Privacy Policy

1. Data controller

In accordance with Regulation (EU) 2016/679, of 27 April (GDPR), and Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and the guarantee of digital rights (LOPDGDD), the user is informed that the data controller of the personal data collected through the Website jesusgranada.com is:

• Controller: Jesús Granada Fernández
• Tax ID (NIF): ES26220672M
• Address: Calle Doctor González Caraballo 1, Estudio 210, Edificio PortaSevilla, 41020 Seville (Spain)
• Email: admin@jesusgranada.com

For any matter related to personal data protection, the user may contact the controller at admin@jesusgranada.com.

2. Purposes of processing

Personal data collected through the Website is processed for the following purposes:

• Quote requests: to handle quote requests sent through the corresponding form, respond to the enquiry and, where applicable, formalise and perform the contracted professional service.
• General contact: to attend to enquiries, requests for information and communications sent by the user through the forms or email addresses published on the Website.
• Blog comments: to publish and manage the comments that users send on blog posts, and to prevent automated submissions of spam.
• Browsing analytics: to obtain aggregated and anonymous statistics on the use of the Website through Google Analytics, in order to improve content and user experience.
• Security: to ensure the security of the Website and prevent fraudulent or abusive activities through the firewall and access logs.
• Email delivery: to send emails in response to user enquiries and, where applicable, to keep records of such submissions through the transactional mail service configured on the Website.

3. Legal basis for processing

The legal basis for the processing of personal data is:

• The consent of the data subject, given through the voluntary completion of the forms or the submission of comments and communications (Article 6.1.a GDPR), which can be withdrawn at any time.
• The performance of a contract or the application of pre-contractual measures at the request of the data subject in the case of quote requests (Article 6.1.b GDPR).
• Compliance with legal obligations applicable to the controller, in particular tax, accounting and invoicing obligations (Article 6.1.c GDPR).
• The legitimate interest of the controller in ensuring the security of the Website and preventing automated spam submissions (Article 6.1.f GDPR).

4. Personal data processed

Depending on the form or service used, the following categories of data may be processed:

• Identifying data: name, surname.
• Contact data: email address, telephone number.
• Professional or project data: name of the studio, company or institution, project description, location, deadlines.
• Browsing data: IP address, browser identifiers, pages visited, time spent, under the terms described in the Cookie Policy.
• Any other information that the user voluntarily provides in the body of their message.

No special categories of personal data (Article 9 GDPR) are processed, nor data of minors. The user warrants the truthfulness and accuracy of the data provided and shall be solely responsible for any false or inaccurate statements made.

5. Retention period

Personal data will be kept for the time strictly necessary to fulfil the purpose for which it was collected and, where applicable, for the periods legally required to address potential liabilities:

• Quote requests and enquiries: while the enquiry is being attended to and, if the request does not result in a commission, for a maximum of one year.
• Contractual relationship: for as long as the professional relationship is maintained and, once it has ended, for the periods legally required (in particular, those provided for in tax and commercial law, up to six years).
• Blog comments: for as long as the post remains published, unless the user requests their removal.
• Browsing data and cookies: the periods described in the Cookie Policy.

6. Recipients and processors

Personal data will not be transferred to third parties, except where legally required. However, in order to provide the Website service, the controller relies on processors who access the personal data on behalf of the controller and under their instructions, in particular:

• Web hosting provider, located in the European Union.
• Google Ireland Limited / Google LLC, in relation to the Google Analytics service.
• Transactional email service provider used for sending messages from the Website.
• Security and firewall service provider applied to the Website.

All processors have entered into the corresponding data processing agreement under the terms of Article 28 GDPR.

7. International transfers

Some of the processors mentioned may process personal data outside the European Economic Area. In particular, in the case of Google LLC, transfers to the United States are covered by the EU-US Data Privacy Framework, adopted by the European Commission through the Implementing Decision of 10 July 2023, which recognises an adequate level of protection. Failing that, transfers will be carried out under the standard contractual clauses approved by the European Commission or other legally valid mechanisms.

8. Rights of the data subject

The user has the right to:

• Access their personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of the data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Object to the processing of the data in certain circumstances.
• Restriction of processing.
• Data portability.
• Not to be subject to automated decisions, including profiling, that produce legal effects on the user or significantly affect them in a similar way.
• Withdraw consent given at any time, without this affecting the lawfulness of the processing based on consent prior to its withdrawal.

These rights may be exercised by sending a communication to admin@jesusgranada.com, indicating “Data protection” in the subject line and attaching a copy of a document proving the identity of the applicant.

9. Right to lodge a complaint

When the user considers that the controller has infringed the rights recognised by the applicable regulations, they may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), in particular when they have not obtained satisfaction in the exercise of their rights.

10. Modification of the privacy policy

The controller reserves the right to modify this privacy policy in order to adapt it to legislative or case law developments. Modifications will be published on the Website and shall apply from the date of publication.