Privacy

Data controller

• Controller: Ventura Vega Martínez, owner of the Calleja Estudio website.
• Email: hola.callejaestudio@gmail.com.

What data is processed and why

This website has no user accounts, shop or newsletter, and uses no advertising tools. Personal data is only processed when someone contacts the studio:

• Contact form: when “Send” is pressed, the message reaches the studio’s email through the website’s hosting, which does not store it. The writer’s name, email address and message are received and, if they ask about a piece, the name of that piece.
• Email: whatever details each person chooses to give when writing.
• Instagram: messages sent through Instagram are also subject to Meta’s privacy policy.

This data is used only to reply and deal with the enquiry. It is not used to send advertising, no profiles are built and no automated decisions are made.

Legal basis

• To reply to an enquiry: the consent of the person writing, given by sending their message (Article 6(1)(a) GDPR) and, if they ask about a piece or a commission, steps taken at their request prior to entering into a contract (Article 6(1)(b)).
• For the technical security of the website and to know, in aggregate, how many people visit it: the legitimate interest in keeping it secure, running and improving it (Article 6(1)(f)).

Retention

Messages are kept for as long as needed to deal with the enquiry. They are then deleted, unless they must be kept, blocked, to deal with possible claims for the periods set by law, as provided in Article 32 of the LOPDGDD.

Recipients

Data is not disclosed to third parties, except where required by law. When an enquiry concerns a piece or a commission, it is shared with its author, Juan Manuel Martínez Calleja, solely so that he can reply, as requested by the person writing.

To operate, the website and email rely on providers acting as data processors, under contract and with the safeguards of Article 28 GDPR: web hosting (Cloudflare, Inc.) and email (Gmail (Google LLC)). Both are United States companies and may process data there: this is an international transfer, covered by the European Commission adequacy decision on the EU-US Data Privacy Framework, to which both have signed up, and by the standard contractual clauses in their contracts (Articles 45 and 46 GDPR).

Browsing, cookies and local storage

This website does not use cookies, whether for analytics or advertising, and does not embed third-party content that sets them. Fonts are served from the website itself.

It only stores two preferences in the browser’s local storage: the language in which the website is shown (on the first visit, the browser’s own; afterwards, the one chosen) and the way of viewing the Work section (“one by one” or “all”), so as to remember them on the next visit. They are the visitor’s preferences, they do not identify anyone and they never leave their device; they therefore do not require consent (Article 22(2) LSSI-CE). They can be deleted at any time from the browser settings.

Like any server, the hosting server records technical data for each visit (IP address, browser, page and time) in order to deliver the website and protect it from abuse. This data is not used to identify anyone and is kept only for as long as needed for those purposes.

To know how many people visit the website, it uses Cloudflare Web Analytics, from the same provider as the hosting. It uses no cookies and stores nothing in the browser, does not follow anyone from one website to another and only gives overall figures (pages viewed, country, type of device and where the visit comes from).

Your rights

Anyone who has provided their data may, at any time, access, rectify or erase it, object to or restrict its processing, request its portability and withdraw their consent, without affecting processing carried out beforehand. Simply write to hola.callejaestudio@gmail.com stating which right you wish to exercise. If there is reasonable doubt about the identity of the person making the request, further information may be requested to confirm it. You will receive a reply within one month.

If you believe your data has not been processed properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), calle Jorge Juan, 6, 28001 Madrid.

Minors

This website is not aimed at children under fourteen. If a child under that age writes, their data will only be processed with the consent of their parents or guardians (Article 7 LOPDGDD).

Security

Appropriate technical and organisational measures are applied to protect data against loss, unauthorised access or misuse, as required by Article 32 GDPR. The website is served over an encrypted connection (HTTPS).

Changes

This policy may be updated when the website or the law changes. The version in force is always the one published on this page.