Privacy policy
How we handle the personal data of people who visit this website or get in touch through it, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Owner: Mildred Rosa Sint Jago, sole trader operating under the business name “Brand Lab Ads”
- Tax ID: Y1474557H
- Registered address: Paseo del Fuego 7, 18220 Albolote (Granada), Spain
- Email: info@brandlabads.com
You can write to that email address both to exercise your rights and to ask anything about privacy. No data protection officer has been appointed, as none of the circumstances listed in article 37 of the GDPR apply.
2. What data we handle and where it comes from
All the data comes from you. We do not obtain data from third parties, we do not buy it and we do not scrape it from public sources. Each form asks only for what is needed, and you can leave the fields marked as optional blank.
- Contact form: name, email address, phone number (optional), subject and message.
- Quote request form: name, email address, phone number (optional), service you are interested in, your website address (if you have one), budget range and a description of the project.
- Job application form: name, email address, phone number (optional), area of interest, a link to your portfolio and the CV you attach, including whatever information you choose to put in it.
- Direct email: whatever information you include in your message.
- WhatsApp: if you write to us through the WhatsApp button, the phone number you write from, the name and picture on your profile and the content of the messages you send us.
- Technical browsing data: the logs the server generates automatically (IP address, date and time, page requested and browser), which are needed to keep the site running and secure.
We do not handle special categories of data (health, beliefs, ethnic origin and the like), and we ask you not to include them in your messages.
3. What we use it for, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Dealing with your enquiry and replying to you. | Steps taken at your request before entering into a contract (art. 6.1.b) or, where there is no prior relationship, our legitimate interest in replying to whoever writes to us (art. 6.1.f). |
| Preparing and sending you the quote you asked for. | Steps taken at your request before entering into a contract (art. 6.1.b). |
| Considering your application for a job or a collaboration. | Steps taken at your request before entering into a contract (art. 6.1.b) and your consent when you send us your CV (art. 6.1.a). |
| Keeping the site secure and preventing automated submissions and spam. | Our legitimate interest in protecting the service and its communications (art. 6.1.f). |
| Remembering the language you chose for the website. | Delivering the service you yourself requested when you switched language (a technical cookie exempt from consent). |
| Meeting legal, accounting and tax obligations if we end up working together. | Compliance with a legal obligation (art. 6.1.c). |
We will not send you marketing simply because you contacted us: your data is used to deal with what you asked for. If at some point we wanted to send you commercial messages, we would ask you first and you could say no without any consequence. Nor do we build profiles or make automated decisions that affect you.
4. How long we keep your data
- Enquiries and quote requests: while we deal with your request and for up to one year after our last contact. After that they are deleted, unless they have led to a contract.
- Job applications: one year at most. Your CV file is not published or stored on the website: it is deleted from the server the moment it is sent, and the only copy that remains is the one that arrives in our mailbox.
- Clients: for as long as the contract lasts and, afterwards, for the statutory limitation periods (six years for commercial records under article 30 of the Spanish Commercial Code, and four years for tax purposes).
- WhatsApp conversations: the same period as enquiries, up to one year after the last message. Bear in mind that the conversation also stays on your own device and in your WhatsApp account until you delete it.
- Technical server logs: twelve months at most.
5. Who we share your data with
We do not sell, rent or pass your data on to third parties for commercial purposes. The only ones with access are the providers needed to keep the website and the email running. They act as data processors and are bound by an agreement under article 28 of the GDPR:
- Our web hosting provider, with servers located in the European Union.
- Our email provider (Nominalia, part of the Register.it group, European Union), through which we receive the messages sent from the forms.
If you write to us on WhatsApp, the messaging service is provided by WhatsApp Ireland Limited (part of the Meta group), which processes the conversation data as an independent controller, under its own terms and its own privacy policy. We only process the content you choose to send us.
We will also disclose data to courts, public authorities or supervisory bodies where the law requires us to.
6. International transfers
This site loads its typefaces from Google Fonts. When you open a page, your browser connects to Google servers and passes on your IP address along with basic technical details of the connection. Google LLC appears on the list of organisations certified under the EU-US Data Privacy Framework, which the European Commission regards as providing an adequate level of protection. If you use the WhatsApp button, the service is provided by WhatsApp Ireland Limited, based in Ireland, whose group (Meta Platforms, Inc.) also appears on the list of organisations certified under that Framework. Apart from these two cases, no transfer of data outside the European Economic Area takes place. You will find the details in our cookie policy.
7. Your rights
You can exercise the following rights at any time by writing to info@brandlabads.com, stating which right you wish to exercise and enclosing a copy of a document proving your identity:
- Access: finding out what data of yours we hold.
- Rectification: correcting anything that is inaccurate.
- Erasure: asking us to delete your data once it is no longer needed.
- Restriction: asking us to keep your data but stop using it.
- Objection: objecting to processing based on legitimate interest.
- Portability: receiving your data in a commonly used format, where applicable.
- Withdrawing your consent at any time, without affecting the lawfulness of processing carried out beforehand.
Exercising these rights is free of charge. We will reply within one month at most, extendable to two if the request is particularly complex — in which case we would let you know.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), calle Jorge Juan 6, 28001 Madrid (www.aepd.es).
8. Information security
We apply technical and organisational measures appropriate to the risk: the whole site is served encrypted over HTTPS, access to the content manager is restricted to authorised staff with their own credentials, the forms include filters against automated submissions, and CVs are processed outside the public area of the server and deleted once they have been sent. No system is infallible, but we review these measures regularly.
9. Accuracy of your data, and minors
By sending us a form you confirm that the data is yours, or that you are authorised to provide it, and that it is accurate. This site is aimed at professionals and businesses: it is not intended for children under fourteen and we do not knowingly collect their data. If we find that we have received a child's data without authorisation, we will delete it.
10. Changes to this policy
We may update this policy if the services on the site or the applicable rules change. Any amendment will be published on this same page, with a new update date.