Privacy Policy

Last updated: October 2026

This policy explains what personal data is processed on miguelhiroshi.com, for what purposes and what your rights are, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

  • Controller: Miguel Hiroshi
  • Tax ID (NIF): 75145008Y
  • Address: Cortijo Wanihiro, Era Empedrá n.º 5, 18414 Pitres (Granada), Spain
  • Phone: +34 679 297 181
  • Email: info@miguelhiroshi.com

2. What data we process, why and on what legal basis

Processing

Data

Purpose

Legal basis

Contact form

Name, email address and message

To reply to your enquiry about concerts, courses, workshops or other matters

Your consent (Art. 6.1.a GDPR) and, if your enquiry concerns a course or activity, steps taken at your request prior to entering into a contract (Art. 6.1.b GDPR)

Direct email

The data you include in your message

To reply to your message

Your consent (Art. 6.1.a GDPR)

Web analytics (Google Analytics 4)

Pseudonymised browsing data: pages visited, device, approximate location

To understand how the website is used in order to improve it

Your consent through the cookie banner (Art. 6.1.a GDPR and Art. 22.2 LSSI)

Website security

IP address, access logs and technical browser and device data

To protect the website against attacks, fraudulent use and automated submissions (spam) in the form using Google reCAPTCHA

The controller’s legitimate interest in the security of the website (Art. 6.1.f GDPR)

Fields marked as required in the form are needed to reply to you. No automated decisions are made and no profiles are built from your data.

3. How long we keep your data

  • Enquiries via the form or email: for as long as needed to handle them and for no more than 12 months after the last communication, unless they lead to a relationship (for example, enrolment in a course), in which case the data will be kept for the duration of that relationship and for the legally required periods thereafter.
  • Web analytics: 14 months in Google Analytics.
  • Security logs: for the period set by the hosting provider and the security plugin, which does not usually exceed a few months.

After these periods, the data is deleted or blocked in accordance with Article 32 of the LOPDGDD.

4. Recipients and processors

Your data is not disclosed to third parties unless required by law. The following providers are involved in running the website and act as data processors:

Provider

Service

Location

Nominalia Internet S.L.

Web hosting and email

Spain (EU)

Google Ireland Limited

Google Analytics and Google reCAPTCHA

Ireland (EU), with possible access from the US

Defiant Inc. (Wordfence)

Website security: analysis of suspicious IP addresses

United States

International transfers. Google LLC is certified under the EU-US Data Privacy Framework, recognised by the European Commission as providing an adequate level of protection. For other providers outside the EU, the standard contractual clauses approved by the European Commission apply.

Online shop. Tickets, courses, workshops and instruments are purchased at shop.miguelhiroshi.com, which runs on Shopify. That processing is governed by the privacy policy published in the shop itself.

Social networks and music platforms. This website only links to Instagram, YouTube, Spotify, TikTok and other platforms; it does not embed their content. When you visit them, their own privacy policies apply.

5. Your rights

You may exercise the following rights at any time:

  • Access to your data.
  • Rectification of inaccurate data.
  • Erasure when the data is no longer needed or you withdraw your consent.
  • Objection to processing based on legitimate interest.
  • Restriction of processing in the cases provided for in the GDPR.
  • Portability of the data you have provided to us.
  • Withdrawal of consent, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise them, write to info@miguelhiroshi.com or by post to the address in section 1, stating which right you wish to exercise. If necessary to verify your identity, we may ask you for additional information. We will reply within one month.

If you believe your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence in the EU.

6. Minors

This website is not intended for children under 14. If you are under that age, please do not send us your data without the consent of your parents or guardians (Art. 7 LOPDGDD).

7. Security

The website uses an encrypted connection (HTTPS) and applies appropriate technical and organisational measures to protect your data against loss, unauthorised access or alteration.

8. Changes to this policy

This policy may be updated due to legal changes or changes in how the website works. The version in force is always the one published on this page, with its last updated date.