Privacy and cookies

Last updated: 12 October 2026.

In short

noalc.es collects little data, and only what is needed to run the site, send you the newsletter if you subscribe, reply if you write via the contact form, store a rating or an article topic if you send one and, if you agree, measure how pages are used. We do not sell data. We do not run behavioural advertising. We do not take automated decisions that affect you.

The controller is Askar Nadyrshin, publisher of noalc.es. For privacy questions: privacy@noalc.es. The supervisory authority in Spain is the Spanish Data Protection Agency (AEPD, aepd.es).

This page is the second layer of information. The cookie notice (first layer) and the line under the subscribe form cover the essentials; the detail is here.

Who is the controller

Identity: Askar Nadyrshin, a natural person, publisher of the noalc website (noalc.es).

Contact: privacy@noalc.es. For general enquiries: info@noalc.es and the form at /en/contact/. The same details appear in the legal notice (/en/legal/).

Law that applies: Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and, for cookies and electronic communications, Law 34/2002 (LSSI-CE). The site is aimed mainly at people in Spain and the rest of the European Union.

What we collect and why

We only process data for a stated purpose. This is the inventory:

1. Newsletter. If you subscribe, we store your email address, the interface language (es or en) and the date you signed up. Purpose: to send you notices about noalc content. Legal basis: your consent (Art. 6(1)(a) GDPR) and, for electronic sending, Art. 21 LSSI-CE. It is voluntary: you can browse without giving an email. There is no automated sending yet; we keep the address for when the newsletter is active. You can object or ask to be removed by writing to privacy@noalc.es.

2. Contact form. If you write from /en/contact/ (or /es/contact/), we process the name, email and message you submit, plus technical request data. Purpose: to reply to collaboration, press or other enquiries. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and, where the enquiry implies a pre-contractual step, Art. 6(1)(b). The message is sent to info@noalc.es; we do not create a user account. We keep the email for as long as needed to reply and, where relevant, to evidence how the request was handled. The form uses an arithmetic captcha and a honeypot field against bots.

3. Server logs. When you visit, the server automatically stores technical connection data: IP address, date and time, requested URL, response code and, where logged, the browser (user-agent). Purpose: to operate the site, catch errors and protect it against abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We do not use this to profile you or to advertise.

4. Necessary technical cookies. The site sets session and CSRF (request-forgery protection) cookies. Without them the subscribe, contact and article-rating forms and basic security do not work. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). For strictly necessary cookies we do not ask for consent, in line with Art. 22(2) LSSI-CE.

5. Analytics (only with your permission). Every page includes the Google Analytics 4 tag (gtag.js), with the consent mode Google asks for in the European Economic Area. Until you accept, analytics storage stays denied: no `_ga` cookies are set and visitors are not distinguished from visit to visit. Google may receive a technical, cookieless request (page and network data, with a pseudonymised IP). If you tap “Accept analytics”, we update consent and Google may then process cookie identifiers, pages viewed, approximate device and interaction data, and a pseudonymised IP (we enable IP anonymisation). Purpose: to understand which pages are used, not to show you ads. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). If you choose “Necessary only”, analytics cookies are not set. Google advertising signals stay off.

6. Cookie preference. We store your choice (analytics yes or no, and the time) in the browser’s local storage, key `noalc-consent`. It is not an HTTP cookie, but the LSSI-CE treats similar technologies the same way. It stops us asking on every visit and lets us honour a refusal.

7. YouTube videos. On tasting pages the player uses youtube-nocookie.com. If you press play, YouTube (Google) may set cookies and process viewing data under its own policy. That follows from your action on the video, not from merely loading noalc.es.

8. Links to third parties. Some pieces in the feed point to Substack or other sites. Once you leave noalc.es, that third party’s rules apply. We do not send them your newsletter or contact-form email.

9. Article rating. At the end of an article you can score it from 1 to 5 stars and, if you want, suggest a topic for another article. We store the score, the text you write, the page language and the date. We do not ask for a name or an email. Purpose: to see which pieces work and which topics are of interest. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). It is voluntary: if you close the window, nothing is stored. If you send the note or close it, the browser remembers that choice in local storage (key `noalc-article-feedback`) or for the session (`noalc-article-feedback-hide`) so we do not ask again on that article. You can object by writing to privacy@noalc.es.

We do not ask for your postal address, phone number or payment data. There is no public user account.

Cookies, one by one

• csrftoken (noalc.es): necessary. Stops forged form submissions. Typical life: up to 1 year. First-party.
• sessionid (noalc.es): necessary. Keeps the technical session. Typical life: 2 weeks of inactivity. First-party.
• noalc-consent (local storage, noalc.es): cookie preference. Until you clear it or change the choice in “Cookie settings”. First-party.
• noalc-article-feedback (local storage, noalc.es): remembers that you already rated an article, so we do not ask again. Until you clear the site data. First-party.
• _ga and _ga_* (Google): analytics, only if you consented. Pseudonymous visitor distinction. Typical life: up to 13 months. Third party: Google.
• YouTube / Google cookies when you play a video: third-party. Duration and uses: those set by Google. We do not set them just by your arriving on the site.

We do not use advertising cookies, social-network cookies or cross-site tracking beyond what is listed above.

You can change your choice in “Cookie settings”, in the footer of any page. If you withdraw analytics consent, we deny analytics storage again and delete `_ga` cookies we can reach from the browser. Refusing is as easy as accepting.

Recipients

We do not sell data or hand it over so that others can market to you.

The following may have access, as processors or as third parties as the case may be:

• the hosting provider, with servers in the European Union (Germany), to host the site and the database;
• Google Ireland Ltd. / Google LLC, if you accept analytics (Google Analytics 4) or if you play a YouTube video.

Only those who need the data to provide that service have access, with GDPR safeguards.

Transfers outside the EU

Site and newsletter data are hosted in the European Union.

Google may process analytics or YouTube data in the United States or other countries. Google states that it uses the European Commission’s standard contractual clauses and additional measures. Analytics cookies and the persistent identifier only turn on if you consent. The Google tag is on the pages in any case, with analytics storage denied until you accept. If you play a YouTube video, that path opens separately.

How long we keep data

• Newsletter: while the subscription is active. If you ask to leave, we stop using the address for sending and delete or lock it once we no longer need it to show that consent was withdrawn or to handle a claim.
• Contact form: for as long as needed to reply and handle the enquiry; afterwards only if a limited copy is required for legal duties or claims.
• Article ratings: while they are useful for the editorial line, for 24 months at most, and sooner if you ask for erasure.
• Server logs: ordinary operational time, at most 30 days, unless a security incident requires keeping them longer, limited to that investigation.
• Necessary cookies: as in the list above.
• Analytics: for as long as your consent lasts, capped by the cookies themselves (at most 13 months).
• Cookie preference: until you change it or clear this site’s data in the browser.

Your rights

You may exercise, under the GDPR and the LOPDGDD:

• access;
• rectification;
• erasure;
• restriction of processing;
• objection;
• portability;
• withdrawal of consent, where that is the basis (newsletter and analytics), without affecting processing already carried out lawfully.

To exercise them, write to privacy@noalc.es, state the right you are using and a contact email. If we need to identify you, we will ask only for what is strictly necessary.

You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan, 6, 28001 Madrid. You do not have to contact us first, but writing to us usually settles things faster.

There is no solely automated decision-making that produces legal effects or similarly significant effects.

Children

The site is not directed at children under 14 (Art. 7 LOPDGDD). If you are under 14, do not send us your email. If we find a subscription from a child under that age, we delete it.

Security

The site is served over HTTPS. Admin access is not public. We keep data to the minimum described above. No measure is absolute; if an incident affecting your data occurs, we will inform you where the GDPR requires it.

Changes to this policy

If what we collect or how we process it changes, we will update this page and the date at the top. The cookie notice and the subscribe-form text are kept in line with what is described here.