Privacy policy

1. Data controller

Controller

Javier López del Pueyo (Silex Design Studio)

Tax ID (NIF)

[NIF pendiente]

Address

[Domicilio profesional pendiente]

Contact

projects@silexdesignstudio.com

No data protection officer has been appointed, as this activity is not required to have one (Article 37 GDPR and Article 34 LOPDGDD).

2. What data is processed

• Contact form: name, email address, company (optional), project stage and the content of your message.
• Email: if you write directly, your address and whatever you include in your message.
• Technical connection data: the server hosting the site automatically logs data such as your IP address, the date and time of access, the page requested and the type of browser.

Please do not include special categories of data (for example, health data) or confidential information that is not necessary for your enquiry. This site does not use cookies or analytics tools: see the cookie policy.

3. Purposes and legal bases

• Answering your enquiry or request for a quote and continuing the conversation you start. Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) when the enquiry concerns a possible engagement, and your consent (Article 6(1)(a)) for other enquiries. You may withdraw your consent at any time.
• Business contacts: if you write on behalf of a company, your professional contact details are also processed on the basis of the legitimate interest in maintaining that relationship (Article 19 LOPDGDD and Article 6(1)(f) GDPR).
• Managing the professional relationship if an engagement is formalized: communication, invoicing and tax and accounting obligations. Legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).
• Keeping the site secure through the server’s technical logs. Legal basis: the controller’s legitimate interest in protecting the site against unauthorized access and attacks (Article 6(1)(f)).

No marketing communications are sent, no profiles are built and no automated decisions affecting you are made. Only people aged 14 or over may provide their data through the form (Article 7 LOPDGDD).

4. Retention period

• Enquiries that do not lead to an engagement: for as long as needed to answer and follow them up; they are deleted no later than twelve months after the last contact.
• Clients: for the duration of the professional relationship and afterwards for the periods required by tax and commercial law (for example, documents relevant for tax purposes are kept until the tax authority’s right to assess them lapses: generally four years, under Articles 66 and 70 of the Spanish General Tax Law) and the limitation periods for possible liabilities.
• Server technical logs: for the limited period set by the hosting provider for security purposes.

After these periods, the data is deleted or, where the law requires it to be kept, blocked and made available only to the competent authorities.

5. Recipients

No data is disclosed to third parties, except where required by law (for example, to the Spanish Tax Agency in the case of clients). To provide the service, the following providers access the data as processors, under a contract that complies with Article 28 GDPR:

• Website hosting: [Hosting provider pending].
• Contact form delivery: [Form service pending].
• Email: [Email provider pending].
• Tax and accounting advisor (client data only): [Tax and accounting advisor pending, or “Not used”].

6. International transfers

[Providers not yet chosen: state here which provider processes data outside the European Economic Area and which safeguard applies (for example: “Formspree, Inc. is based in the USA; the transfer relies on its participation in the EU-US Data Privacy Framework, the European Commission adequacy decision of 10 July 2023”), or state that all providers are located in the EEA.]

Any processing outside the European Economic Area takes place only with the safeguards provided for in Chapter V of the GDPR: an adequacy decision of the European Commission or the standard contractual clauses approved by the Commission. You can obtain a copy of these safeguards by writing to projects@silexdesignstudio.com.

7. Mandatory data

The required fields of the form (name, email address and message) are necessary to reply to you. If you do not provide them, we will not be able to deal with your enquiry. The other fields are optional.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before its withdrawal.

To do so, write to projects@silexdesignstudio.com stating the right you wish to exercise. If necessary to verify your identity, you may be asked for additional information. You will receive a reply within one month, which may be extended by a further two months where justified by the complexity or number of requests (Article 12(3) GDPR).

If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid, Spain), or through its electronic office (sedeagpd.gob.es).

9. Security

Technical and organizational measures appropriate to the risk are applied to protect the data against loss, unauthorized access or alteration. The site is served over an encrypted connection (HTTPS) and does not connect to third-party services while you browse: fonts are loaded from the site’s own server.

10. Changes to this policy

This policy may be updated to reflect changes in the law or in how the site works. The date of the last update is shown at the top of the page.