Privacy policy
Last updated: 2 October 2026
This policy explains what personal data Chilli FM collects when you visit our website, listen to us, send a shoutout or get in touch, why we collect it, and the rights you have over it.
1. What we collect and why
What we collect depends on how you use Chilli. Here is each case, with the legal basis under the GDPR and how long we keep the data.
Visiting the website
What: IP address, browser and device type, pages visited, and the date and time of your visit.
Why: To run the website, keep it secure and understand how it is used.
Legal basis: Our legitimate interest in operating a secure website. Analytics and advertising cookies are only used with your consent (see Cookies below).
How long: Server logs are kept for up to 12 months.
Listening to the live stream
What: IP address, device or player type, and listening session data such as start time and duration.
Why: To deliver the stream to you and to count listeners for audience figures and music royalty reporting.
Legal basis: Our legitimate interest in providing and measuring the service, and our legal obligations to rights holders.
How long: Up to 12 months, then kept only as anonymous statistics.
Sending a shoutout
What: Your voice recording, anything you say in it (for example names or your business), and your phone number if you use WhatsApp.
Why: To choose messages for broadcast, play them on air, and share them on our website and social media.
Legal basis: Your consent, given when you send the message. You can withdraw it at any time before broadcast by contacting us; after broadcast we will remove the clip from our online channels on request.
How long: Recordings not broadcast are deleted within 3 months. Broadcast clips may be kept in our programme archive for as long as they are used in our programming or online content. We review the archive every 12 months, delete clips we no longer use, and will remove any clip on request.
Contacting us or asking about advertising
What: Your name, email, phone number, business details and the content of your message.
Why: To reply to you, prepare quotes and manage any advertising agreement.
Legal basis: Taking steps at your request before entering a contract, performing the contract, and our legitimate interest in answering enquiries.
How long: Enquiries that do not lead to a contract are deleted after 2 years. Client records are kept for as long as Spanish tax and commercial law requires (currently up to six years).
Newsletters and marketing
What: Your email address and name.
Why: To send you news, offers and event invitations you have signed up for.
Legal basis: Your consent. You can unsubscribe at any time using the link in every email.
How long: Until you unsubscribe.
Using our apps, smart speaker skill and TV apps
What: Device identifiers, operating system version, app configuration, crash and error logs, and a push notification token if you allow notifications.
Why: To stream Chilli, fix errors and, if you agree, send you notifications.
Legal basis: Our legitimate interest in providing a working app, and your consent for push notifications (which you can turn off in your device settings).
How long: Crash logs for up to 90 days; notification tokens until you uninstall the app or turn notifications off.
Competitions
What: Your name and contact details, and your entry.
Why: To run the competition, contact winners and deliver prizes, which may mean sharing winners’ details with the prize sponsor.
Legal basis: Performance of the competition terms you accept when entering.
How long: Up to 6 months after the competition ends.
2. Who we share your data with
We never sell your personal data. We share it only with:
- Service providers that help us run Chilli, such as website hosting, Cloudflare, our streaming provider, Google (Firebase and Analytics), OneSignal (push notifications), WhatsApp and our email provider. They may only use your data on our instructions.
- Competition sponsors, where you win a prize they provide.
- Authorities, where we are legally required to, or to protect our rights or someone’s safety.
3. Transfers outside the EU
Some of our service providers, such as Google, Meta (WhatsApp) and OneSignal, may process data in the United States. Where they do, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
4. Cookies
We use essential cookies to make the website work. Analytics and advertising cookies are only set if you accept them in our cookie banner, and you can change your choice at any time. See our Cookie Policy for details.
5. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did before.
To use any of these rights, email [email protected]. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Spanish Data Protection Agency (AEPD) at aepd.es.
6. Children
Under Spanish law, children under 14 need the consent of a parent or guardian before sending us a shoutout or any personal information. If we learn that we hold data from a child under 14 without that consent, we will delete it.
7. Security
We use appropriate technical and organisational measures to protect your data, such as encrypted connections and restricted access. No system is completely secure, but we work to keep your information safe.
8. Links to other websites
Our website and apps link to websites run by others, including advertisers and partners. Their own privacy policies apply when you visit them.
9. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed, and we will let you know of significant changes where appropriate.
Chilli FM
