Privacy notice

under articles 13–14 of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD)

Last updated:

1. Data controller

The controller of personal data is:

Augusta Bande
NIF/NIE: Y9036584J
Address: Calle Roseta de Emeterio, 3 - 35650 Lajares LAS PALMAS
Contact email: hello@studiojable.com
Website: www.studiojable.com

For the purposes of the GDPR, the Controller is the natural person identified above, who works as a self-employed professional (autónoma) registered in Spain. The competent supervisory authority is the Agencia Española de Protección de Datos (AEPD).

2. Categories of data collected

The website collects the following categories of personal data:

a) Data provided voluntarily through the website forms

  • Contact form: name, email address, company and phone number if given, services of interest and the message entered by the user.
  • Withdrawal form: name, email address, phone number if given, service purchased, booking date and the text of the statement.

b) Technical browsing data

The hosting provider automatically records, in the server logs, the technical data needed to serve the pages and keep them secure: IP address, date and time of the request, page requested, browser and device type. The website does not use analytics tools, cookies or tracking technologies (see section 7).

c) Data relating to the purchase of services

Payment transactions take place exclusively on the TidyCal platform (booking) and through PayPal or Stripe (payment). The website does not collect or store payment data. The data processed during purchase (e.g. name, email, amount) is handled directly by TidyCal, PayPal and Stripe as independent controllers or processors, subject to their own privacy notices.

3.1 Replying to contact requests

Purpose: to reply to requests for information sent through the contact form.
Legal basis: art. 6.1.b GDPR (taking steps at the request of the data subject prior to entering into a contract) and/or art. 6.1.f GDPR (the Controller’s legitimate interest in replying to communications received).
How: messages sent through the form are received and stored by the Netlify Forms service and forwarded by email to the Controller.
Retention period: data is kept for 12 months from the last contact, after which it is deleted unless it must be kept to meet legal or contractual obligations.

3.2 Provision of professional services

Purpose: performance of the service contract agreed between the Controller and the client.
Legal basis: art. 6.1.b GDPR (performance of a contract to which the data subject is party).
Retention period: for the duration of the contractual relationship and for the following 5 years for any tax, accounting and legal obligations (applicable Spanish tax law).

3.3 Operation and security of the website

Purpose: to serve the requested pages, prevent abuse and ensure the technical security of the website.
Legal basis: art. 6.1.f GDPR (the Controller’s legitimate interest in the secure operation of the website).
Data processed: technical browsing data recorded in the server logs (see section 2.b).
Retention period: for the period set by the hosting provider for its technical logs; the logs are not used to profile users.

3.4 Handling withdrawal requests

Purpose: receiving, recording and handling the withdrawal statements sent by the client.
Legal basis: art. 6.1.c GDPR (compliance with a legal obligation under Directive 2011/83/EU and Directive 2023/2673).
Data processed: name, email, service purchased, booking date, content of the statement.
Retention period: 5 years from the date of the request, for any disputes or legal obligations.

4. Processors (art. 28 GDPR)

The Controller uses the following third parties as processors, with whom contractual agreements compliant with art. 28 GDPR have been concluded (or are available):

  • Netlify, Inc. — website hosting and form management (Netlify Forms). Based in: USA. Processes technical browsing data and the content of submitted forms. Transfers to third countries are governed as set out in section 5.
  • TidyCal (Appsumo LLC) — platform for booking and purchasing services. Based in: USA. Processes the user’s name, email and booking data. Transfers to third countries are covered by Standard Contractual Clauses.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processor. Based in: Luxembourg. Processes the payment data of users who choose PayPal.
  • Stripe Payments Europe, Limited — payment processor. Based in: Ireland. Processes the payment data of users who choose Stripe.

For details of the security measures adopted by each provider, please refer to their respective privacy notices, available on their official websites.

5. International data transfers

Some of the processors listed above are based in, or process data in, countries outside the European Economic Area (EEA), in particular the United States of America.

These transfers take place in accordance with art. 46 GDPR, on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission, which ensure an adequate level of protection.

In particular:

  • Netlify, Inc.: transfers covered by the SCCs in Netlify’s Data Processing Agreement. More information at: netlify.com/gdpr-ccpa
  • Appsumo LLC (TidyCal): transfers covered by the SCCs set out in TidyCal’s privacy policy.

6. Rights of data subjects

As a data subject, you have the right to:

Access (art. 15 GDPR): obtain confirmation as to whether or not data concerning you is being processed and, if so, obtain a copy of that data.

Rectification (art. 16 GDPR): obtain the rectification of inaccurate personal data concerning you.

Erasure (art. 17 GDPR): obtain the erasure of personal data in the cases provided for by law.

Restriction of processing (art. 18 GDPR): obtain the restriction of processing in the cases provided for.

Portability (art. 20 GDPR): receive the data you have provided in a structured, commonly used format, where processing is based on consent or on a contract.

Objection (art. 21 GDPR): object at any time to processing based on the Controller’s legitimate interest.

Withdrawal of consent (art. 7.3 GDPR): withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise the rights listed above, you can contact the Controller at the email address: hello@studiojable.com.

The Controller will reply within 30 days of receiving the request. In particularly complex cases, this period may be extended by a further 60 days, after informing the data subject.

7. Cookies

The website sets no cookies and uses no analytics or tracking tools. Fonts are hosted on the website itself and are not loaded from external services.

For details, please refer to the Cookie policy.

8. Data security

The Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or accidental disclosure, in accordance with art. 32 GDPR. The website is served exclusively over HTTPS and form data is transmitted in encrypted form.

9. Supervisory authority

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority:

Agencia Española de Protección de Datos (AEPD)
Calle Jorge Juan, 6 — 28001 Madrid, Spain
Website: www.aepd.es
Electronic office: sedeagpd.gob.es

10. Updates to this notice

This notice may be updated to reflect changes in the law, technology or operations. The updated version will always be available on this page, with the date of the last change. In the event of substantial changes, the Controller will give notice through a prominent announcement on the website.