PRIVACY POLICY

Last updated: 27 October 2026. Mix FM 102.3 (“the station”, “we”) respects your privacy. This notice explains what personal data this website, the MIX Passport club and the Mix FM mobile app collect, why, for how long, and what your rights are under the General Data Protection Regulation (GDPR) and the Cyprus Law 125(I)/2018.

1. Who is responsible

The controller is Mix FM 102.3, 1 Souliou str., 2018 Strovolos, Nicosia, Cyprus. For anything about your personal data — questions, access, correction or deletion — write to [email protected] with “Personal data” in the subject. We answer within one month.

2. What we collect, and why

Competition entries. Your name, phone number, city, age, e-mail (when asked), your answer, and the moment you accepted the entry terms. We also keep the IP address and browser of the entry to stop automated and duplicate entries. Used only to run the competition: validate entries, draw and contact winners, hand over prizes. Legal basis: your consent (the box you tick) and our legitimate interest in a fair draw.

Messages to the studio. The name, message, song, the person it is for, and — if you are signed in — your MIX Passport account, together with the IP address of the sender. Presenters read messages on air at their discretion and may reply to you on the site or in the app. Legal basis: our legitimate interest in running the shows and talking to listeners.

Contact form. The name, e-mail, phone (optional), subject and message you send, with the IP address, so we can reply and filter spam. Legal basis: legitimate interest in answering you.

MIX Passport (club account). Name, e-mail, password (stored only as a one-way hash), phone, birthday, city, your newsletter choice, when you last signed in. Used to run your account, enter you in members-only competitions, send the birthday greeting and — only if you opted in — the Mix FM e-mail update. Legal basis: the club terms you accept when you join (contract) and consent for the newsletter, which you can withdraw at any time from your account page or the unsubscribe link in every e-mail.

Halloween haunt game. When you catch a creature we store a random code generated by your browser (not your name), the time, the channel you chose to claim the catch (studio or Viber), the IP address, and the competition entry you fill in. If you choose Viber, you message the station on Viber and Rakuten Viber's own privacy terms apply to that conversation.

On-air polls. Your vote and a one-way hash that only prevents double voting. We cannot tell who voted.

Listening and visit statistics. We count visits, plays and how long the stream is listened to. Pages and the player send an anonymous identifier: a one-way hash of your connection with a secret that changes every day, so it cannot be turned back into your IP address and yesterday's visits cannot be linked to today's. No advertising or cross-site tracking is used. Legal basis: legitimate interest in knowing how the station is doing.

Mobile app. A random install identifier, the platform and app version, your language, your notification preferences and — if you allow notifications — the device's push token. Push messages are delivered through Google Firebase Cloud Messaging. If you sign in to MIX Passport in the app, the install is linked to your account so studio replies reach you. Legal basis: the service you ask for.

3. How we protect it

Phone numbers, e-mail addresses, cities, answers, messages, IP addresses and push tokens are encrypted at rest in our database; passwords are hashed and cannot be read by anyone. The site is served over HTTPS only. Access to listener data is limited to station staff who need it (studio and admin accounts), each with their own login. Backups are kept for 14 days and the off-site copy is encrypted.

4. How long we keep it

We delete automatically, every night:

Competition entries: 3 months after the competition closes (winners included — prize handover notes stay with the sponsor only as far as needed).
Messages to the studio and contact-form messages: 12 months after we receive them.
Halloween haunt catches: 3 months.
Mobile app installs not opened for 12 months.
Visit and listening statistics: 12 months; the identifier they carry is already anonymous.

Your MIX Passport account stays until you delete it (from your account page, or by asking us). When you delete it, your profile and your messages to the studio are removed at once; competition entries you made keep only the competition's own 3-month retention, because a draw must be verifiable.

5. Who else sees it

We do not sell personal data and we do not share it for advertising. It is processed on our behalf by:

DigitalMove LTD (Cyprus), which builds, hosts and maintains the site, the club and the app, under a data-processing agreement.
Resend, our e-mail delivery provider, for account e-mails, the birthday greeting and the newsletter.
Google Firebase Cloud Messaging, which delivers push notifications to the app.
A competition's sponsor, who receives a winner's name and phone number only to hand over the prize.
YouTube (Google) when you press play on an embedded video: we use the privacy-enhanced youtube-nocookie.com player, which sets nothing before you play.

Data may be disclosed where the law requires it.

6. Cookies

This site sets only the cookies it needs to work: the session cookie and the security (CSRF) token, and — if you sign in — the cookie that keeps you signed in. Your own choices (the “got it” on the privacy notice, the creature you have already caught, the welcome you have seen today) are kept in your browser's local storage and never leave it. There are no advertising cookies and no third-party trackers, so no cookie consent is needed; the notice at the bottom of the page is there to tell you so.

7. Your rights

You may ask us for a copy of your personal data, to correct it, to delete it, to limit or object to its use, and to receive it in a portable form. You may withdraw consent at any time without affecting what was done before. Write to [email protected]; we may ask you to confirm your identity first. You may also complain to the Commissioner for Personal Data Protection of the Republic of Cyprus, 1 Iasonos str., 1082 Nicosia, dataprotection.gov.cy.

8. Children

Competitions are open to listeners aged 18 or over (see the Competition Terms) and MIX Passport to listeners aged 14 or over, the age at which a person in Cyprus can consent to an online service. If we learn that we hold the details of a younger child, we delete them.

9. Changes

When this notice changes we update the date at the top. Material changes to how we use MIX Passport data are announced to members by e-mail.