Privacy policy
The data you give us is handled for one purpose: to answer what you ask and, if we end up working together, to run that work. It is not sold, not shared for commercial use, and never used to build profiles.
Controller
Daniel Rodríguez Carmona, Spanish tax ID 49349248B, trading under the name Bandrau. The full address is set out in the legal notice.
For anything to do with data protection: legal@bandrau.com. For everything else: hola@bandrau.com.
No data protection officer has been appointed, as the activity does not fall under any of the cases that require one.
What we collect, and where it comes from
From the contact form: name, email address, budget band — optional — and the message you write. Nothing else. There are no hidden fields collecting anything more.
From writing to us: whatever you choose to put in your message.
From the connection itself: the IP address and technical request data that Cloudflare processes to serve and protect the site. It is not kept linked to you and is not used to identify you.
From audience measurement: through Cloudflare Web Analytics, the page visited, the page you came from, the country, the browser and device type, and how long the page took to load. All in aggregate. It uses no cookies and no browser fingerprinting, stores nothing on your device, and cannot identify you or follow you between visits.
If we end up working together: the billing and contact details needed to issue invoices and run the project.
From the booking calendar: if you book a call, your name, email and whatever you write in the booking form. The booking is saved as an appointment in the studio’s Google Calendar, which sends you the invitation with the Google Meet link. The booking calendar belongs to this site: nothing from Google is loaded on the page.
Why, and on what legal basis
Answering your enquiry and preparing a quote or proposal: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). If you write about something that will not end in a contract, the basis is our legitimate interest in replying to people who contact us (Art. 6(1)(f)).
Running the project, if there is one: performance of a contract (Art. 6(1)(b)).
Issuing invoices and keeping accounting and tax records: compliance with legal obligations (Art. 6(1)(c)).
Protecting the form from automated submissions with Cloudflare Turnstile: legitimate interest in keeping the site working and free of abuse (Art. 6(1)(f)).
Knowing how many visits each page gets, in aggregate and without identifying anyone: legitimate interest in understanding whether the site does its job (Art. 6(1)(f)).
Handling or defending against claims: legitimate interest (Art. 6(1)(f)).
Scheduling and holding the call you book: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
No marketing emails are sent and there is no mailing list. If there ever is one, consent will be asked for first and this page will say so.
How long it is kept
The period depends on why the data was collected; there is no single blanket term.
Enquiries that do not lead to a working relationship: one year from the last message, then deleted.
Clients: for as long as the relationship lasts and, once it ends, for as long as liabilities may still arise from it.
Invoicing and accounting: four years under Spanish tax law and six years under the Commercial Code, each counted as the relevant rule requires.
The email these submissions generate lives in the studio inbox and is deleted on the same schedule.
Who else is involved
The site relies on three providers, and only three:
Cloudflare — infrastructure, hosting, audience measurement through Web Analytics and form protection through Turnstile. It processes the technical data of the connection and of the form submission.
Resend — delivery of the email the form generates, both the one that reaches the studio and the acknowledgement you receive. The account is set to its European region (Ireland).
Google Workspace — receipt, storage and handling of the studio inbox, and the booking calendar (Google Calendar and Google Meet) when you book a call.
All three act as processors under the data processing agreement that forms part of their terms of service, with no permission to use the data for their own ends. Beyond that, data is only disclosed to public authorities where the law requires it.
Transfers outside the EU
The email from the form does not leave the European Economic Area: the Resend account sits in its Ireland region, and that is where it is processed.
Cloudflare and Google are US-based and may process data outside the European Economic Area. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified and, failing that, on the standard contractual clauses approved by the European Commission, together with the additional safeguards each contract sets out. The same applies to any occasional support access from outside the European Economic Area.
Your rights
You can request access, rectification, erasure, restriction, objection and portability by writing to legal@bandrau.com. You can also object to processing based on legitimate interest by explaining your particular situation.
You will get an answer within a month at most. If complexity means more time is needed, we will tell you within that month.
If you think this has been handled badly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Automated decisions
There are none. No data is subject to automated decision-making or profiling.