ES

Data Protection

Privacy Policy

In accordance with current legislation, Madera Creative Studio (hereinafter also referred to as the “Website”) undertakes to implement the necessary technical and organizational measures, in accordance with the level of security appropriate to the risk associated with the data collected.

I. Privacy and Data Protection Policy

Laws Incorporated in This Privacy Policy

This privacy policy complies with current Spanish and European regulations regarding the protection of personal data on the Internet. Specifically, it complies with the following regulations:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
  • Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD-GDD).
  • Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the Data Controller

The data controller for the personal data collected by Madera Creative Studio is Adrián Jiménez Ballesteros, with Tax ID No. 74945218V (hereinafter, the “Data Controller”). His contact information is as follows:

  • Address: 22 Louis Pasteur Boulevard, 29010 Málaga (Spain)
  • Contact phone number: 677 842 238
  • Contact email: hola@maderacreative.es

Personal Data Record

In compliance with the GDPR and the LOPD-GDD, personal data provided to Madera Creative Studio via forms on its website, email, WhatsApp Business, or other contact channels will be incorporated into the management systems necessary to respond to requests, prepare proposals, maintain communications, and, where applicable, manage business or contractual relationships.

Furthermore, in accordance with the provisions of the GDPR and the LOPD-GDD, unless the exception provided for in Article 30.5 of the GDPR applies, a record of processing activities is maintained that specifies, according to their purposes, the processing activities carried out and the other circumstances set forth in the GDPR.

Principles Governing the Processing of Personal Data

The processing of the User’s personal data shall be subject to the following principles set forth in Article 5 of the GDPR and in Article 4 et seq. of Organic Law 3/2018, dated December 5:

  • Principle of Lawfulness, Fairness, and Transparency: The User will be informed of the purposes and applicable legal bases, and consent will be requested when necessary in accordance with the regulations.
  • Principle of purpose limitation: Personal data will be collected for specific, explicit, and legitimate purposes.
  • Principle of data minimization: The personal data collected will be limited to what is strictly necessary for the purposes for which it is processed.
  • Principle of Accuracy: Personal information must be accurate and kept up to date at all times.
  • Principle of Limitation on Retention Periods: Personal data will only be retained in a form that allows for the identification of the User for as long as necessary for the purposes of its processing.
  • Principle of Integrity and Confidentiality: Personal data will be processed in a manner that ensures its security and confidentiality.
  • Principle of proactive responsibility: The data controller will be responsible for ensuring that the above principles are followed.

Categories of Personal Data

Depending on the channel used and the purpose of the inquiry, Madera Creative Studio may process identifying and contact information (such as name, phone number, or email address), professional and company information, commercial information regarding requested services, quotes and estimated timelines, website addresses or social media profiles provided by the User, as well as the content of communications exchanged with the User.

No special categories of personal data, as defined in Article 9 of the GDPR, are requested. Users are advised not to include particularly sensitive information in forms or business communications.

Legal Basis for the Processing of Personal Data

The legal basis for processing will depend on the specific purpose: the implementation of precontractual measures at the User’s request to respond to inquiries and prepare quotes (Article 6.1.b of the GDPR); the performance of contracts where a contractual relationship exists (Article 6(1)(b)); compliance with legal obligations (Article 6(1)(c)); the organization’s duly balanced legitimate interest in organizing and following up on commercial inquiries where applicable (Article 6.1.f); and the User’s consent for processing operations that require it (Article 6.1.a).

When processing is based on consent, the User may withdraw that consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal. The withdrawal of consent will not prevent processing that must continue based on another valid legal basis.

Whenever the User is required or able to provide personal information through forms to make inquiries, request information, or for reasons related to the content of the Website, the User will be informed if completing any of these forms is mandatory because such information is essential for the proper execution of the transaction.

Purposes for Which Personal Data Is Processed

Personal data is collected and processed by Madera Creative Studio for the purpose of facilitating, streamlining, and fulfilling the commitments established between the Website and the User; maintaining the relationship established through the forms filled out by the User; or responding to a request or inquiry.

They may also be used, in accordance with the applicable legal basis, to organize the commercial follow-up of requests, improve customer service, and compile internal statistics. Unsolicited commercial communications will be sent only when there is legal authorization to do so and in compliance with the applicable options to object or unsubscribe.

At the time the personal data is collected, the User will be informed of the specific purpose or purposes for which the personal data will be processed; that is, the use or uses to which the collected information will be put.

Retention Periods for Personal Data

In general, data associated with inquiries and business opportunities will be retained for a maximum period of 24 months from the last relevant interaction, unless the User requests its deletion before that time and such request is honored, or it is necessary to retain certain data for a longer period to comply with a legal obligation or to fulfill responsibilities arising from a contractual relationship. The data will be deleted or anonymized when it is no longer necessary, in accordance with applicable retention procedures.

At the time the personal data is collected, the User will be informed of the period for which the personal data will be retained or, when that is not possible, the criteria used to determine that period.

Recipients of Personal Data

To provide services and manage communications, certain data may be processed by technology providers, to the extent necessary for each purpose: Meta/WhatsApp Business (messaging), Google (Google Sheets and Google Drive), OVHcloud (hosting), OpenRouter, and the providers of artificial intelligence models used by Madera AI. Internal automation is carried out through an n8n installation managed by Madera Creative Studio. The specific role of each provider depends on the service used.

When such providers act as data processors, their involvement must be governed by the agreements and safeguards required by the GDPR. If international data transfers outside the European Economic Area occur, the applicable safeguards under current regulations will apply. Personal data is not sold to third parties.

Personal Information of Minors

In accordance with Article 8 of the GDPR and Article 7 of Organic Law 3/2018 of December 5, only individuals 14 years of age or older may lawfully give their consent for Madera Creative Studio to process their personal data. In the case of a child under 14 years of age, the consent of the parents or legal guardians is required for the processing, and such processing will only be considered lawful to the extent that they have authorized it.

Confidentiality and Security of Personal Data

Madera Creative Studio is committed to implementing the necessary technical and organizational measures, in accordance with the level of security appropriate to the risk posed by the data collected, so as to ensure the security of personal data and prevent the accidental or unlawful destruction, loss, or alteration of personal data that is transmitted, stored, or otherwise processed, as well as unauthorized disclosure of or access to such data.

The Website has an SSL (Secure Socket Layer) certificate, which ensures that personal data is transmitted securely and confidentially, as the transmission of data between the server and the User—and vice versa—is fully encrypted.

However, because Madera Creative Studio cannot guarantee the impenetrability of the Internet or the complete absence of hackers or others who fraudulently access personal data, the Data Controller undertakes to notify the User without undue delay whenever a personal data breach occurs that is likely to result in a high risk to the rights and freedoms of natural persons. In accordance with Article 4 of the GDPR, a personal data breach is defined as any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Personal data will be treated as confidential by the Data Controller, who undertakes to ensure—through a legal or contractual obligation—that such confidentiality is respected by its employees, associates, and any person to whom it discloses the information.

Rights Arising from the Processing of Personal Data

The User has the following rights with respect to Madera Creative Studio and may, therefore, exercise the following rights—as recognized in the GDPR and Organic Law 3/2018 of December 5—against the Data Controller:

  • Right of access: The User has the right to obtain confirmation as to whether or not Madera Creative Studio is processing their personal data and, if so, to obtain information about their specific personal data and the processing that Madera Creative Studio has carried out or is carrying out, as well as, among other things, the available information regarding the origin of such data and the recipients of any communications made or planned regarding it.
  • Right to rectification: It is the User's right to have their personal data corrected if it is found to be inaccurate or, considering the purposes of the processing, incomplete.
  • Right to erasure ("the right to be forgotten"): The User has the right—unless otherwise provided by applicable law—to have their personal data erased when such data is no longer necessary for the purposes for which it was collected or processed; the User has withdrawn consent to the processing and there is no other legal basis for it; the User objects to the processing and there is no other legitimate reason to continue it; the personal data has been processed unlawfully; the personal data must be erased to comply with a legal obligation; or the personal data was obtained as a result of a direct offer of information society services to a child under 14 years of age. In addition to erasing the data, the Data Controller, taking into account available technology and the cost of implementation, must take reasonable measures to inform other controllers processing the personal data of the data subject’s request to remove any links to that personal data.
  • Right to restriction of processing: The User has the right to restrict the processing of their personal data. The User has the right to obtain restriction of processing when they contest the accuracy of their personal data; the processing is unlawful; the Data Controller no longer needs the personal data, but the User needs it to assert claims; and when the User has objected to the processing.
  • Right to data portability: If the processing is carried out by automated means, the User has the right to receive his or her personal data from the Data Controller in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller. Whenever technically possible, the Data Controller will transmit the data directly to that other data controller.
  • Right to object: This is the User's right to have Madera Creative Studio refrain from processing their personal data or to have such processing cease.
  • Right not to be subject to a decision based solely on automated processing, including profiling: This is the User's right not to be subject to an individualized decision based solely on the automated processing of their personal data, including profiling, unless otherwise provided by applicable law.

Therefore, the User may exercise his or her rights by sending a written notice to the Data Controller with the reference “GDPR—https://maderacreative.es/,” specifying:

  • The User's first and last names and a copy of their national ID card. In cases where representation is permitted, the person representing the User must also provide identification using the same method, as well as a document proving the power of attorney. The photocopy of the ID card may be replaced by any other legally valid means of proving identity.
  • A request stating the specific grounds for the request or the information you wish to access.
  • Address for service of process.
  • Date and applicant's signature.
  • Any document that supports the request you are making.

This application and any other attached documents may be sent to the following address and/or email address:

  • Mailing Address: 22 Louis Pasteur Boulevard, 29010 Málaga (Spain)
  • Email: hola@maderacreative.es

Links to Third-Party Websites

The Website may include hyperlinks or links that provide access to third-party websites other than Madera Creative Studio, and which are therefore not operated by Madera Creative Studio. The owners of those websites have their own data protection policies and are, in each case, responsible for their own data files and privacy practices.

Complaints to the supervisory authority

If the User believes that there is a problem or a violation of applicable law regarding the way in which their personal data is being processed, they have the right to effective judicial protection and to file a complaint with a supervisory authority, specifically, in the country where they have their habitual residence, place of work, or where the alleged violation occurred. In the case of Spain, the supervisory authority is the Spanish Data Protection Agency.

Data Processing Using Madera AI and Business Management Systems

Virtual Assistant and Customer Service via WhatsApp

Madera Creative Studio uses a virtual assistant called AI Wood to answer questions about its services, provide sales guidance to those who contact the company, collect the information needed to evaluate projects, and, when appropriate, forward requests to the staff. The user can request assistance from a human representative during the conversation.

These interactions may involve the User’s name, phone number, company, message content, services of interest, project requirements, estimates and approximate timelines, email address, and websites or social media profiles provided by the User. Messages may be processed by artificial intelligence providers to generate responses; we strive to limit the information transmitted to what is necessary to provide the service. The final drafting of proposals and hiring decisions are the responsibility of the Madera Creative Studio team.

Sales CRM and Integration with Google Sheets and Google Drive

To organize contacts and business opportunities, Madera Creative Studio uses an internal database (CRM) connected to Google Sheets and, when necessary, to Google Drive. Technical integration using an instance of n8n It allows you to view records, create contacts, update business information, and avoid duplicates. Follow-up notes and the status of the case—whether handled by AI or a person—can also be added to the CRM.

Access to Google services is provided through OAuth 2.0, with authorization from a Google account set up for system management. The data obtained through Google APIs is used for the internal business management described above and is not used to train general artificial intelligence models or sold to third parties. Access can be revoked through the security settings of the corresponding Google account.

Technology Providers and International Transfers

The following entities may be involved in the operations described: Meta/WhatsApp Business, Google, OVHcloud, OpenRouter, and the providers of artificial intelligence models used at any given time. Their involvement may entail the disclosure of data strictly necessary for the provision of the service and, depending on the providers’ location or infrastructure, international transfers subject to applicable legal safeguards. Information about these recipients is supplemented in the “Recipients of Personal Data” section of this policy.

Purpose, Preservation, and Rights

The data processed through Madera AI and the CRM are used to respond to inquiries, evaluate projects, prepare or manage quote requests, facilitate human support, and maintain sales follow-up. The legal bases and retention periods described in the preceding sections apply, along with any applicable legal obligations.

Users may request access to, correction of, or deletion of their data, as well as exercise any other rights recognized by applicable regulations, by using the contact information for the Data Controller provided in this policy. Revoking Google’s OAuth authorization prevents future access via that connection, but does not in itself result in the automatic deletion of information previously entered into the CRM.

II. Acceptance and Changes to This Privacy Policy

This Privacy Policy informs Users about the data processing activities carried out by Madera Creative Studio. Use of the Website or contact channels does not replace the need to obtain consent when it is legally required; each data processing activity will be based on the corresponding legal basis, and the required information will be provided at the appropriate time.

Madera Creative Studio reserves the right to modify its Privacy Policy at its sole discretion or in response to changes in legislation, case law, or doctrine issued by the Spanish Data Protection Agency. The User will not be explicitly notified of any changes or updates to this Privacy Policy. Users are advised to check this page periodically to stay informed of the latest changes or updates.

This Privacy Policy was updated to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights.

Should we talk?