This policy explains how personal data are processed on this website in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), and other applicable law.
1. Data controller
Andrea de Castro
To contact the data controller or exercise your data protection rights, you can use this website’s contact form.
2. Data that may be processed
- Contact form: email address, subject, message, and any information you voluntarily include. Please do not submit particularly sensitive data unless it is essential.
- Abuse prevention: the connection address observed by the server is processed briefly in memory. A cryptographic digest is generated with a site key; only that digest, a counter, and the start time are temporarily stored to limit submissions.
- Browsing and infrastructure: the server and hosting provider may process technical data such as IP address, date and time, requested URL, response code, browser or user agent and, if supplied, referring page, to deliver and protect the service.
- Language: a first-party cookie remembers the site language. Its name and duration are listed in the Cookie Policy.
3. Purposes and legal bases
- Replying to enquiries, quote requests, or possible commissions: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) where the enquiry concerns a possible professional relationship.
- Handling other communications initiated by you: the legitimate interest in replying and managing correspondence (Article 6(1)(f) GDPR), without using it for marketing.
- Keeping the site operational and secure and preventing abusive submissions: the legitimate interest in protecting the service and communications (Article 6(1)(f) GDPR).
- Meeting legal obligations: Article 6(1)(c) GDPR, only where the law requires information to be retained or disclosed.
No automated decisions or profiling are carried out using these data.
4. Delivery and retention
- The form emails the submitted address, subject, and message to the data controller. The submitted address is used as the reply address (Reply-To). WordPress does not permanently retain these fields in its database. The mail transport provider and recipient mailbox provider process the correspondence and may store it in their systems.
- Correspondence is kept only for as long as reasonably necessary to handle the enquiry and, where applicable, manage any resulting professional or contractual relationship, meet legal obligations, or defend claims. It may be deleted when it is no longer needed.
- The cryptographic digest, counter, and start time used to limit submissions expire no later than 15 minutes after the control window starts. The message content and plain-text IP address are not part of this temporary record.
- Technical hosting logs are retained according to the operational and security needs of the provider hosting the site.
5. Recipients and service providers
Andrea receives and manages enquiries. To provide the service, the provider hosting the website, the provider transporting the email, and the recipient mailbox provider may also process the data needed for their respective services. Data may also be disclosed to authorities or other recipients where required by law. The site does not sell personal data or disclose them to social networks, portfolio platforms, or analytics services merely because the site is visited.
6. International transfers
The location of processing depends on the hosting and email providers in use. If a provider processes data outside the European Economic Area, the safeguards required by the GDPR must apply, such as an adequacy decision or standard contractual clauses, as appropriate. This information will be reviewed if the hosting or email configuration changes.
7. Your rights
You may request access, rectification, erasure, restriction of or objection to processing, and portability where applicable. To exercise these rights, use the contact form, state that your message is a data protection request, specify which right you wish to exercise, and provide only the information needed to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
8. Security and data minimisation
Proportionate measures are used to restrict access, validate submissions, and minimise the data processed. No system is infallible; measures will be reviewed when the site, providers, or risks change.
9. External links
The site contains ordinary links to Instagram, ArtStation, APIC and, for some projects, other websites. These services are not embedded and receive no data merely because the page is viewed; when you follow a link, the destination site applies its own privacy and cookie policies.
10. Updates
This policy will be updated if the form, hosting, email, cookies, analytics, or other processing changes.
Last updated: 16 September 2026.