Privacy policy
1. Data controller
| Identity | Eneritz Tejada Cabellos (hereinafter, “the Controller”) |
|---|---|
| Tax ID (NIF) | 38849924A |
| Address | Calle Parlament, 26, 1.º 3.ª – 08015 Barcelona (Barcelona) |
| [email protected] | |
| Telephone | +34 606 251 076 |
| Activity | Artist specialising in art, technology and creative coding |
The Controller guarantees compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This Privacy policy describes how the personal data of people who visit the website www.eneritztejada.es (hereinafter, “the Website”) or who interact with the Controller through it are collected and processed.
2. What personal data do we collect?
- Data provided by the user through the Website’s contact form, by email or by telephone: first name and surnames, email address, telephone number and the content of the enquiry or request.
- Browsing data collected automatically: IP address, browser and device type, pages visited, date and time of access. Where these data are not strictly necessary, they are obtained through cookies and similar technologies only with the user’s consent, as detailed in the Cookie policy.
The user guarantees that the data provided are true and up to date and that, if they provide data relating to third parties, they have their authorisation. The Website is not aimed at children under 14; if the Controller becomes aware of having collected data from a minor without the authorisation of their legal representatives, she will delete them.
3. For what purposes and on what legal basis do we process your data?
| Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|
| Responding to enquiries and requests for information or quotes received through the contact form, by email or by telephone. | Consent of the data subject when sending the enquiry and, where applicable, taking pre-contractual steps at the data subject’s request (Art. 6.1.a and 6.1.b). | While the enquiry is being handled and for up to 1 year afterwards, unless it leads to a contractual relationship. |
| Managing the contractual relationship: provision of the service, invoicing and collection. | Performance of a contract (Art. 6.1.b) and compliance with legal tax and accounting obligations (Art. 6.1.c). | For the duration of the contractual relationship and, thereafter, for the legal limitation periods (as a general rule, 6 years under the Spanish Commercial Code and 4 years for tax purposes). |
| Statistical analysis of browsing in order to improve the Website. | Consent of the data subject through the cookie panel (Art. 6.1.a). | According to the duration of each cookie, as indicated in the Cookie policy. |
| Ensuring the security of the Website and preventing fraud and spam. | Legitimate interest of the Controller in protecting her systems (Art. 6.1.f). | Access logs: 12 months. |
| Handling the exercise of rights and complaints. | Compliance with legal obligations (Art. 6.1.c). | Limitation periods for legal actions (3 years). |
Where the legal basis is consent, the data subject may withdraw it at any time without affecting the lawfulness of prior processing. The data marked as mandatory in the forms are necessary to handle the request; if they are not provided, the request cannot be handled.
4. To whom do we disclose your data?
The Controller does not disclose personal data to third parties, except in the following cases:
- Legal obligation: tax authorities, courts and tribunals, law enforcement agencies or other authorities, where required by law.
- Data processors who provide services to the Controller and access the data solely on her behalf and under contract in accordance with Article 28 GDPR: web hosting and email provider, web development and maintenance company, analytics and consent management tools, and Cloudflare, Inc. (anti-spam protection service for the forms, Cloudflare Turnstile).
International transfers: some technology providers (in particular, Google and Cloudflare, Inc.) may process data outside the European Economic Area. In such cases, transfers are covered by an adequacy decision of the European Commission (EU-US Data Privacy Framework) or by the Standard Contractual Clauses approved by the European Commission.
5. What are your rights?
Any person has the right to:
- Access: know whether we process their data and obtain a copy of them.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of their data when they are no longer necessary.
- Objection: object to processing, in particular processing based on legitimate interest or for direct marketing purposes.
- Restriction: request that processing be restricted in the cases provided for by law.
- Portability: receive their data in a structured, commonly used format, or have them transmitted to another controller.
- Withdraw consent at any time, without retroactive effect.
- Not be subject to automated decisions producing legal effects. The Controller does not make decisions of this kind or carry out profiling with legal effects on the user.
To exercise these rights, write to [email protected] or by post to Calle Parlament, 26, 1.º 3.ª – 08015 Barcelona (Barcelona), stating the right you are exercising and enclosing a copy of an identity document if there are reasonable doubts about your identity. We will respond within a maximum of one month, which may be extended by a further two months in complex cases.
If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of your place of residence.
6. Commercial communications and right to object (Arts. 20 and 21 LSSI-CE)
We do not send commercial communications by email or by equivalent means. Should we do so in the future, we would first request your express consent and include in each mailing a simple, free means of objecting. In any case, you may object to receiving commercial communications by writing to [email protected] with the subject “UNSUBSCRIBE”.
7. Data security
The Controller applies technical and organisational measures appropriate to the risk to ensure the confidentiality, integrity and availability of the data: encrypted communications (HTTPS), access control, backups, regular software updates and confidentiality agreements with staff and providers who have access to data.
8. Social media
The Controller has social media profiles (Instagram and Vimeo). Data that users publish or send through these platforms are governed by the privacy policies of each social network, the Controller being responsible only for the management of her own profiles and the interactions that take place on them.
9. Cookies
The Website uses its own and third-party cookies. You can consult detailed information, and accept, reject or configure their use at any time, in our Cookie policy.
10. Changes to this Policy
The Controller may amend this Privacy policy to adapt it to regulatory changes or to changes in the processing carried out. The version in force will always be the one published on the Website. Where a change is significant, users will be informed by appropriate means.
Last updated: 2 October 2026