1. Controller
The data controller is CreativeSignalGroup, 25613, Pssg. Segre, 9, Lleida, Sant Llorenç de Montgai, Camarasa, Spain. Privacy enquiries may be directed to [email protected].
2. Data we collect
When you open a brief, subscribe to updates, or correspond with us, we may collect: name, email address, telephone number, company name, project requirements, budget range, and any other information you choose to provide. We also collect standard technical data (IP address, browser type, pages viewed, referring URL) through essential cookies and privacy-respecting analytics.
3. Purposes and legal bases
We process personal data to: respond to enquiries and prepare quotations (steps prior to a contract, Art. 6(1)(b) GDPR); perform delivered services and invoicing (contract performance, Art. 6(1)(b)); maintain the security and reliability of our website (legitimate interests, Art. 6(1)(f)); meet legal accounting and tax obligations (legal obligation, Art. 6(1)(c)); and, where you have given consent, send occasional studio notes (consent, Art. 6(1)(a)).
4. Retention
Enquiry records are retained for up to 24 months from last contact. Contractual and financial records are retained for the period required by Spanish commercial and tax law (generally up to 6 years). Analytics data is retained in aggregate form for up to 14 months.
5. Recipients and transfers
Data is accessed only by CreativeSignalGroup personnel and vetted processors (hosting, email, analytics, payment) bound by data-processing agreements. We do not sell or rent personal data. Where a processor operates outside the European Economic Area, transfers rely on Standard Contractual Clauses or an adequacy decision.
6. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting prior lawful processing. You may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or your local supervisory authority. To exercise any right, write to [email protected].
7. Security
We apply appropriate technical and organisational measures — encryption in transit, access control, least-privilege permissions, and regular backups — proportionate to the risk of the data we hold.