Privacy

What data this site handles, why, and for how long.

This policy follows Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD). The site has no newsletter and no accounts: we handle the email or WhatsApp message you choose to send us, what you type into the quote form, and the technical data the hosting needs to serve the pages.

Data controller

Laura López Real, NIF 12342824N, Calle Piedra del Cormorán 2, bloque A, planta 1, puerta 8, 39520 Comillas, Cantabria, Spain. Privacy contact: [email protected].

What we process, and why

You write to us by email or WhatsApp

Data: Your address or your number, your name if you give it, the content of the message and any photographs you send
Purpose: To reply and, if you ask, to prepare a quote
Legal basis: Legitimate interest in answering your enquiry; steps prior to a contract if you ask for a quote (art. 6(1)(b) and (f) GDPR)
Retention: For the length of the conversation and up to two years after it, unless it becomes a commission

You fill in the quote form

Data: Your name, your email address, your phone number if you give it, the topic, the piece's configuration, your message and any measurements you add
Purpose: To reply and, if you ask, to prepare a quote
Legal basis: Your consent, given with the form; steps prior to a contract (art. 6(1)(a) and (b) GDPR)
Retention: For the length of the conversation and up to two years after it, unless it becomes a commission

You are a client

Data: Contact and billing details, the delivery or collection address, communications about the commission
Purpose: To make the piece or the restoration, deliver it, invoice and meet tax obligations
Legal basis: Performance of the contract; legal obligation (art. 6(1)(b) and (c) GDPR)
Retention: For the term of the commission and the statutory periods after it: in general, four years for tax obligations and six for commercial records

You visit the site

Data: IP address and technical connection data, processed by our hosting provider to serve the pages and protect them from attack
Purpose: Security and operation of the site
Legal basis: Legitimate interest (art. 6(1)(f) GDPR)
Retention: The provider's technical logs, for short periods

We make no automated decisions and build no profiles.

Cookies

This site sets no cookies: none for tracking, advertising or analytics, and none for technical purposes either. Its pages load no third-party scripts, so there is nothing to accept or decline. The one thing kept in your browser is what you type into the quote form, held in the tab's session storage while you send it so that a failed send does not lose it; it is removed on the confirmation page and when the tab closes, and it never leaves your browser. Should the hosting provider ever enable a strictly necessary cookie to protect the site from attack, it would need no consent and would be listed here.

Recipients

We do not pass your data to third parties unless the law requires it. To deliver the service we use providers that act as processors under the safeguards of art. 28 GDPR:

Hosting, content delivery, receipt of the workshop's email and the sending of the quote form's email: Cloudflare, Inc. (USA, with operations in the EU). International transfers rest on the EU–US Data Privacy Framework and standard contractual clauses.
Mailbox: Google (Gmail), under the same safeguards.
Messaging: WhatsApp (WhatsApp Ireland Ltd.), when you choose to write to us there.

Your rights

You may access your data, correct it, have it erased, object to its processing, restrict it, ask for it to be ported and withdraw your consent at any time by writing to [email protected]. We will answer within one month. If you consider that we have not dealt with your request, you may complain to the Spanish Data Protection Agency (AEPD, aepd.es).

Security

We apply technical and organisational measures appropriate to the risk: the site is served over HTTPS only, with security headers; access to the systems is limited to those who need it and protected by a second authentication factor; and we store no more data than necessary.

Minors

This site is not aimed at children under 14, and we do not knowingly process their data.

Changes

Any change to this policy will be published here, with the date of its last update.

Last updated: 25 October 2026