Privacy policy

Data controller

Controller

David Monje Navidad

Business address

Rambla Recolons, 17 · 17455 Caldes de Malavella · Girona · Spain

Email

[email protected]

Website

crida.studio

What data we may process

Depending on your relationship with crida studio and the features you choose to use, we may process the following categories of data:

• Identification and contact data, such as your name, email address, telephone number, company or organisation.
• Information you voluntarily provide in enquiries, messages, conversations, briefings or quotation requests.
• Data needed to manage a contractual, administrative, accounting or billing relationship.
• Technical data needed to ensure the operation and security of the website and its services and to prevent abuse.
• Pseudonymised technical information or approximate location information where needed to protect systems, prevent fraud or analyse service incidents.

Special categories of personal data are not routinely requested. Please avoid providing particularly sensitive information that is not necessary for your enquiry.

How we use the data

Enquiries, contacts and quotations

To respond to messages, understand a professional need, assess a project, prepare a proposal and manage requests for information or quotations. The legal basis will be taking pre-contractual steps at the request of the data subject and, where appropriate, the legitimate interest in responding to communications related to the professional activity.

Services and clients

To manage projects, communications, service delivery, administration and billing. The legal basis will be performance of the contractual relationship and compliance with applicable legal obligations.

Operation and security

To ensure the availability and integrity of the services, prevent abuse, control automated or fraudulent requests, maintain technical security and resolve incidents. The legal basis is the controller’s legitimate interest in protecting its systems, services and information.

Feedback and service improvement

If you voluntarily submit a rating or comment, the information provided may be used to detect incidents, analyse quality and improve how the service operates.

Marketing communications

Where consent is expressly requested to receive marketing communications, they will be sent on the basis of that consent, which may be withdrawn at any time.

Interaction with the artificial intelligence assistant

The website includes an artificial intelligence assistant. Its responses are generated automatically and may contain errors.

When you interact with it in writing, the content needed to generate a response is processed through specialised technology providers acting as part of the service provision.

If you voluntarily activate voice features, audio is processed in real time to recognise or generate speech. crida studio does not retain your voice as an audio file.

If you confirm a commercial request or briefing, only the data needed to manage that request will be retained, including contact details, the reviewed content and the information needed to evidence its submission.

Submitting a commercial request is voluntary and requires an explicit confirmation action.

How long we retain information

Data will be retained for as long as necessary to fulfil the purpose for which it was collected and, afterwards, for the periods during which legal obligations or liabilities may arise.

Data relating to clients, projects and billing will be retained for the duration of the professional relationship and, afterwards, for the periods required by tax, commercial and other applicable legislation.

Ratings and associated information used to analyse how the service operates have a standard maximum retention period of 180 days.

Confirmed commercial requests or briefings have a standard maximum retention period of 365 days, without prejudice to the request resulting in a contractual relationship or the need to retain certain data for other legally applicable periods.

Any copies that may exist in email systems, delivery logs or backups will follow the retention periods needed to provide the service and comply with the corresponding legal obligations.

Who may process the data

Data will not be disclosed to third parties unless there is a legal obligation, it is necessary to manage the requested service or providers are involved in delivering services on behalf of the controller.

Depending on the feature used, the following categories of recipients may be involved:

• Web hosting, infrastructure and maintenance providers.
• Cloud infrastructure and computing providers.
• Artificial intelligence and voice-processing service providers.
• Security, abuse-prevention and automated-traffic protection providers.
• Email, communications and form or request delivery providers.
• Advisers or professionals who need to be involved due to a legal obligation or to manage the professional relationship correctly.

Where these providers act as processors, they must process the data in accordance with the controller’s instructions and the safeguards required by data-protection law.

International transfers

Some technology providers may be established or operate infrastructure outside the European Economic Area.

Where processing involves an international transfer of data, it will rely on the mechanisms provided for by the General Data Protection Regulation, such as an adequacy decision, standard contractual clauses or other applicable appropriate safeguards.

You can request additional information about the applicable safeguards by writing to [email protected].

Your rights

Where applicable, you can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability.

You may also withdraw consent you have previously given at any time. Withdrawal does not affect the lawfulness of processing carried out before that point.

To exercise your rights, you can write to [email protected], stating which right you wish to exercise. Additional information will only be requested to verify your identity where necessary.

If you believe that the processing of your data does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency.

Where the data comes from

As a general rule, data comes directly from the data subject, for example when they submit an enquiry, interact with the assistant, send an email, request information, ask for a quotation or begin a professional relationship.

Certain technical information may be generated automatically from the connection and the infrastructure needed to operate and protect the service.

Automated decisions

Certain features use automated systems to generate responses or assist in preparing enquiries and requests.

The processing described in this policy is not intended to involve decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them.

How we protect information

Technical and organisational measures appropriate to the risk are applied to protect personal data against loss, alteration, unauthorised access, disclosure or unlawful processing.

These measures may include access controls, validation, abuse prevention, pseudonymisation, request limiting, incident logging and other mechanisms appropriate to the nature of the service.

Policy updates

This Privacy policy may be updated when processing activities, providers, website features or applicable law change. The version published on this page will be the version in force at any given time.