us.
  • Your rights: if you appear in a video or photo and want it removed, limited or your name corrected, write to info@flowave.es with the event and chapter; you may also object to the processing. We resolve it within one month and may take the content down in the meantime.

Retention periods

  • Contact: while we handle your enquiry and, if nothing comes of it, up to 12 months after the last communication. If it becomes a project, for the duration of the contract and the legal (tax and accounting) retention periods.
  • Exotic Generation waitlist: until we tell you about the next edition and, at most, 24 months after you signed up, or earlier if you unsubscribe.
  • Participants and audience of the events: while the event is published on this website; full recordings are kept as an archive of the work done.
  • Browsing data: Cloudflare’s logs are kept for the period that provider sets for the security of the service.
  • Local storage for the 18+ notice: 30 days in your browser.

Cookies

We do not use our own cookies, nor analytics or advertising cookies, so we do not show you a cookie banner. Cloudflare’s anti-spam verifier only loads on the contact page and on the Exotic Generation event pages with a waitlist (on those, once you start filling in the form), and is not used for advertising. YouTube videos load from youtube-nocookie.com, and every video player (YouTube, Vimeo and Bunny) only loads when you press play or, on streaming pages, when you open a direct link to a performance (on 18+ streamings, after you confirm your age). Once it loads, that provider receives your connection and is governed by its own privacy policy.

Local storage. When you confirm you are over 18 to watch the pole streamings, we save that confirmation (only the date you gave it) in your browser’s local storage (localStorage) for 30 days, so we do not ask you again. It is not a cookie, it is not sent anywhere and you can delete it at any time from your browser settings. This preference is your own choice and only prevents us from asking again, so it does not require consent under cookie rules (Article 22.2 LSSI and the Spanish Data Protection Agency’s guide); we inform you about it here. Cloudflare’s anti-spam check runs in a frame on its own domain (challenges.cloudflare.com) and does not set cookies on flowave.es. Turnstile may store a technical cookie on its own domain, challenges.cloudflare.com (a third party), never on flowave.es.

Who else accesses your data

To provide the service we rely on providers acting as data processors, with whom we have data processing agreements:

  • Cloudflare, Inc. (USA, with an EU entity): hosting, CDN, Turnstile and cookie-free analytics. Certified under the EU-US Data Privacy Framework.
  • Resend, Inc. (USA): delivery of the email carrying your form content to our inbox. [COMPLETAR: check resend.com/legal/dpa to see whether Resend is certified under the EU-US Data Privacy Framework; if it is not, replace this marker with “Under the European Commission’s standard contractual clauses.”]
  • Google Ireland Ltd. (Google Workspace): our email and storage; the messages you send us are kept there. Google is certified under the EU-US Data Privacy Framework.
  • Bunny.net d.o.o. (Slovenia, EU): hosting and player for the streamings. It only connects when you load a player (pressing play or opening a direct link to a performance) and receives your IP and technical playback data, including the player’s own quality metrics.
  • YouTube (Google) and Vimeo: only when you press play on a video hosted there, under their own policies.
  • WhatsApp and Instagram (Meta Platforms Ireland): only if you choose to contact us through them.

Some of these providers process data outside the European Economic Area (in the United States) with appropriate safeguards: EU-US Data Privacy Framework certification or the European Commission’s standard contractual clauses. We do not sell your data or share it with anyone else, except where required by law or as stated for the waitlist.

Minors

This website is not aimed at children under 14 and its forms must not be used by them; the pole streaming section is for adults aged 18 or over. If you believe we have collected data from a minor, write to us and we will delete it.

Automated decisions

We do not make automated decisions or build profiles with your data.

Mandatory data

In the forms, fields marked as required are needed to assist you; the rest are optional. Without the required ones we cannot handle your enquiry or waitlist sign-up.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to info@flowave.es. Tell us your name and the right you want to exercise; we may ask you to verify your identity. We reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Changes to this policy

If we change anything significant, we will update it here. We suggest checking back from time to time.

Last updated: 13 October 2026.