Privacy Policy

Who is responsible for your data

This website (zivael.com) is run by Zivaël. If you have a question about your data, or you want to use one of the rights listed further down, email [email protected]. You will get an answer within one month.

The short version

This site does not track you. There are no analytics cookies, no advertising pixels and no embedded social media players. Visitors are counted without cookies and without storing IP addresses. The only personal data here is what you type in yourself: a message through the contact form, or your email address for release updates.

What is collected, and why

1. The contact form

What: your name, your email address, the subject and your message.
Why: to read your message and answer it.
Legal basis: legitimate interest, Article 6(1)(f) GDPR, in answering someone who gets in touch.
How long: no longer than 24 months after the conversation has ended.

2. Release updates by email

What: your email address, and your name if you choose to fill it in.
Why: to let you know when new music is out.
Legal basis: your consent, Article 6(1)(a) GDPR.
How it works: after signing up you get one email with a confirmation link. Without that click, nothing is ever sent. Every email after that has an unsubscribe link, and one click is enough.
How long: until you unsubscribe.

If you are under 16, please ask a parent or guardian before you subscribe.

3. Visitor statistics

What: the date, the address of the page, and a counter. That is genuinely all.
Not collected: no IP address, no browser fingerprint, no cookie, no profile, and nothing that follows you to other websites.
Why: to see which pages people actually read.
Legal basis: legitimate interest, Article 6(1)(f) GDPR. Because nothing identifiable is stored, these numbers cannot be traced back to you.
How long: 400 days, then deleted automatically.

4. Server logs

What: your IP address, the page requested, the moment of the request and your browser type.
Why: security, and tracking down faults.
Legal basis: legitimate interest, Article 6(1)(f) GDPR.
How long: 14 days, then deleted automatically.

Cookies

Two cookies are placed, and both are needed for the site to work safely:

rj-websites-session: keeps your visit together while you use the contact form.
XSRF-TOKEN: protects that form against misuse from other websites.

Both expire after one hour. Strictly necessary cookies like these do not require consent under Article 11.7a of the Dutch Telecommunications Act, which is why there is no cookie banner. No other cookies are used.

Links to Spotify, YouTube and Instagram

Those are ordinary links, not embedded players. Nothing is loaded from those companies while you are on this site, and they learn nothing about your visit until you click. From the moment you do, their own privacy policies apply.

Who else handles your data

RJ Websites: builds and hosts this website and the panel behind it, as a processor under a data processing agreement.
Hetzner Online GmbH (Germany): the servers and the backups. Inside the EU.
Cloudflare: traffic to www.zivael.com passes through Cloudflare, which blocks attacks and speeds the site up. It processes IP addresses to do that. Cloudflare is based in the United States; those transfers are covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
Mailgun (EU region): sends the email from the contact form and the release updates. Servers inside the EU.

Your data is never sold, rented out, or used for advertising.

Your rights

Under the GDPR you can ask to:

See what personal data is held about you, and get a copy.
Correct anything that is wrong or incomplete.
Delete your data.
Restrict what is done with it.
Receive it in a common, machine readable file.
Object to processing based on legitimate interest.
Withdraw your consent for the release updates at any time, which is what the unsubscribe link does.

Email [email protected] to use any of these. If you are not happy with the answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Security

The site runs over HTTPS, is hosted inside the EU, and the contact form is protected against automated spam. Messages and email addresses can only be reached by the site owner and the platform administrator, behind a password. No system is perfect, but if something ever goes wrong with your data you will be told about it.

Changes to this policy

If the site starts doing something new with data, this page is updated first. The date at the top always shows the version you are reading.

Version 1.0, effective 1 September 2026.