Privacy

Terral Studio is the trading name shared by two self-employed professionals: Rubén Díaz Fraga (tax ID 34281643M) and Daniel Aguilar Fernández (tax ID 77199164D). They decide together what is done with the data from this website, so they are joint controllers (Article 26 GDPR) and both are responsible; you can ask us for the essence of that arrangement. Their addresses are in the legal notice. For any question about your data, email contact@terral.studio.

We receive what you write in it: name, email, business, plan of interest and message. We use it to assess your enquiry, reply and, if you ask, prepare a quote. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). If we do not end up working together, we delete the conversation 12 months after the last contact; if there is a project, the data becomes part of it and is kept as long as tax and commercial obligations require, up to 6 years.

To ask for a video call you give us your name and your email, and if you want your business, your phone number, what you would like to talk about and how you heard about us. When you send it we also note how you reached the meeting page: the campaign in the link (its “utm” parameters), the website that linked to you, the page of ours you came from, or “direct”; we use no cookies for this and store nothing in your browser. We use it to confirm and prepare the meeting; the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). How you heard about us and how you arrived are also used to know which channels bring us meetings, based on our legitimate interest in measuring our own marketing (Article 6(1)(f) GDPR), and you can object by writing to us. None of this is stored in any database: the request travels signed inside the link of the email that reaches us, and to hold the slot while we decide, a provisional event is created in our Google Workspace calendar (Google Ireland Ltd.) with your name, your email, what you wrote to us, how you arrived and how you heard about us, without inviting you. If we accept, that event becomes the meeting, with you as a guest and a Google Meet link, and it is kept for as long as it makes sense in the calendar; if we do not accept, it is deleted, and the emails we have exchanged are kept like those from the contact form.

When you sign up for a subscription, you contract with one of the two professionals, the one shown on the sign-up page, and that person processes your data as controller: name, email, business, tax ID and billing address. It is used to provide the service, invoice you and collect payment; the legal basis is the contract (Article 6(1)(b) GDPR) and tax obligations (Article 6(1)(c) GDPR). Payment is handled by Stripe Payments Europe, Ltd. (Ireland) from that professional's account: your card or bank account details are collected by Stripe directly and we never see them. Stripe also processes some data as an independent controller, to prevent fraud and comply with payments regulation, under its own privacy policy (stripe.com/privacy), and may transfer it to Stripe, Inc. (United States) under the EU-US Data Privacy Framework and standard contractual clauses. Invoices and the data needed to issue them are kept as long as tax and commercial obligations require, up to 6 years.

Your message reaches us by email through Resend, Inc. (United States, certified under the EU-US Data Privacy Framework) and we keep it in Google Workspace (Google Ireland Ltd.). The website is hosted on an OVH server in Zurich (Switzerland, which has an adequacy decision from the European Commission). We do not sell or share your data.

We call businesses whose phone number is published on their website or Google listing, to offer web design and development related to their activity. We keep the business name, that phone number, its website and what we talk about, on our OVH server in Zurich (Switzerland). The legal basis is our legitimate interest in business-to-business contact (Article 6(1)(f) GDPR and Article 19 of the Spanish LOPDGDD), assessed before calling. If you tell us you do not want to be called, we record it straight away and will not call again; if you are self-employed, we check the Spanish Robinson List before calling. We only write to you by WhatsApp or email if you ask for it or authorise it during the call. If we never get to talk, your details are deleted after 30 days; if we do, we keep them while the conversation lasts and review them every year, and if you tell us you are not interested, we keep only the minimum needed not to bother you again. You can exercise your rights at contact@terral.studio.

Only if you accept it in the cookie notice, we measure visits with Google Analytics (Google Ireland Ltd., acting as processor): pages viewed, referrer, device and approximate location, in aggregate and without storing your IP address. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from “Cookie settings” in the footer. Google may process data in the United States under the EU-US Data Privacy Framework. Data is kept for up to 14 months. We also keep what you chose in the notice, without your IP address, for three years, so that we can prove it. The detail is in the cookie policy.

You can request access, correction, deletion, restriction, objection or portability by emailing contact@terral.studio. We reply within one month. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).