Privacy Policy
1. Who is responsible for your data
Data controller: [Full legal name], trading as PROJEKTA2, [NIF], [postal address, Girona, Spain]. Contact for privacy matters: [email protected].
2. What data is collected, and why
| Where | Data collected | Purpose | Legal basis |
|---|---|---|---|
| Newsletter / lead magnet form | Email address, name (optional) | Send the requested checklist download and occasional editorial/commercial updates | Consent (Art. 6.1.a GDPR) — withdrawable anytime via the unsubscribe link |
| Contact / Evaluation Gate form | Name, email, message content, and any project details you choose to share | Respond to your inquiry about acquisitions, commissions, or press | Steps prior to entering into a contract (Art. 6.1.b) or legitimate interest in responding to inquiries (Art. 6.1.f) |
| Acquisition / Acquire landing page | Name, email, indicative budget range, project description | Qualify and follow up on acquisition or commission inquiries | Steps prior to entering into a contract (Art. 6.1.b) |
| Course purchase | Name, email, billing details, payment data (handled by the payment processor, not stored by PROJEKTA2 directly) | Deliver the course, issue invoices, comply with tax obligations | Performance of a contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) |
| Certificate generation (“Certify state”) on artwork pages | None sent to any server. The SHA-256 hash, canvas snapshot, and session log are computed entirely in your browser and only leave your device if you choose to download the resulting .json file yourself. | — | Not applicable — no personal data is processed by PROJEKTA2 in this feature |
| verify.html certificate verification | None sent to any server by default. If the optional server-side lookup is enabled, only the certificate’s hash (not personal data) is sent to check registration. | Confirm a certificate’s integrity, optionally cross-check its hash against PROJEKTA2’s own record | Legitimate interest in fraud prevention (Art. 6.1.f) |
| Server logs (hosting provider) | IP address, browser type, pages visited, timestamps | Security, abuse prevention, basic technical diagnostics | Legitimate interest (Art. 6.1.f) |
Note on certificate hashes: The hash generated during certificate creation exists only locally in your browser; it is not stored on our servers unless you voluntarily upload the file for verification via verify.html.
3. Who receives your data
PROJEKTA2 does not sell personal data. The following processors may access data strictly to provide the service indicated:
- Mailchimp (The Rocket Science Group LLC, USA) — newsletter and lead-magnet delivery. Mailchimp participates in the EU-U.S. Data Privacy Framework, which is the current legal mechanism recognized by the European Commission for transfers of this kind; you can review Mailchimp’s own privacy practices at mailchimp.com/legal/privacy.
- Hosting provider: [name of WordPress hosting company], storing site data and server logs.
- Payment processor: [e.g. Stripe / PayPal — name the one actually used for course sales], processing payment details directly; PROJEKTA2 does not store full card numbers.
Data is not otherwise shared with third parties except where required by law (e.g., tax authorities) or with your explicit consent.
4. International data transfers
Where a processor listed above is based outside the European Economic Area (notably Mailchimp, in the United States), the transfer relies on the EU-U.S. Data Privacy Framework adequacy mechanism. In the event that this framework does not apply to a particular transfer, PROJEKTA2 will rely on the Standard Contractual Clauses approved by the European Commission. You may request a copy of the relevant safeguard by writing to [email protected].
5. How long data is kept
- Newsletter subscribers: until you unsubscribe, or up to [e.g. 3 years of inactivity] without engagement.
- Contact and acquisition inquiries: for the duration needed to handle the inquiry and a reasonable follow-up period, typically no more than [e.g. 24 months].
- Course and acquisition purchase records: for the period required by Spanish tax and commercial law (generally [4–6 years, confirm with an accountant]).
6. Your rights
Under the GDPR and LOPDGDD, you have the right to:
- Access the personal data held about you.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”), subject to legal retention obligations.
- Restrict or object to processing based on legitimate interest.
- Port your data to another provider, where technically feasible.
- Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal), for example by clicking “unsubscribe” in any newsletter email.
To exercise any of these rights, write to [email protected]. We will respond to your request within the maximum legal period of one month, as required by Article 12 of the GDPR. If you believe your data has not been handled correctly, you have the right to lodge a complaint with Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD) — aepd.es — or the supervisory authority of your own EU country of residence.
7. Security
Reasonable technical and organizational measures are used to protect personal data against unauthorized access, loss, or alteration. This includes, among others, the use of HTTPS encryption for all data transmitted through this website. No system is completely infallible; if a breach affecting your data occurs, applicable notification obligations under the GDPR will be followed.
8. Changes to this policy
This policy may be updated to reflect changes in processing activities or applicable law. The “last updated” date at the top of this page reflects the most recent revision.