Privacy and cookies

Last updated: 1 September 2026.

In short

noalc.es collects little data, and only what is needed to run the site, send you the newsletter if you subscribe, and — if you agree — measure how pages are used. We do not sell data. We do not run behavioural advertising. We do not take automated decisions that affect you.

The controller is the publisher of noalc.es. For privacy questions: privacy@noalc.es. The supervisory authority in Spain is the Spanish Data Protection Agency (AEPD, aepd.es).

This page is the second layer of information. The cookie notice (first layer) and the line under the subscribe form cover the essentials; the detail is here.

Who is the controller

Identity: publisher of the noalc website (noalc.es).

Contact: privacy@noalc.es.

Law that applies: Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and, for cookies and electronic communications, Law 34/2002 (LSSI-CE). The site is aimed mainly at people in Spain and the rest of the European Union.

What we collect and why

We only process data for a stated purpose. This is the inventory:

1. Newsletter. If you subscribe, we store your email address, the interface language (es or en) and the date you signed up. Purpose: to send you notices about noalc content. Legal basis: your consent (Art. 6(1)(a) GDPR) and, for electronic sending, Art. 21 LSSI-CE. It is voluntary: you can browse without giving an email. There is no automated sending yet; we keep the address for when the newsletter is active. You can object or ask to be removed by writing to privacy@noalc.es.

2. Server logs. When you visit, the server automatically stores technical connection data: IP address, date and time, requested URL, response code and, where logged, the browser (user-agent). Purpose: to operate the site, catch errors and protect it against abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We do not use this to profile you or to advertise.

3. Necessary technical cookies. The site sets session and CSRF (request-forgery protection) cookies. Without them the subscribe form and basic security do not work. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). For strictly necessary cookies we do not ask for consent, in line with Art. 22(2) LSSI-CE.

4. Analytics (only with your permission). If you tap “Accept analytics”, we load Google Analytics 4. Google may then process cookie identifiers, pages viewed, approximate device and interaction data, and a pseudonymised IP (we enable IP anonymisation). Purpose: to understand which pages are used, not to show you ads. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). If you choose “Necessary only”, that script is not loaded.

5. Cookie preference. We store your choice (analytics yes or no, and the time) in the browser’s local storage, key `noalc-consent`. It is not an HTTP cookie, but the LSSI-CE treats similar technologies the same way. It stops us asking on every visit and lets us honour a refusal.

6. YouTube videos. On tasting pages the player uses youtube-nocookie.com. If you press play, YouTube (Google) may set cookies and process viewing data under its own policy. That follows from your action on the video, not from merely loading noalc.es.

7. Links to third parties. Some pieces in the feed point to Substack or other sites. Once you leave noalc.es, that third party’s rules apply. We do not send them your newsletter email.

We do not ask for your name, postal address, phone number or payment data. There is no public user account.

Cookies, one by one

• csrftoken (noalc.es): necessary. Stops forged form submissions. Typical life: up to 1 year. First-party.
• sessionid (noalc.es): necessary. Keeps the technical session. Typical life: 2 weeks of inactivity. First-party.
• noalc-consent (local storage, noalc.es): cookie preference. Until you clear it or change the choice in “Cookie settings”. First-party.
• _ga and _ga_* (Google): analytics, only if you consented. Pseudonymous visitor distinction. Typical life: up to 13 months. Third party: Google.
• YouTube / Google cookies when you play a video: third-party. Duration and uses: those set by Google. We do not set them just by your arriving on the site.

We do not use advertising cookies, social-network cookies or cross-site tracking beyond what is listed above.

You can change your choice in “Cookie settings”, in the footer of any page. If you withdraw analytics consent, we stop loading Google Analytics and delete `_ga` cookies we can reach from the browser. Refusing is as easy as accepting.

Recipients

We do not sell data or hand it over so that others can market to you.

The following may have access, as processors or as third parties as the case may be:

• the hosting provider, with servers in the European Union (Germany), to host the site and the database;
• Google Ireland Ltd. / Google LLC, if you accept analytics (Google Analytics 4) or if you play a YouTube video.

Only those who need the data to provide that service have access, with GDPR safeguards.

Transfers outside the EU

Site and newsletter data are hosted in the European Union.

Google may process analytics or YouTube data in the United States or other countries. Google states that it uses the European Commission’s standard contractual clauses and additional measures. That transfer only happens if you consent to analytics or if you play a YouTube video. If you refuse analytics and do not start the video, we do not open that path.

How long we keep data

• Newsletter: while the subscription is active. If you ask to leave, we stop using the address for sending and delete or lock it once we no longer need it to show that consent was withdrawn or to handle a claim.
• Server logs: ordinary operational time, at most 30 days, unless a security incident requires keeping them longer, limited to that investigation.
• Necessary cookies: as in the list above.
• Analytics: for as long as your consent lasts, capped by the cookies themselves (at most 13 months).
• Cookie preference: until you change it or clear this site’s data in the browser.

Your rights

You may exercise, under the GDPR and the LOPDGDD:

• access;
• rectification;
• erasure;
• restriction of processing;
• objection;
• portability;
• withdrawal of consent, where that is the basis (newsletter and analytics), without affecting processing already carried out lawfully.

To exercise them, write to privacy@noalc.es, state the right you are using and a contact email. If we need to identify you, we will ask only for what is strictly necessary.

You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan, 6, 28001 Madrid. You do not have to contact us first, but writing to us usually settles things faster.

There is no solely automated decision-making that produces legal effects or similarly significant effects.

Children

The site is not directed at children under 14 (Art. 7 LOPDGDD). If you are under 14, do not send us your email. If we find a subscription from a child under that age, we delete it.

Security

The site is served over HTTPS. Admin access is not public. We keep data to the minimum described above. No measure is absolute; if an incident affecting your data occurs, we will inform you where the GDPR requires it.

Changes to this policy

If what we collect or how we process it changes, we will update this page and the date at the top. The cookie notice and the subscribe-form text are kept in line with what is described here.