Legal information

Legal notice

1. Identification of the website owner

In accordance with Spanish Law 34/2002 of 11 July on information society services and electronic commerce, the following information is provided:
- Responsable: Angel Tarifa Diaz
- Correo electrónico: replicas.enigma@gmail.com
- Domain: https://maquinaenigma.com

In this document, the owner may also be referred to as “CEDI” or “Centro Enigma de Divulgación e Investigación” where these names are used as the public name of the project.

2. Purpose of the website

Maquinaenigma.com presents the activities of the Enigma Centre for Outreach and Research and provides information on museum and educational replicas of the Enigma machine, lectures, exhibitions, historical research, outreach projects and media coverage.

The website allows visitors to request information by email or WhatsApp. Unless expressly stated otherwise, it does not automatically complete purchases, payments or contracts. Any quotation, commission, sale or provision of services will be agreed directly with the interested person and will be subject to the specific terms communicated in each case.

3. Terms of use

Access to the website is free, except for areas reserved for administration. Users undertake to use the website, its content and its links lawfully, diligently and with respect for the rights of others.

It is prohibited to use the website to introduce malicious code, attempt unauthorised access to systems or data, interfere with its operation, impersonate another person, conduct fraudulent activities or infringe intellectual property, privacy or any other applicable rights or laws.

The owner may restrict or block access where abusive, automated or harmful use threatens the security or availability of the service.

4. Information on products and services

Photographs, descriptions, scales, specifications and other content relating to replicas, exhibitions or services are provided for information. Some works may be manufactured or adapted to order, so their specifications, availability, timescale, transport arrangements and price must be expressly confirmed before any contract is concluded.

The owner endeavours to keep the information accurate and up to date but may correct errors, update content or alter the offering without prior notice. Published information does not replace the quotation, technical sheet, terms or specific agreement supplied for a particular commission.

5. Intellectual and industrial property

Unless otherwise stated, the design, structure, original texts, original photographs, databases, graphic elements, logos and code of the website belong to the owner or are used with permission. They are protected by intellectual and industrial property law.

Viewing the website and using it strictly for personal purposes does not transfer any rights. Its content may not be reproduced, altered, distributed, communicated to the public, systematically extracted, reused or exploited commercially without prior written permission, except where allowed by law.

Trade marks, names, photographs, videos, articles and other materials belonging to third parties remain the property of their respective owners. Their inclusion for information, historical discussion, criticism or linking does not imply sponsorship, association or any transfer of rights.

6. Third-party links and services

The website may contain links to media outlets, museums, institutions, YouTube, Instagram, WhatsApp and other external services. By following them, the user leaves maquinaenigma.com and becomes subject to the terms and policies of the destination service.

Links are selected in good faith, but the owner does not continuously control the availability, security, accuracy, advertising, cookies or data processing carried out by third parties. A link does not constitute complete endorsement of its content or acceptance of responsibility for later changes made by the third party.

Any link believed to be unlawful, misleading or harmful may be reported to [CORREO_DE_CONTACTO] for review.

7. Liability and availability

The owner applies reasonable measures to keep the website available and secure but cannot guarantee the complete absence of interruptions, errors, incompatibilities, harmful software or unlawful access. The owner will not be liable for damage caused by circumstances beyond reasonable control, use contrary to these terms or decisions made solely on the basis of general information published on the website.

This limitation does not exclude liability that cannot legally be limited and does not affect any mandatory consumer rights.

8. Personal data

The processing of personal data is explained in the Privacy policy published on this page. Communications sent by email or WhatsApp should be limited to the information necessary to deal with the requested enquiry or relationship.

9. Cookies and similar technologies

The use of cookies and similar technologies is described in the Cookie policy published on this page. The configuration may change if new functions are introduced; the information will then be updated and consent requested where required.

10. Amendments

The owner may update this notice to reflect legal, technical or operational changes. The applicable version is the one published on the date of access, identified by its update date.

11. Governing law and jurisdiction

This website is governed by Spanish law and any applicable European Union legislation.

Where the user is a consumer, any dispute will be submitted to the courts determined by mandatory consumer-protection rules. In relationships between professionals, and where legally permitted, the parties may submit to the courts of Cartagena

Privacy policy

1. Data controller

• Responsable: Angel Tarifa Diaz
• Correo electrónico: replicas.enigma@gmail.com

2. Scope of this policy

This policy explains how personal data connected with maquinaenigma.com and communications addressed to the Enigma Centre for Outreach and Research are processed.

The website does not currently provide a public registration, purchasing or contact form. When a person uses an email or WhatsApp link, they voluntarily provide their data through the service they have chosen. The server may also generate technical logs required for website operation and security.

3. Data that may be processed

Depending on the chosen contact method and the requested relationship, the following categories may be processed:

• Identification and contact details, such as a name, email address, telephone number or the profile used to communicate.
• The contents of enquiries, requests for information, quotations, commissions and subsequent communications.
• Professional, institutional, invoicing, delivery or payment information where required to prepare or perform a contract. The website does not directly collect bank card details.
• Information connected with lectures, exhibitions, collaborations or media appearances.
• Technical security data, such as IP address, date and time, requested page, user agent and error events, where logged by the server.
• Administration account data, solely for persons authorised to manage the website.

Special categories of personal data are not requested. Users should avoid sending sensitive information that is not necessary.

4. Purposes and legal bases

Personal data may be processed for the following purposes:

• To answer enquiries and requests for information. The legal basis is taking pre-contractual steps at the data subject’s request and, where no contractual purpose exists, the legitimate interest in replying to communications connected with the activity.
• To prepare quotations and manage commissions, sales, services, deliveries, payments and after-sales assistance. The legal basis is performance of a contract or taking pre-contractual steps.
• To manage lectures, exhibitions, collaborations, institutional relations and professional communications. The legal basis will be performance of an agreement, consent where required or the legitimate interest in maintaining relationships connected with CEDI’s work.
• To comply with accounting, tax, administrative, consumer and other legal obligations. The legal basis is compliance with a legal obligation.
• To protect the website, prevent abuse, investigate incidents and maintain technical logs. The legal basis is the legitimate interest in ensuring the security, integrity and availability of the service.
• To establish, exercise or defend legal claims. The legal basis is the legitimate interest and compliance with applicable duties.

Personal data will not be used to send unsolicited electronic marketing. If a newsletter or regular promotional communications are offered in the future, the relevant consent will first be requested and may be withdrawn at any time.

5. Whether data must be provided

Providing data is voluntary, but certain contact details and, where applicable, invoicing or delivery information are necessary to answer a request, prepare a quotation or perform a commission. Without them, it may be impossible to provide the requested service.

Anyone providing another person’s data confirms that they have a lawful basis to do so and have supplied that person with the necessary information.

6. Recipients and processors

Personal data is not sold or disclosed to third parties for their own advertising purposes. Access may be granted only where necessary to:

• The hosting and technical support provider: [PROVEEDOR_DE_ALOJAMIENTO_Y_PAÍS].
• Email, storage, backup, security or maintenance providers engaged by the controller and subject to the relevant obligations.
• Google, where the Gmail account shown as a contact channel is used, under the terms applicable to that service.
• The entities responsible for WhatsApp and Instagram and the companies in their respective groups, where the person chooses to use those platforms, under their own terms and policies.
• Financial institutions, carriers, advisers or other collaborators where required to perform a commission.
• Public authorities, courts, tribunals and law-enforcement bodies where there is a legal duty or valid request.

Links to third-party websites and social networks lead to services managed by other controllers. Users should read their policies before using them.

7. International transfers

Some technology providers may process information outside the European Economic Area. Where the controller is a customer of those providers, services will, as far as reasonably possible, be selected that rely on an adequacy decision, standard contractual clauses or another safeguard recognised by the General Data Protection Regulation.

Where a user voluntarily accesses WhatsApp, Instagram, YouTube or another external platform, processing by that platform is also governed by its own terms, processing locations and safeguards.

8. Retention periods

Personal data will be kept only for as long as necessary for the relevant purpose and to meet possible liabilities:

• Enquiries that do not lead to a contractual relationship: [PLAZO_DE_CONSERVACIÓN_DE_CONSULTAS] after resolution, unless they must be retained to address a claim.
• Quotations: for their period of validity and subsequently for as long as needed to demonstrate the steps taken.
• Contractual data, invoices and accounting or tax records: for the duration of the relationship and the periods required by applicable law.
• Communications and documents related to claims: for as long as liabilities may arise and while the claim is handled.
• Server technical and security logs: [PLAZO_REAL_DE_CONSERVACIÓN_DE_LOGS], unless an incident requires longer retention.
• Data processed on the basis of consent: until consent is withdrawn, without prejudice to retaining evidence of consent and past processing for the applicable limitation periods.

Once these periods expire, data will be deleted or kept blocked where required by law.

9. Individual rights

Data subjects may request, free of charge:

• Access to their personal data.
• Rectification of inaccurate or incomplete data.
• Erasure where the data is no longer required or another legal ground applies.
• Objection to processing based on legitimate interests and, in all cases, to direct marketing.
• Restriction of processing in the circumstances provided by law.
• Data portability where processing is based on consent or contract and carried out by automated means.
• Withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.
• The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise these rights, send a request to [CORREO_DE_CONTACTO] or [DOMICILIO_COMPLETO], stating the right concerned and providing the information needed to verify identity. Where a representative acts on the person’s behalf, their authority must be demonstrated.

Requests will be answered within the statutory period. Where there are reasonable doubts about identity, proportionate additional information may be requested.

10. Complaint to a supervisory authority

Anyone who believes that processing infringes data-protection law may first contact the controller and may also lodge a complaint with the Spanish Data Protection Agency: https://www.aepd.es.

11. Children

The website is not specifically directed at children and does not request their data. Children under fourteen should not send personal data without the involvement of a parent or legal guardian. Where personal data relating to a child is found to have been received without sufficient legal basis, reasonable steps will be taken to delete it.

12. Security

The controller applies reasonable technical and organisational measures to prevent loss, alteration, unauthorised access or disclosure. Nevertheless, no Internet-connected system can guarantee absolute security. Users should also use secure channels and devices and avoid sending unnecessary or particularly sensitive information.

13. Automated decision-making and profiling

No decisions are made solely through automated processing, and no profiles producing legal or similarly significant effects on users are created.

14. Updates

This policy may be updated when the law, activity or services used change. The current version will be the one published on the website with its update date.

Cookie policy

1. What cookies are

Cookies are small files that a website or external service may store on a user’s device. Among other functions, they can maintain a session, remember preferences, protect a service, measure its use or display third-party content. Similar technologies may also be used, including local storage, pixels and device identifiers.

2. Current position on maquinaenigma.com

As at the date of this policy, public browsing on maquinaenigma.com does not use first-party analytics, behavioural advertising or profiling cookies. Google Analytics, Meta Pixel and advertising networks have not been incorporated.

The server may retain technical logs, including IP addresses, for security and operation. These records are not cookies and are explained in the Privacy policy.

3. Technical cookie used

The private administration area uses the following strictly necessary cookie:

• Name: enigma_admin
• Provider: maquinaenigma.com
• Purpose: to maintain the administrator’s authenticated session and protect access to the control panel.
• Scope: the /admin path only.
• Duration: session; it is removed when the browser is closed or the session ends, subject to the device’s configuration.
• Security features: HttpOnly, SameSite=Strict and Secure when HTTPS is used.
• Basis: a technical cookie required to provide the requested service; it is not used for analytics or advertising.

Strictly necessary cookies are exempt from prior consent. The public website can be viewed without accessing the administration area.

4. Links to external services

The website contains links to WhatsApp, Instagram, YouTube, media outlets and other external websites. While they are displayed as ordinary links, these services are not loaded from maquinaenigma.com. When a link is selected, the user leaves this website and the destination service may use its own cookies or technologies under its policy.

Users should review each platform’s settings and policies before using it.

5. YouTube videos

Where a video is offered solely as a link, YouTube is not loaded until the user selects the link and visits its website.

Where a player is embedded within maquinaenigma.com, privacy-enhanced mode is used through the youtube-nocookie.com domain. Even then, Google or YouTube may receive technical data and use cookies, local storage or other identifiers when content is loaded or played, in accordance with their own terms.

If operation of the player involves technologies that are not strictly necessary before interaction or without another valid legal basis, it will be blocked until the relevant consent has been obtained. Users may choose not to play the video and may instead open the external link if they wish.

6. Consent and future changes

While the website uses only exempt technical cookies and does not load non-essential technologies, it is not necessary to display a cookie acceptance and rejection panel.

If analytics, advertising, personalisation, maps, captcha, chat, players, active social buttons or other services using non-essential technologies are added in the future, this policy will be updated and a mechanism implemented to allow users to accept or reject those purposes before activation, with equivalent choices and the ability to withdraw consent.

7. How to control or delete cookies

Users can view, block or delete cookies in their browser settings. The exact route depends on the browser and device. Blocking technical cookies may prevent access to or correct operation of the administration area, but should not affect ordinary viewing of the public website.

Local-storage data may also be deleted and permissions granted to each website changed through the browser’s privacy options.

8. Third-party services and international transfers

External providers may process information in countries outside the European Economic Area. Their policies explain the relevant controller, technologies, duration and safeguards. The owner of maquinaenigma.com does not control cookies placed directly after a user accesses an external service.

9. Controller and contact details

• Responsable: Angel Tarifa Diaz
• Correo electrónico: replicas.enigma@gmail.com

This email may be used for questions concerning cookies or the technical operation of the website.

10. Updates to this policy

This policy will be reviewed when the technologies or services used change. The date below identifies the current version.