Skip to content
balderas.studio

Privacy policy

This is a translation provided for convenience. If there is any difference, the Spanish version prevails.

This policy explains how we handle personal data under Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR, known in Spain as RGPD) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

Alejandro López Balderas (balderas.studio), NIF (Spanish tax ID) 44528079X, Calle de las Moreras 17, 3E, 46024 Valencia (España). Email: alopez@balderas.studio.

What data we handle and why

  • Contact form and emails you send us: name, email address, company, your message and the tasks you tick (including the result of the hours calculator). We use them to reply to you and prepare a proposal. Legal basis: your request and the pre-contractual steps you ask for (art. 6.1.b GDPR).
  • Clients: the data needed to provide the service, invoice and meet our tax obligations. Legal basis: the contract (art. 6.1.b) and legal obligation (art. 6.1.c).
  • Business contacts: contact details that companies publish themselves on their websites (company email address, trading name), so that we can introduce our services to them. Legal basis: legitimate interest (art. 6.1.f GDPR). Every email includes a simple way to ask us not to write again, and we always respect it.
  • Website visits: we count page views, the referring website and the type of device (phone or computer), without cookies and without storing IP addresses or any data that identifies you. To stop spam, the IP address is checked briefly in memory when the form is sent, and is not stored.
  • Visits from an ad or a campaign (a link with utm_source, for example from an ad in ChatGPT): to find out whether the campaign works, we give that visit a random code that travels in the page address while you browse the site. With it we record the campaign and the ad, the type of device, how long you read and how far down, which pages you view and whether you send us the form; if you do, we'll know which ad you came from. It doesn't use cookies, store anything in your browser or keep your IP address. The IP is only checked briefly in memory to filter out repeated clicks. Legal basis: our legitimate interest in measuring the advertising we pay for (art. 6.1.f GDPR). It is deleted after 90 days.

We do not make automated decisions with legal effects on you, and we do not build profiles.

Artificial intelligence tools

We use AI agents in our own work, for example to sort email or draft replies. We do this with the business version of the models (Anthropic), which does not use your data to train its models, and a person reviews any reply to a client before it is sent.

Who we share data with

Only with providers who give us services and act as data processors, under contract and with safeguards:

  • Microsoft (business email and calendar).
  • Anthropic (AI models for business).
  • The hosting provider for the server that runs the website and our systems.
  • Telegram (internal notifications for our team of agents).
  • WhatsApp (Meta), only if you choose to contact us there: WhatsApp handles that conversation under its own terms.

Some of them are outside the European Economic Area (in the United States). These transfers are made with the safeguards required by the GDPR: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We do not sell or pass on data to anyone else, unless required by law.

How long we keep it

  • Enquiries that don't lead to a project: up to 2 years from the last contact, or until you ask us to delete them.
  • Business contacts: until you ask us not to write again (after that we only keep what we need to make sure we don't).
  • Clients: for as long as the relationship lasts and, after that, for the time required by tax and commercial law (up to 6 years).

Your rights

You can request access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw your consent at any time, by emailing alopez@balderas.studio. We will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) (www.aepd.es).

Last updated: 19 October 2026.