Skip to main content
ESContact

Privacy policy

Last updated: 6 November 2026

This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.

1. Data controller

2. What data we process and why

Contact form, email and WhatsApp

We process your name, your email address, the kind of project you choose and the idea you tell us about, or the details and messages you send us by email or WhatsApp, for the sole purpose of replying to your enquiry and, if you ask us to, preparing a proposal.

  • Legal basis: your consent (art. 6.1.a GDPR), which you give by ticking the acceptance box and can withdraw at any time; and, where the enquiry comes before a contract, steps taken at your request prior to entering into it (art. 6.1.b GDPR).
  • Retention: 12 months from our last contact if we do not end up working together. If you commission a project, the data become part of the business relationship and are kept for the periods required by law.

Technical browsing data

To protect the website from abuse, we limit the number of submissions per IP address. We also use cookieless visitor analytics that do not identify anyone: the figures are aggregated and are not used to build profiles.

  • Legal basis: our legitimate interest in keeping the website secure and understanding its use in aggregate (art. 6.1.f GDPR).
  • Retention: the data used to limit submissions are deleted automatically within a short time, from minutes to hours.

3. Recipients and data processors

We do not share your data with third parties unless required by law. To provide the service we rely on providers acting as data processors, under contracts that comply with art. 28 GDPR:

  • Vercel Inc. (website hosting and cookieless analytics), United States.
  • Resend (Plus Five Five, Inc.), delivery of the form's emails, United States.
  • WhatsApp Ireland Limited, if you choose to write to us on WhatsApp, under its own terms and privacy policy.

International transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified or, failing that, on the standard contractual clauses approved by the European Commission.

4. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time without affecting the lawfulness of earlier processing, by writing to info@madflowstudios.com and stating the right you wish to exercise.

If you feel we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

5. Automated decisions

We do not make automated decisions or build profiles with your data.

6. Security

We apply technical and organisational measures appropriate to the risk, such as encrypted connections (HTTPS) and restricted access to the information.