Privacy Policy

Data controller

• Identity: Arnau Cruz Borrell
• Tax ID (NIF): 41615395T
• Address: Carrer Joan Frontera Riera, 99, planta superior
• Email: gripdigitalstudio@gmail.com

What data do we collect, and why?

Through the Site's contact form, we collect: name, email address, phone number (optional), company (optional), project type, and the message you write to us. We also automatically log the language of the site you were using, the referring page, and your browser (user agent), so we can handle your request properly and detect misuse of the form.

Purpose: to respond to your request for information or a quote and, should it move forward, to manage the resulting business relationship.

Legal basis: your explicit consent, given by checking the consent box on the form, and the controller's legitimate interest in responding to inquiries addressed to him.

No automated decisions are made and no profiling is carried out using your data.

Client and quote data

If the contact moves forward and a quote is prepared, we create a client record that may include: name, email address, phone number, registered company name, tax ID (NIF or CIF), postal address, city, postcode, and country. You provide this data yourself, and we only ask for it when it is needed to issue the document.

Purpose: to prepare and send quotes, manage the business relationship and, where applicable, meet invoicing and accounting obligations.

As part of that, we also record the payments you make: the date, the amount and, where applicable, an internal note about the payment. This lets us know what has been paid and what has not, and lets us evidence it. We do not store banking details: no account number, no card, no payment method of any kind.

Legal basis: performance of a contract or of pre-contractual measures taken at your request (Article 6(1)(b) GDPR) and, for tax data, compliance with the controller's legal obligations (Article 6(1)(c)).

Your quote link

Each quote is published at its own unlisted address, protected by a random identifier known only to whoever receives the link. That page is not reachable from any menu, does not appear in search engines, and sets no cookies.

Opening it records:

• The date and time it is first opened. This tells us whether the quote was actually read before we follow up by phone. Only the first opening is stored: subsequent visits are not recorded and your browsing is not tracked in any way.
• Your response, if you accept or decline the quote, along with any comment you write at that moment and the date you do so.

The page uses no tracking pixels, no analytics, and no resources loaded from other servers. If you would rather no record of the opening be kept, tell us and we will send the quote as a PDF by other means.

IP address

When you submit the form, a fingerprint of your IP address is stored, derived through a cryptographic function (HMAC) — not the IP address in plain text. This fingerprint is used solely to limit the number of submissions and, if necessary, to help demonstrate that consent was given from a specific address. It cannot be used to directly identify you and is not used for any other purpose.

On a quote page, that same fingerprint is stored only when someone tries to open a link that does not exist, in order to slow down automated attempts to guess addresses. Opening your own link, as many times as you like, records no fingerprint.

How long do we keep your data?

We keep the form data for as long as any resulting business relationship lasts and, after it ends, for the legal limitation periods that apply (for tax, contractual, or liability purposes). If the contact does not lead anywhere, we keep the data only for a reasonable time to handle the inquiry, and you may request its deletion at any time before those periods elapse.

Quotes and the client records linked to an engagement are kept for the periods required by Spanish commercial and tax law. Quotes that are never accepted are kept for as long as they remain useful as a commercial reference, and are deleted at your request.

Who receives your data?

Your data is not shared with third parties except where legally required. To provide the service, we rely on the following data processors, all hosted within the European Union:

• Supabase (database hosting, server located in Frankfurt, EU): stores leads, client records, and quotes.
• Resend (email delivery): the internal notification of a new contact and, where applicable, the email containing the link to your quote.
• Vercel (hosts the website itself).

All of them act as data processors under Article 28 of the GDPR, subject to the terms of their respective data processing agreements.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, and data portability at any time by writing to gripdigitalstudio@gmail.com, stating the right you wish to exercise and attaching a copy of your ID document or other proof of identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you believe the processing does not comply with applicable regulations.

Security

Data is stored with restricted access: the database has row-level security enabled and no public policies, so only the server itself — never a visitor's browser — can read from or write to it.