Last updated — 5 September 2026

Privacy policy

This policy explains what personal data Scannata Records collects through this website, why, and what you can do about it. It is written to meet Regulation (EU) 2016/679 (the GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Who is responsible for your data

The data controller is Scannata Records, Calella, Spain. You can reach us at contact@scannata.com.

We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale monitoring or process special categories of data as a core activity.

2. What we collect

Information you send us

If you submit a demo or otherwise write to us, we receive whatever you choose to put in that message. Using the form on the demo page, that is typically your name, your artist or band name, where you are based, a genre, a link to a track and a short description of what you are making.

The demo form does not send anything to us by itself. It assembles the message and opens it in your own email programme, so nothing leaves your device until you press send, and nothing is stored on this website. What reaches us is an ordinary email.

Technical information from our hosting

Our hosting provider records standard server logs when a page is requested. These contain your IP address, the time of the request, the page requested, and your browser and operating system. They exist to serve the site and to detect abuse, and we do not use them to build a profile of you or try to identify you.

3. What this site does not do

This site sets no cookies. It runs no analytics, no advertising or tracking pixels, no session recording and no fingerprinting, and it stores nothing in your browser. Typefaces are served from our own domain rather than fetched from Google, so loading a page makes no request to a third-party server. That is why you are not asked to accept anything when you arrive: there is nothing to consent to.

4. Why we process it, and on what basis

Answering you and considering your demo

Legal basis: steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR. Where you are writing about something other than working with us, the basis is our legitimate interest in replying to correspondence, Art. 6(1)(f).

Keeping the site running and secure

Legal basis: our legitimate interest in delivering the site, keeping it available and preventing abuse, Art. 6(1)(f). We have considered your rights here and think a short-lived server log is the least we can do the job with.

Providing your data is entirely voluntary. You are under no obligation to send us anything; the only consequence of not doing so is that we cannot reply or listen to your music.

5. How long we keep it

Demo submissions and related correspondence are kept for up to 12 months from your last message, so that we can recognise you if you send us something again, and are then deleted. If we go on to work together, correspondence is retained for the life of that relationship and for as long as Spanish commercial and tax law requires afterwards. Server logs are kept by our hosting provider for a short period, of the order of 30 days, and then rotated out.

6. Who else sees it

We do not sell your data, and we do not share it for anyone else’s marketing. It is handled by two suppliers, acting as processors on our instructions:

Vercel Inc. hosts this website and holds the server logs described above. Cloudflare, Inc. provides the email service behind our contact address, so a message you send us passes through their systems.

Both are established in the United States. Transfers are covered by the European Commission’s Standard Contractual Clauses, by the provider’s certification under the EU–US Data Privacy Framework, or both. You can ask us for details of the safeguards that apply.

We may also disclose data where we are legally required to, for example in response to a valid order from a court or public authority.

7. Automated decisions

There are none. Nobody is signed, rejected or ranked by an algorithm here — every submission is read by a person.

8. Your rights

Under the GDPR you have the right to ask us for a copy of the personal data we hold about you; to have it corrected if it is wrong; to have it deleted; to have our processing restricted; to object to processing carried out on the basis of our legitimate interests; and to receive data you gave us in a portable, machine-readable form. Where we ever rely on your consent, you can withdraw it at any time without affecting what was done beforehand.

Write to contact@scannata.com and we will answer within one month. We may need to confirm who you are first, so that we do not hand your data to somebody else.

If you think we have got this wrong, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the authority where you live or work. We would rather you told us first, so we can put it right.

9. Children

This site is not aimed at children. Under Spanish law a person must be at least 14 to consent to their data being processed by an online service. If you are younger than that, please ask a parent or guardian to write to us on your behalf. If we learn we hold data on a child without that authority, we will delete it.

10. Changes

If this policy changes we will update the date at the top of this page. Where a change materially affects how we handle data you have already sent us, we will tell you directly.