Privacy policy

1. Controller

Full legal identification appears in the Legal notice.

2. Data we process

If you use the form or email us, we may process your name, phone number, email address, contact preference, message, language and source page, together with the minimum technical data associated with the submission that the infrastructure may record for security and operation.

3. Purpose and legal basis

We use the data to respond to your request, understand your needs and, if requested, prepare a potential professional relationship. The legal basis is taking steps at your request before entering into a contract —Article 6(1)(b) GDPR—. We may rely on legitimate interests —Article 6(1)(f)— to prevent abuse, maintain security and handle claims.

The form checkbox records that you have read this information; it is not consent to advertising. We will not use the data for newsletters or promotional communications without separate permission.

4. Retention

• Enquiry without a project: up to 18 months after the last interaction, after which it will be deleted or anonymised.
• Active negotiation: while the conversation continues and for the time needed to manage possible liabilities.
• Client or contracted project: the data moves to the contractual, accounting and tax records and is kept for the applicable statutory periods.

5. Recipients and providers

We do not sell your data or disclose it for commercial purposes. Providers needed to deliver the service may access it, mainly Netlify —hosting and technical form processing— and Google Workspace —email and enquiry management—, subject to their data processing terms. Data may also be disclosed where required by law.

6. International transfers

Netlify and Google operate international infrastructure. Where processing takes place outside the European Economic Area, the safeguards required by law will apply, such as adequacy decisions or Standard Contractual Clauses approved by the European Commission.

7. Your rights

You may request access, rectification, erasure, objection, restriction and portability, where applicable, by emailing info@bustamanteexperience.com. To prevent unauthorised access, we may request reasonable information to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency.

8. Cookies and measurement

At launch the website does not use analytics, behavioural advertising or cookies that require consent. The infrastructure may use strictly technical mechanisms needed for security and delivery of the service. If this configuration changes, the information will be updated and consent will be requested before non-essential technologies are activated where required.

9. Security and children

We apply reasonable measures to protect the data and limit access to those who need it. The form is not directed at children under 14. If you are under 14, do not send data without the involvement of your parent or legal guardian.

10. Changes

This policy may be updated to reflect legal or technical changes. The date at the top identifies the current version.