GDPR Privacy Notice
This notice explains how personal data of visitors, fans, creators and webmasters is processed on Lewdden under the EU General Data Protection Regulation (GDPR) and the UK GDPR. It supplements our Privacy Policy; residents of the United States please also see our U.S. Privacy Notice (CCPA).
1. Controller
Lewdden is operated by Netfield Media S.L., Calle Panamá 32, 38009 Santa Cruz de Tenerife, Spain. Phone: +34 922 971 748. E-mail: [email protected]. Netfield Media S.L. is the controller within the meaning of Art. 4(7) GDPR.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data (e-mail address, username, password hash, language, profile details you enter) | Creating and running your account | Art. 6(1)(b) GDPR (contract) |
| “Sign in with Google” data (e-mail, Google account ID, name, profile picture URL) | Creating or matching your account when you choose Google sign-in | Art. 6(1)(b) GDPR |
| Purchase and payment data (orders, subscriptions, wallet top-ups, tips; billing data handled by our payment processing) | Delivering paid content, billing, refunds and chargebacks, accounting | Art. 6(1)(b) and (c) GDPR (contract, statutory retention) |
| Identity and age verification of creators and webmasters (government ID, proof of address, tax ID, bank account details) | Verifying that every performer is 18+ and identified (18 U.S.C. 2257), anti-fraud and anti-money-laundering checks, paying out earnings | Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(b) GDPR |
| Content you upload (clips, images, live streams, messages) | Providing the platform functions you use | Art. 6(1)(b) GDPR |
| Technical data (IP address, browser, device, access times, server logs) | Delivering the website, security, abuse and fraud prevention, bot protection | Art. 6(1)(f) GDPR (legitimate interest in a secure service) |
Referral cookies (affiref, gc_crref, gc_crefc) – see the Privacy Policy | Crediting the partner who referred you | Art. 6(1)(f) GDPR; § 25(2) TDDDG / Art. 5(3) ePrivacy Directive (strictly necessary for the service you requested) |
| Statistics cookies (Google Analytics) | Understanding how the website is used | Art. 6(1)(a) GDPR (your consent via the cookie banner, withdrawable at any time under “Manage consent”) |
| Support and e-mail correspondence | Answering your requests | Art. 6(1)(b) or (f) GDPR |
3. Recipients
We share personal data only as far as necessary with: payment processing and payout services; our hosting and server providers; e-mail delivery providers; security and bot-protection services (Cloudflare); Google (only for “Sign in with Google” when you choose it, and for Google Analytics when you consent); and authorities where we are legally obliged to. Service providers act on our instructions under data processing agreements (Art. 28 GDPR). We do not sell personal data.
4. Transfers outside the EEA
Some providers (for example Google or Cloudflare) may process data in the United States or other third countries. Such transfers are based on an adequacy decision (in particular the EU–U.S. Data Privacy Framework) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. How long we keep data
Account data is kept for as long as your account exists and deleted after you close it, unless the law requires us to keep it longer. Transaction and accounting records are retained for the statutory periods (generally up to 6 years under Spanish commercial and tax law). Age and identity verification records of creators are kept for as long as required by 18 U.S.C. 2257 and anti-money-laundering rules. Server logs are deleted after a short period unless needed to investigate abuse.
6. Your rights
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing based on legitimate interests (Art. 21 GDPR)
- Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you (Art. 22 GDPR).
To exercise your rights, e-mail [email protected] or contact us through Support in your account. We answer within one month (Art. 12(3) GDPR).
7. Right to lodge a complaint
You may lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement. The authority competent for the controller is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es.
8. Full Privacy Policy
The complete Privacy Policy of Netfield Media S.L. is available as a PDF document. Our cookie and referral details are on the Privacy Policy page.
Last updated: 2026-10-05
