Version of 8 November 2026. The Spanish version prevails over the French and English translations.
This policy explains what personal data MADCINE+ processes, for what purpose, on what legal basis, for how long and what rights you have. It applies Regulation (EU) 2016/679 (RGPD, GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD, Spanish Personal Data Protection and Digital Rights Act). It fulfils the duty to inform under Articles 13 and 14 RGPD and Article 11 LOPDGDD.
1. Data controller
| Detail | Value |
|---|---|
| Controller | GABON CONNECT ESPAÑA, S.L. |
| NIF / CIF | B88909304 |
| Address | Calle Eduardo Chillida, 225, escalera A, 7th floor, door A, 28051 Madrid (Spain) |
| Email for privacy matters | info@madcineplus.com |
| Data protection officer | Not appointed, as it is not mandatory for the owner's activity (Article 37 RGPD and Article 34 LOPDGDD). For any privacy matter: info@madcineplus.com |
2. What data we process
We only process the data needed for each purpose (Article 5.1.c RGPD).
| Category | Data | Where it comes from |
|---|---|---|
| Account | name, email address, password stored as a hash, never in plain text, language, member number | from you, when you register |
| Profiles | profile name, colour, language, children's profile indicator | from you, when you create up to 5 profiles |
| Viewing | work watched, profile, seconds watched, playback position, percentage completed, date | from your use of the service |
| My list | works saved per profile | from you |
| Festival vote | work voted for, award, date | from you, when you vote |
| Payment | customer, subscription, invoice and payment identifiers in Stripe, amount, period paid, status | from Stripe and from you |
| Tickets | ticket type, number of people, access code, associated purchase | from you, when you buy |
| Producers | company name or name, NIF, address, representative, payout account details in Stripe Connect, uploaded works, settlements | from the producer |
| Technical | IP address, device and browser type, security logs | from your device |
| Contact | content of your messages and content notices | from you |
MADCINE+ does not store your card number. Stripe receives and keeps it.
We do not process special categories of data under Article 9 RGPD. We do not build profiles for advertising purposes. Any advertising that may be shown in the service tracks no one: it does not use advertising cookies, device identifiers or viewing data to choose ads.
3. Why we process it and on what legal basis
| Purpose | Legal basis | Retention period |
|---|---|---|
| Create and manage your account and your profiles | performance of the contract, Article 6.1.b RGPD | while the account is active |
| Provide the service: playback, resuming, My list, age restriction on children's profiles | performance of the contract, Article 6.1.b RGPD | while the account is active |
| Charge for the subscription, tickets and producer registration, and issue invoices | performance of the contract, Article 6.1.b RGPD, and legal obligation, Article 6.1.c RGPD | invoices and supporting documents: 6 years (Article 30 of the Código de Comercio, Spanish Commercial Code); 4 years for tax purposes (Article 66 of Ley 58/2003, General Tributaria, Spanish General Tax Act) |
| Calculate producers' remuneration by hours watched | performance of the contract with the producer, Article 6.1.b RGPD, and legitimate interest in an accurate distribution, Article 6.1.f RGPD | individual viewing data: up to 13 months after the settled month; after that, only aggregated figures without personal data |
| Run the vote for the Premio del Público (Audience Award): check that 80% has been watched and that each account votes only once per award | performance of the Festival Rules, Article 6.1.b RGPD | up to 6 months after the gala; after that, the vote is anonymised |
| Produce aggregated statistics for producers (minutes, unique viewers, countries) | legitimate interest, Article 6.1.f RGPD | producers only receive aggregated figures, never data about a single viewer |
| Manage tickets and access to the gala | performance of the contract, Article 6.1.b RGPD | up to 3 months after the event, except invoices |
| Ensure security and prevent fraud in payments, views and votes | legitimate interest, Article 6.1.f RGPD | technical logs: 12 months |
| Handle notices of illegal content and complaints | legal obligation, Article 6.1.c RGPD, in connection with Articles 16 and 17 of Regulation (EU) 2022/2065 on Digital Services (DSA) | as long as needed to resolve them and, after that, for the limitation periods of the relevant claims |
| Send you MADCINE+ news by email | consent, Article 6.1.a RGPD, or Article 21.2 LSSI-CE (Spanish Information Society Services Act) if you are already a customer | until you unsubscribe |
| Answer your requests and bring or defend claims | legitimate interest, Article 6.1.f RGPD | for the applicable limitation periods |
When we close your account, we block the data that the law requires us to keep, under Article 32 LOPDGDD. While blocked, only judges, the Public Prosecutor's Office and the competent authorities can consult it. When that period ends, we delete it.
When we rely on legitimate interest, we have weighed your rights against our interest. You can ask us for the result of that assessment and object to the processing (Article 21 RGPD).
4. Mandatory data and automated decisions
Account and payment data are needed to sign up. Without them we cannot provide the service.
The check that 80% has been watched before voting is automatic. It is an objective condition of the Festival Rules and does not evaluate personal aspects. If you think your viewing has been counted incorrectly, you can ask for a person to review it by writing to info@madcineplus.com. The same applies if a vote or a view is excluded on suspicion of fraud: you can request human intervention, express your point of view and challenge the decision (Article 22.3 RGPD).
5. Recipients and processors
We do not sell your data. We only disclose it in these cases:
| Recipient | Role | Location |
|---|---|---|
| Stripe Payments Europe, Ltd. | payments, subscriptions, invoices, and payouts to producers through Stripe Connect. It acts as a processor for payment processing and as a controller in its own right for its fraud prevention and anti-money laundering obligations | Ireland (EU), with possible transfers to Stripe, Inc. (USA) |
| Cloudflare, Inc. | storage and delivery of the videos (Cloudflare R2, with data hosted in the European Union) and network protection | storage in the EU; company headquartered in the USA |
| Hostinger International Ltd. | application and database servers | European Union (France, Paris) |
| Google Ireland Limited (Google Workspace) | customer service email | Ireland (EU), with possible transfers to Google LLC (USA) |
| Apple and Google | distribution of the mobile apps. They process your data as controllers in their own right under their terms | according to their policies |
| Tax and accounting advisers | accounting and tax obligations | Spain |
| Public authorities, judges and courts | when required by law | Spain |
Each processor processes the data only on our behalf, under a contract that complies with Article 28 RGPD.
Producers do not receive viewers' personal data. They only see aggregated statistics.
6. International transfers
The servers and video storage are in Europe. Some providers are headquartered in the United States or may access data from there, in particular Stripe, Inc. and Cloudflare, Inc. These transfers rely on:
- the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for certified companies (Article 45 RGPD); and, failing that,
- the standard contractual clauses approved by Implementing Decision (EU) 2021/914 (Article 46.2.c RGPD).
You can ask for a copy of the applicable safeguards at info@madcineplus.com.
7. Minors and children's profiles
You must be over 18 to create an account and sign up, because the subscription is a paid contract.
The account holder can create children's profiles for minors in their household. In a children's profile:
- only works rated for all audiences (TP) and for ages 7 and over appear, according to the age rating required by Article 98 of Ley 13/2022, General de Comunicación Audiovisual (Spanish General Audiovisual Communication Act) and the rating system that implements it;
- only the profile name, its colour, its language and its viewing history are processed;
- voting in the Festival and making purchases are not possible;
- no advertising is shown.
The account holder decides to create the profile and is responsible for its use. The account holder exercises the minor's rights. Article 7 LOPDGDD sets 14 as the age at which a person can give consent on their own. Children's profiles are not based on the minor's consent, but on the account holder's contract.
8. Your rights
You can exercise these rights at any time. They are governed by Articles 15 to 22 RGPD and 12 to 18 LOPDGDD:
- access: find out what data we process and get a copy;
- rectification: correct inaccurate data;
- erasure: ask us to delete your data when it is no longer needed;
- objection: object to processing based on legitimate interest or to receiving commercial communications;
- restriction: ask us to suspend processing while a complaint is resolved;
- portability: receive the data you gave us in a structured, machine-readable format;
- withdraw your consent, without affecting earlier processing.
How to exercise them: write to info@madcineplus.com or to Calle Eduardo Chillida, 225, escalera A, 7th floor, door A, 28051 Madrid (Spain), stating the right you are exercising. If we have reasonable doubts about your identity, we may ask you for additional information, only what is necessary (Article 12.6 RGPD). We reply within one month. That period can be extended by two more months if the request is complex; we will tell you within the first month (Article 12.3 RGPD). Exercising your rights is free.
You can also delete profiles and close your account from the "Cuenta" (Account) section of the service.
9. Complaint to the supervisory authority
If you think we have not handled your data properly, you can file a complaint with the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency), C/ Jorge Juan 6, 28001 Madrid, electronic office sedeagpd.gob.es (Article 77 RGPD). If you live in another EU country, you can also contact its authority.
We recommend that you write to us first at info@madcineplus.com or to the data protection officer, if there is one (Article 37 LOPDGDD).
10. Security
We apply technical and organisational measures appropriate to the risk (Article 32 RGPD). These include: encrypted connections, passwords stored with a hash function, session cookies that the page's code cannot access, encrypted videos, restricted access to administration and backups. If a security breach occurs, we will notify the AEPD within 72 hours and, if the risk is high, the people affected (Articles 33 and 34 RGPD).
11. Changes to this policy
If we change this policy in a significant way, we will notify you in the service or by email before the change takes effect.