Lusitanian Coven
Last updated: 9 October 2026
Lusitanian Coven is an unofficial, non-commercial fan site about King Diamond and Mercyful Fate. Visitors come from all over the world, so this policy follows the strictest common standard (the EU/UK GDPR) and adds notes for other regions. It explains what personal data the site handles, why, who else touches it, and how you can control it.
1. Who is responsible
The person responsible for your data (the “controller”) is Lucas Almeida Romão, Portugal. You can reach us at privacy@lusitaniancoven.com.
2. What we collect, why, and on what basis
You can read most of the site without an account and without giving us anything. We only hold personal data when you create an account, use a member feature, contact us, or visit the site (the technical data every web server sees).
| What | Examples | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Name, email address, login identifier (from Auth0, including Google sign-in if you use it), country, member number, role | Create and run your account; show your Coven Card; keep the site secure | Contract (providing the account you asked for) |
| Profile you choose to fill in | Display name, date of birth (optional), city, bio, profile photo, favourite band, preferences | Your Coven Card and personalisation. Shown to others only as described in section 4 | Consent (you decide what to add and can remove it at any time) |
| Membership | Your membership tier (founding member or member), the end date of your membership year and a history of renewals (date, whether you renewed yourself or an administrator did, and the administrator’s name in that case) | Run the membership year, show your Coven Card, send reminders on the site and keep the member list up to date | Contract (providing the membership you asked for) |
| Your sharing choice | Whether you allow us to share your fan art and photos with the band on our social media, and the date you chose | Know whether we may share your uploads without asking again. Off by default | Consent (you can withdraw it any time in My Account) |
| Things you post or submit | Forum topics, replies and likes, fan art and photos, contest answers, show check-ins (private unless you make them public), contact messages | Provide the community features; reply to you; moderate | Contract; legitimate interests (running and moderating the community) |
| Giveaway winners | Name, postal address and, if the carrier needs it, a phone number | Send the prize. Used for nothing else, and deleted within 90 days after delivery | Contract (delivering the prize you won) |
| Shipping payments | If you pay a giveaway’s shipping cost: what PayPal or your bank shows us, such as your name, email address or the bank account used | Receive and record the payment | Contract; legal obligation (accounting records) |
| Technical data | IP address, browser and device type, pages requested, time of request | Deliver the site, prevent abuse and overload (rate limiting), fix errors | Legitimate interests (security and reliability) |
| Administration records | Which administrator changed which content, and when | Accountability for site content. Visible to administrators only | Legitimate interests |
| Your cookie choice | The consent record kept by our cookie banner | Remember what you allowed or refused | Legal obligation / legitimate interests |
We do not use advertising or analytics trackers (tools such as Google Analytics or advertising pixels that record what you do on the site), we do not build advertising profiles, and we do not sell your data. If we ever add analytics, they will load only after you consent and this policy will be updated first.
3. Cookies and similar technologies
When you first visit, a banner lets you accept or refuse optional cookies. Refusing is as easy as accepting, and you can change your mind at any time through Cookie Settings (also in the footer).
| Type | What it is | Needs consent? |
|---|---|---|
| Strictly necessary | The login session (Auth0 stores a session cookie and data in your browser’s local storage); the record of your cookie choice | No: the site cannot work without them |
| Preferences kept on your device | Display choices such as the band filter or the image magnifier, saved in your browser only and never sent to us | No: stored at your request, only on your device |
| Embedded players | Spotify and YouTube players. They set their own cookies and can see your IP address and that you visited this page. They stay hidden until you allow them in the banner or click “Load” on that single player. YouTube players use the privacy-enhanced youtube-nocookie.com address | Yes |
| Detailed map | The shows map shows a simple outline map hosted on our own server. The detailed map background comes from CARTO (map data from OpenStreetMap). CARTO sees your IP address, so it loads only after you allow it in the banner or click “Load detailed map” | Yes, for the detailed map only |
| Analytics / advertising | None used | n/a |
The site’s fonts and code libraries (including the map and page-turning libraries) are hosted on our own server. Your browser still loads the sign-in library from Auth0’s server, which necessarily sees your IP address; without it you could not log in.
4. Who sees your data
- Other visitors and members. Content you post in the forum, fan art you submit and public check-ins are visible to other people as the page indicates. Your Coven Card shows the profile fields you choose to fill in. If you are ever featured on the public site, the featured parts become visible to everyone. Check-ins are private unless you make them public.
- Administrators and moderators of the site, to run and moderate it.
- Service providers (processors). Auth0 (Okta) handles sign-in and holds your login identifier, name and email. Our web host, Domínios.pt (Portugal), stores the site and its database. Cookie-Script provides our cookie banner and keeps the record of your cookie choice.
- Payment services. If you pay a giveaway’s shipping cost, you pay by PayPal or bank transfer. PayPal and your bank handle your payment details under their own privacy policies, and we do not see card numbers.
- Spotify and YouTube (Google), only if you load their players, as in section 3.
- When you share. The share buttons (WhatsApp, Facebook, X, Telegram, copy link) only open those services when you press them.
- Authorities, only where the law requires.
5. Transfers outside your country
Auth0 and other providers may process data in the United States and other countries. Where required, transfers rely on safeguards recognised by law, such as the standard contractual clauses approved by the European Commission, which Auth0 includes in its data processing agreement.
6. How long we keep it
- Account and profile data: for as long as your account exists. When you delete your account (see section 7) it is removed immediately, together with your photos, fan art, check-ins, contest answers, likes and messages; backups kept by our hosting provider expire on its regular schedule, currently about 15 days (one backup per day).
- Accounts whose membership has ended and was not renewed: after the 30-day tolerance period the members’ area pauses, and if the membership stays expired for 12 more months the account is deleted. The renewal history is deleted with the account.
- Forum posts: when you delete your account your topics and replies stay in the forum so conversations still make sense, but they are no longer linked to you and appear as “Deleted member”. Write to us if you want a specific post removed as well.
- Records of shipping payments: for as long as accounting and tax law requires.
- Contact messages: 24 months after the conversation ends.
- Server logs and rate-limit data: up to 30 days.
- Administration records: 12 months.
7. Your rights
Wherever you live, you can ask us to tell you what we hold about you, correct it, delete it, or give you a copy. Depending on where you live you may also have the right to restrict or object to some uses, to receive your data in a portable format, to withdraw consent at any time (without affecting what happened before), and to complain to your local data protection authority.
- EU/EEA and UK: the rights above under the GDPR / UK GDPR. You can complain to your national authority, or to the UK Information Commissioner’s Office. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
- Brazil (LGPD): you have the rights in Article 18 of the LGPD and can complain to the ANPD. Contact for data protection matters: privacy@lusitaniancoven.com.
- Elsewhere: if you live in another country with data protection rights, write to us and we will respond under the law that applies to you.
You can download a copy of your data or delete your account yourself, at any time, in My Account → Privacy & Data. For anything else, email privacy@lusitaniancoven.com from the address on your account. We reply within one month. We may need to confirm it is really you first.
8. Children
The site is not aimed at children. Accounts are for people aged 13 or over. If your country requires permission from a parent or guardian for people under 16 to use a service like this one, you need that permission to use an account. We do not knowingly keep accounts of people under 13: if we learn that an account belongs to someone under 13 we will delete it, and if you believe a child has given us personal data, write to us and we will delete it.
9. Security
Logins are handled by Auth0, connections use HTTPS, administrator access requires an admin role, and full-size images are limited to logged-in members. No system is perfectly secure; if a breach affecting you occurs we will tell you and the authorities as the law requires.
10. Changes
If we change how we use data, we will update this page and its date, and for significant changes ask for your consent again where the law requires it.
11. Contact
Questions about this policy or your data: privacy@lusitaniancoven.com.