LEGAL

Privacy Policy

Last updated: September 30, 2026

See also our Legal Notice.

1. Data controller

  • Controller: MAGIC BROS SL
  • Address: Calle de Las Pedroñeras, 14 — 28043 Madrid (Spain)
  • Tax ID: B84744796 · VAT ID: ESB84744796
  • Privacy contact email: [email protected]

2. What data we collect

We only collect personal data that you voluntarily provide through the Site:

  • When you subscribe to our updates list: your email address, the interest categories you select (RetroBox Modem and/or the BBS history book), your explicit consent, and the date and time you confirm your subscription (this timestamp determines your position on the Founders Offer list, which is managed in strict confirmation order).
  • When you email us: your email address and the content of the message you send.
  • Limited technical data: the subscription form uses Cloudflare Turnstile, a verification service that helps distinguish people from automated programs (bots) and which may process, to a limited extent, your IP address and technical browser data for this sole purpose.

We do not collect special categories of data (health, ideology, ethnic origin, etc.) or data from minors.

3. Purposes of processing

  • Sending you updates about the RetroBox Modem project and, if selected, about the book.
  • Managing the Founders Offer list and, once the Enclosure Pack is ready, contacting the first 60 confirmed subscribers in strict confirmation order, with kit information and a special offer.
  • Responding to enquiries you send us by email.
  • Protecting the subscription form against spam and abusive automated use.

We do not use your data to build advertising profiles, nor do we share it with third parties for commercial purposes.

4. Legal basis for processing

The legal basis for sending updates and managing the Founders Offer list is your explicit consent (Article 6(1)(a) of the General Data Protection Regulation, GDPR), given by checking the consent box and confirming your email address through a double opt-in system. You may withdraw this consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

The legal basis for the form's anti-spam verification is our legitimate interest (Article 6(1)(f) GDPR) in protecting the Site and subscribers from automated abuse.

5. Retention period

We keep subscriber data for as long as you remain subscribed to the updates list. Confirmation links expire after 48 hours; pending subscriptions that are not confirmed are removed after an additional seven-day grace period. Anti-abuse signup records containing a hashed IP value are deleted after 30 days. If you unsubscribe, email communications stop immediately and, after 30 days, the stored email address and other direct identifiers in the subscription record are anonymised. Subscription event history may then be retained in anonymised form to document consent, unsubscription and Founders-list integrity. Contact emails are kept only for as long as necessary to handle and follow up your enquiry, unless a legal obligation requires longer retention.

6. Recipients and data processors

We do not sell or share your personal data with third parties for commercial purposes. We rely on technology providers acting as data processors, who only access your data to provide their services to us, in accordance with our instructions and, where required, a data processing agreement:

  • Infrastructure, hosting and anti-spam protection providers for the Site (including Cloudflare, Inc.).
  • The provider used to manage delivery of the updates mailing list.

7. International data transfers

Some of the providers mentioned above may process data on servers located outside the European Economic Area. In such cases, we ensure that the transfer is subject to appropriate safeguards under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses or another valid transfer mechanism.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by writing to [email protected], indicating the right you wish to exercise and, if necessary, attaching a document to verify your identity.

If you believe that the processing of your data does not comply with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), at www.aepd.es, or with the data protection authority of your own country of residence.

9. Minors

The Site and its content are not directed at minors. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with their data without the consent of a parent or guardian, please let us know at [email protected] so that we can delete it.

10. Cookies and similar technologies

The Site only uses strictly necessary technical cookies and technologies, in particular those associated with the subscription form's anti-spam verification service (Cloudflare Turnstile). We do not currently use third-party analytics or advertising cookies. Should this change in the future, we will update this policy and request your consent where legally required.

The Site also uses privacy-preserving first-party analytics to understand aggregate use of the project website. A random analytics session identifier is kept temporarily in first-party browser storage and shared across tabs of the same browser for up to eight hours so that simultaneous tabs are not counted as separate active visitors. A local session-start timestamp is also stored so that aggregate repeat-visit rates can be estimated without storing a permanent visitor identifier. Our own backend receives the page path, country code supplied by Cloudflare, referring domain, UTM campaign values, device category, browser language, an anonymous repeat-visit yes/no flag, approximate active time and limited interaction events such as viewed sections and scroll milestones. It does not store the visitor's IP address, email address or raw browser user-agent for analytics. Session-level analytics records are automatically removed after 30 days; aggregated daily metrics may be retained for up to 400 days. Global Privacy Control and Do Not Track are respected.

11. Information security

We apply reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or alteration, appropriate to the risk of the processing we carry out.

12. Changes to this policy

We may update this privacy policy to reflect legislative changes or changes in how we process your data. The date of the current version is shown at the top of this document. We recommend checking it periodically.

13. Contact

For any query relating to this policy or to the processing of your personal data, you can write to us at [email protected].