Privacy policy
Last updated: 30 September 2026
This English version is provided for convenience. If the two versions differ, the Spanish version is the reference text.
1. Data controller
| Data controller | Miguel Zambrana Infantes, self-employed professional |
|---|---|
| Tax ID | 25723002D |
| Address | Avenida de la Constitución, 20 · 29631 Benalmádena (Málaga) |
| Contact | hola@povstudio.es |
2. Data, purposes and legal basis
| Enquiries and quotations | Name, business, email, optional phone number, service of interest, message, page, page title, referrer and campaign parameters. We use these details to answer and reasonably follow up your enquiry, understand which service it concerns and, if requested, prepare a proposal. The legal basis is taking pre-contractual steps at your request (Art. 6(1)(b) GDPR). |
|---|---|
| Email or WhatsApp | The contact details and content you choose to send, to answer your enquiry or take the pre-contractual steps you request (Art. 6(1)(b) GDPR). |
| Clients | Contact, project and billing details needed to provide the agreed service (Art. 6(1)(b) GDPR) and meet accounting and tax obligations (Art. 6(1)(c) GDPR). |
| Security and technical operation | IP address, date and time, requested URL, response status, user-agent, browser language, device or platform indicators and referrer may appear in server logs. We use them to protect, diagnose and operate the website and to produce aggregate technical statistics without individual profiles. The legal basis is our legitimate interest in keeping the service secure and operational (Art. 6(1)(f) GDPR). |
| Google Ads | Google Tag Manager loads in advanced consent mode with advertising storage, user data and personalisation denied by default. Before you choose, and if you reject, Google may receive limited cookieless signals such as consent state, timestamp, page and referrer, browser or device information and a random number to model aggregate results. Advertising cookies, audiences, personalised ads and POV's own conversion events remain disabled. If you accept Advertising, Google may also process advertising identifiers, ad-click information and conversion events to attribute and measure campaigns, optimise advertising, build audiences and show personalised ads. That full advertising use is based on your consent (Art. 6(1)(a) GDPR and section 22.2 LSSI). |
We do not use enquiries for advertising or add them to mailing lists. We do not make automated decisions or create marketing profiles from the form.
3. Advertising choice and Google Ads
Your Advertising choice is stored locally for 12 months with its version and expiry. Google Tag Manager loads with all advertising permissions denied. If you accept, those permissions are granted; if you reject or have not yet decided, Google may only receive the limited cookieless signals described above. You can change your choice at any time through “Privacy settings” in the footer.
Google explains how it processes business advertising data in its Business Data Responsibility information.
4. Form submission and automatically generated data
The form is processed by Formspree, Inc. and sent to our email account. In addition to the fields shown above, this provider may process technical information such as IP address, browser, source domain and referrer to deliver and protect the service. Its processing is described in the Formspree privacy policy.
5. Retention
- Submission history in Formspree: up to 30 days under the Free plan currently in use.
- Email copies of enquiries that do not become a client relationship: up to 12 months after the last relevant contact, unless needed to establish, exercise or defend a legal claim.
- Client and project data: for the duration of the relationship and then blocked for the applicable limitation periods.
- Invoices and commercial documentation: for the legally applicable periods, including the six-year commercial retention period where applicable.
- Server access logs use Skynet's volume-based rotation rather than a fixed number of days: processed files are rotated when they reach 10 MiB and no more than ten compressed rotations are kept per log type. The actual period therefore varies with traffic. A copy may be retained for longer only when needed to investigate an incident or to establish, exercise or defend legal claims. Genuinely anonymous aggregate statistics may be kept while useful; if they can identify or single out a visit, the criteria above apply.
- Advertising choice: 12 months, unless you change it or the purposes or providers change first. Google determines the duration of its data and cookies as described in our cookie policy and its own documentation.
6. Recipients and international transfers
We do not sell personal data. It may be accessed by suppliers needed to operate the service, such as Formspree, email and hosting providers, Google through the limited cookieless signals described above and, if you accept Advertising, through full advertising measurement, and—when you are a client—accounting or professional advisers. Each provider is responsible for its own role or acts as a processor under the relevant agreement.
Formspree is based in the United States. Formspree states that it uses European Commission Standard Contractual Clauses for international transfers. If you choose WhatsApp, Meta's services and international-transfer terms also apply. You can consult the WhatsApp privacy policy for the EEA.
Google Ireland Limited and other Google group companies may process tag and advertising data and make international transfers under the safeguards described in their terms and privacy information. Before acceptance or after rejection, the tag data is limited by the denied consent state described above.
7. Your rights
You can request access, rectification, erasure, restriction, objection and portability where applicable. Write to hola@povstudio.es, identify the request clearly and provide only the information needed to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency.
8. Security, compulsory fields and minors
Required fields are marked because we need them to identify and answer the enquiry; the phone number and service selector are optional. The website uses encrypted transport when published over HTTPS, and we apply proportionate organisational and technical safeguards. No system can guarantee absolute security.
This business website is not aimed at children. If you believe a minor has sent us personal data, contact us so that we can review and, where appropriate, delete it.
9. Changes
We will update this notice if the website's data use, providers or legal requirements change. The revision date appears at the top of this page.