Privacy Policy
Last updated: 7 October 2026
This policy explains how we process the personal data you share with us through this website or by email, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
| Controller | Manel Mayans Sánchez, trading as AboveStudioo |
|---|---|
| Tax ID (NIF) | 46257886X |
| Address | C/ Lluna, 9, 17310 Lloret de Mar (Girona), Spain |
| abovestudioo@gmail.com |
2. What data we collect
- Brief form: your name, email address, company or product name, website and the project details you choose to share (product description, audience, goals, deadlines, brand assets and references).
- Email: your email address and whatever you include in your messages and attachments.
- Clients: billing details (name or company name, tax ID, address) and the materials you provide for each project.
- Technical data: our hosting provider may process your IP address and basic request data to serve the website securely. We do not use analytics or advertising cookies.
Please do not send us special categories of personal data. We do not need them to provide our services.
3. Why we use it and on what legal basis
| Answering your brief or message and preparing a proposal | Steps taken at your request before entering into a contract (Art. 6.1.b GDPR), and your consent when you submit the form (Art. 6.1.a). |
|---|---|
| Providing the contracted services and managing the client relationship | Performance of a contract (Art. 6.1.b GDPR). |
| Invoicing and meeting our tax and accounting obligations | Legal obligation (Art. 6.1.c GDPR). |
| Showing your ad in our portfolio and publishing your testimonial (launch offer only) | Your express consent (Art. 6.1.a GDPR), which you can withdraw at any time. |
| Keeping the website secure | Our legitimate interest in protecting the website (Art. 6.1.f GDPR). |
We do not make automated decisions or build profiles with your data, and we do not send marketing emails without your consent.
4. How long we keep it
- Brief and enquiry data that doesn't lead to a project: up to 12 months after our last exchange, unless you ask us to delete it sooner.
- Client data: for as long as the business relationship lasts, and afterwards for the periods required by law (for example, 6 years for accounting records under the Spanish Commercial Code, and 4 years for tax purposes).
- Portfolio and testimonial use: until you withdraw your consent.
5. Who we share it with
We do not sell your data. We only share it with service providers that process it on our behalf, under data processing agreements:
- Tally (Tally BV, Belgium): brief form. Data is stored in the EU.
- Google (Google Ireland Ltd.): email through Gmail and file storage.
- Cloudflare (Cloudflare, Inc.): website hosting and security.
- Stripe (Stripe Payments Europe Ltd., Ireland) and our bank: payment processing.
We may also disclose data to public authorities when the law requires it.
6. International transfers
Some providers, such as Google and Cloudflare, may process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by the EU–US Data Privacy Framework, when the provider is certified, or by the European Commission's Standard Contractual Clauses.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, at any time and free of charge. Email abovestudioo@gmail.com with the subject "Data protection" and say which right you want to exercise. If we need to confirm your identity, we will ask you for the minimum information required.
If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
8. Cookies and similar technologies
This website does not set its own cookies and does not use analytics or advertising trackers. Fonts and videos are served from our own domain. When the brief form loads, Tally may use the technical storage the form needs to work. See Tally's privacy policy for details.
9. Security
We apply reasonable technical and organizational measures to protect your data against loss, misuse and unauthorized access, including encrypted connections (HTTPS) and access restricted to the people who need it.
10. Changes to this policy
We may update this policy to reflect legal or operational changes. The current version is always available on this page, with its last update date.