Skip to content
// privacy policy

Privacy Policy

I. Privacy policy and data protection

In accordance with applicable legislation, https://bants.dev/ (hereinafter, also the “Website”) undertakes to adopt the technical and organisational measures necessary, according to the level of security appropriate to the risk of the data collected.

Laws reflected in this privacy policy

This privacy policy is adapted to current Spanish and European rules on the protection of personal data on the internet. In particular, it reflects the following:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
  • Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPD-GDD).
  • Royal Decree 1720/2007 of 21 December approving the implementing regulation of Organic Law 15/1999 of 13 December on the protection of personal data (RDLOPD).
  • Law 34/2002 of 11 July on information society services and electronic commerce (LSSI-CE).

Identity of the controller of personal data

The controller of the personal data collected on https://bants.dev/ is: Joan Antoni Barnes Woodward (Anthony Barnes), Consultant, Software Engineer and Director, with tax identification number (NIF): 53627987Z (hereinafter, the “Controller”). Contact details are as follows:

Address: Avenida De Madrid 3,
Benissa 03720
Alicante
Spain

Contact email: [email protected]

Register of personal data

In compliance with the GDPR and the LOPD-GDD, we inform you that personal data processed through this Website (described in section II) are incorporated into and processed in the filing system of the Controller, in order to operate and secure the Website and to deal with any request or enquiry from the User. Likewise, in accordance with the GDPR and the LOPD-GDD, unless the exception in Article 30(5) GDPR applies, a record of processing activities is maintained that specifies, according to its purposes, the processing activities carried out and the other circumstances established in the GDPR.

Principles applicable to the processing of personal data

The processing of the User’s personal data shall be subject to the following principles set out in Article 5 GDPR and Article 4 et seq. of Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights:

  • Lawfulness, fairness and transparency: the User’s consent shall be required at all times following fully transparent information on the purposes for which personal data are collected.
  • Purpose limitation: personal data shall be collected for specified, explicit and legitimate purposes.
  • Data minimisation: personal data collected shall only be those strictly necessary in relation to the purposes for which they are processed.
  • Accuracy: personal data must be accurate and kept up to date.
  • Storage limitation: personal data shall only be kept in a form that permits identification of the User for as long as necessary for the purposes of processing.
  • Integrity and confidentiality: personal data shall be processed in a manner that ensures appropriate security and confidentiality.
  • Accountability: the controller shall be responsible for ensuring that the above principles are complied with.

Categories of personal data

The categories of data processed by the Controller are technical data (such as IP address, browser and device information, and the pages requested) and, only if the User writes to this site, identification and contact data (name and email address, and the content of the message). Under no circumstances are special categories of personal data processed within the meaning of Article 9 GDPR.

Legal basis for processing personal data

The legal basis depends on the processing: the legitimate interest of the Controller in operating, securing and delivering the Website (Article 6(1)(f) GDPR) for server logs, the content delivery network and security checks; the User’s consent (Article 6(1)(a) GDPR) for Google Analytics and any other cookie or similar technology that is not strictly necessary; and the User’s own request (Article 6(1)(b) GDPR) when the User writes to this site.

The User shall have the right to withdraw consent at any time. It shall be as easy to withdraw consent as to give it. As a general rule, withdrawal of consent shall not condition use of the Website.

Where the User must or may provide their data through forms to make enquiries, request information or for reasons related to the content of the Website, they will be informed if completion of any of them is mandatory because they are essential for the proper performance of the operation carried out.

Purposes for which personal data are processed

Personal data are collected and managed by the Controller in order to facilitate, expedite and fulfil the commitments established between the Website and the User or the maintenance of the relationship established in the forms completed by the User, or to deal with a request or enquiry, and, only if the User accepts analytics cookies, to measure how the Website is used (Google Analytics).

At the time personal data are obtained, the User will be informed about the specific purpose or purposes of the processing to which the personal data are intended; that is, the use or uses that will be given to the information collected.

Retention periods for personal data

Personal data shall only be retained for the minimum time necessary for the purposes of their processing and, in any case, only for the following periods: messages sent by the User, for as long as needed to deal with the request and any follow-up; server and security logs, for the limited period set by the hosting and network providers for security and troubleshooting; Google Analytics event-level data, 2 months (only if the User accepts analytics cookies); cookie consent choices and analytics cookies, as stated in the Cookie Policy.

At the time personal data are obtained, the User will be informed of the period for which the personal data will be retained or, where that is not possible, the criteria used to determine that period.

Recipients of personal data

The User’s personal data are not sold, and are not shared with third parties for their own purposes. The service providers listed in section II process data on behalf of this site, as processors, only to provide their services.

In any case, at the time personal data are obtained, the User will be informed about the recipients or categories of recipients of the personal data.

Personal data of minors

In accordance with Articles 8 GDPR and 7 of Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights, only persons aged 14 or over may lawfully give consent for the processing of their personal data by the Controller. If the data subject is under 14, the consent of parents or guardians is required for processing, and this shall only be lawful to the extent that they have authorised it.

Confidentiality and security of personal data

The Controller undertakes to adopt the technical and organisational measures necessary, according to the level of security appropriate to the risk of the data collected, so as to ensure the security of personal data and prevent accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorised access to or disclosure of such data.

The Website has an SSL (Secure Socket Layer) certificate, which ensures that personal data are transmitted securely and confidentially, as transmission of data between the server and the User, and in feedback, is fully encrypted.

However, because the Controller cannot guarantee the absolute security of the internet or the total absence of hackers or others who fraudulently access personal data, the Controller undertakes to notify the User without undue delay when a personal data breach likely to result in a high risk to the rights and freedoms of natural persons occurs. Following Article 4 GDPR, a personal data breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Personal data will be treated as confidential by the controller, who undertakes to inform of and ensure through a legal or contractual obligation that such confidentiality is respected by its employees, associates, and anyone to whom the information is made accessible.

Rights arising from the processing of personal data

The User may exercise against the Controller the following rights recognised in the GDPR and Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights:

Right of access: the User’s right to obtain confirmation as to whether or not the Controller is processing their personal data and, where appropriate, to obtain information about their specific personal data and the processing carried out or being carried by the company, including, among other things, information available on the origin of such data and the recipients of communications made or envisaged.

Right to rectification: the User’s right to have inaccurate personal data concerning them rectified or, taking into account the purposes of processing, completed where incomplete.

Right to erasure (“right to be forgotten”): the User’s right, unless otherwise provided by applicable law, to obtain the erasure of their personal data when they are no longer necessary in relation to the purposes for which they were collected or processed; the User has withdrawn consent to processing and there is no other legal ground; the User objects to processing and there are no overriding legitimate grounds; the personal data have been unlawfully processed; the personal data must be erased for compliance with a legal obligation; or the personal data have been collected in relation to the offer of information society services to a child under 14. In addition to erasure, the Controller shall, taking account of available technology and the cost of implementation, take reasonable steps to inform controllers which are processing the personal data that the data subject has requested the erasure of any links to those personal data.

Right to restriction of processing: the User’s right to limit the processing of their personal data. The User has the right to obtain restriction of processing where they contest the accuracy of their personal data; the processing is unlawful; the Controller no longer needs the personal data for the purposes of processing but the User needs them for the establishment, exercise or defence of legal claims; and where the User has objected to processing.

Right to data portability: where processing is carried out by automated means, the User shall have the right to receive from the Controller their personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller. Where technically feasible, the Controller shall transmit the data directly to that other controller.

Right to object: the User’s right not to have their personal data processed or to have processing of such data ceased by the Controller.

Right not to be subject to a decision based solely on automated processing, including profiling: the User’s right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where provided by applicable law.

Accordingly, the User may exercise their rights by written communication to the Controller with the reference “GDPR- https://bants.dev/”, specifying:

  • Name and surname of the User and a copy of their ID. Where representation is permitted, identification by the same means of the person representing the User, as well as documentary proof of representation, shall also be required. A photocopy of the ID may be replaced by any other valid means in law that proves identity.
  • The request with the specific grounds for the request or the information to which access is sought.
  • Address for notifications.
  • Date and signature of the applicant.
  • Documents supporting the request made.

This request and any other attached document may be sent to the following address and/or email:

Address: Avenida De Madrid 3,
Benissa 03720
Alicante
Spain

Email: [email protected]

Links to third-party websites

The Website may include hyperlinks or links that allow access to third-party websites other than the Controller, and which are therefore not operated by it. The owners of such websites will have their own privacy policies and are themselves, in each case, responsible for their own files and privacy practices.

Complaints to the supervisory authority

If the User considers that there is a problem or breach of applicable rules in the way their personal data are being processed, they shall have the right to effective judicial remedy and to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.

In the case of Spain, the supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es/).

II. How this Website processes personal data

What this Website does and does not collect

This Website is Anthony Barnes’s personal site (Consultant, Software Engineer and Director). It has no user accounts, newsletter, contact form or shop, and comments are closed. It does not use advertising tools and does not build advertising profiles of its visitors. It uses Google Analytics 4 to measure how the Website is used, but only if the User accepts analytics cookies (see “Google Analytics” below).

If the User writes to the contact email address in the Legal Notice, the message and the sender’s details are used only to reply.

Hosting and server logs

The Website is hosted by Cloudways Ltd (Malta) on servers provided by DigitalOcean in Amsterdam, the Netherlands. As with any website, the server records technical data for each request (IP address, date and time, page requested, browser and referring page) in order to deliver the Website, detect abuse and fix problems. The server also runs a security firewall, which may briefly show an automated browser check to traffic that looks like a bot.

Content delivery network

Pages and images are delivered through a content delivery network that runs on Cloudflare’s global network (Cloudflare, Inc., United States). This means requests, including the User’s IP address, pass through Cloudflare servers, often in a location close to the User, so that pages load quickly and the Website is protected against attacks. Cloudflare takes part in the EU-US Data Privacy Framework and offers the European Commission’s standard contractual clauses for transfers outside the European Economic Area.

Google Analytics (only with consent)

This Website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how visitors use the Website, for example which pages are read and how visitors arrive. Google Analytics runs only after the User accepts analytics cookies in the cookie banner (CookieYes). Until then, Google Consent Mode keeps analytics storage denied and no Google Analytics cookies are set.

If the User accepts, Google Analytics processes the pages visited, the referring page, the approximate location derived from the IP address, device and browser information, and interactions with the Website. Google Analytics keeps this event-level data for 2 months; after that, only aggregated reports remain. The _ga and _ga_* cookies last up to 2 years (see the Cookie Policy). Google acts as a processor on behalf of this site. Data may be transferred to Google LLC in the United States, which takes part in the EU-US Data Privacy Framework; Google also offers the European Commission’s standard contractual clauses.

The User can withdraw consent at any time through the cookie settings (the “Consent Preferences” button shown on every page, or the cookie banner). Google Analytics then stops collecting data about the User’s visits.

Cookie banner

The cookie banner (CookieYes) stores the User’s choice in cookies on the User’s device, so that the banner is not shown again on every page. The choice is not sent to a third party, except that, if the User accepts analytics cookies, Google Analytics is told through Consent Mode that analytics storage is allowed. The User can change the choice at any time from the “Consent Preferences” button or the banner. Details are in the Cookie Policy.

III. Acceptance of and changes to this privacy policy

It is necessary that the User has read and agrees with the conditions on the protection of personal data contained in this Privacy Policy, and consents to the processing of their personal data so that the Controller may proceed in the manner, during the periods and for the purposes indicated. Use of the Website shall imply acceptance of its Privacy Policy.

The Controller reserves the right to modify its Privacy Policy at its own discretion or due to a legislative, judicial or doctrinal change by the Spanish Data Protection Agency. Changes or updates to this Privacy Policy will not be explicitly notified to the User. Users are recommended to consult this page periodically to be aware of the latest changes or updates.

This Privacy Policy was updated to align with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and with Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights.