Privacy Policy
The short version
No tracking cookies. No analytics profiles. No selling your data. This site stores your contact details only when you actively send them through the contact form, and uses them for exactly one purpose: answering you. The only cookies set are functional ones that remember your language and design preference.
Data controller
The data controller within the meaning of the EU General Data Protection Regulation (GDPR / RGPD) is the site operator named in the imprint.
[PLACEHOLDER — REQUIRED BEFORE LAUNCH: full name and postal address of the data controller, identical to the imprint]
Contact form
When you use the contact form, the following data is processed: your name, your email address, your message, and — if you choose to provide them — your phone number, the topic of your inquiry and a budget range.
Purpose: responding to your inquiry and preparing a potential offer. Legal basis: Art. 6(1)(b) GDPR — processing necessary for steps prior to entering into a contract, taken at your request.
Your data is deleted once your inquiry has been fully handled and no legal retention obligations apply. If a project results from your inquiry, the data becomes part of the contractual records and is retained according to statutory retention periods.
IP address & abuse prevention
When you submit the contact form, your IP address is processed transiently to prevent spam and abuse (by limiting how many submissions can be sent from the same source — so-called rate limiting).
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the site from automated abuse and overload.
The IP address is not permanently stored and is not linked to your inquiry. It is held only briefly in memory and automatically discarded after a short period (about one hour).
Where your data is stored
Contact form submissions are stored in a MongoDB database hosted on the Railway platform.
[PLACEHOLDER — VERIFY BEFORE LAUNCH: confirm the database is hosted in an EU region and that a data processing agreement (DPA) with Railway Corp. is in place; if data is processed outside the EU, name the transfer mechanism, e.g. EU Standard Contractual Clauses]
Email delivery
Confirmation and reply emails are sent via the email service Resend (Resend, Inc.), which acts as a processor. Resend receives your email address and the content of the emails sent to you for the sole purpose of delivering them.
[PLACEHOLDER — VERIFY BEFORE LAUNCH: reference the data processing agreement with Resend and the applicable international transfer mechanism, e.g. EU Standard Contractual Clauses / EU–US Data Privacy Framework]
Cookies
This website does not use tracking or marketing cookies, and no third-party analytics services are embedded.
The only cookies set are strictly functional: they remember your chosen language and design variant so the site looks the same on your next visit. These cookies contain no personal profiles and require no consent banner under Art. 6(1)(f) GDPR and applicable ePrivacy rules.
WhatsApp contact
If you choose to contact the operator via the WhatsApp button, your use of WhatsApp is governed by the privacy policy of WhatsApp Ireland Ltd. / Meta Platforms. No data is transmitted to WhatsApp by simply visiting this website — only when you actively open the chat link.
Your rights
Under the GDPR you have the right to access your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21).
To exercise any of these rights, a simple email to the address in the imprint is enough — no forms, no hurdles.
You also have the right to lodge a complaint with a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.