Privacy policy

TODO(kunde): Draft (remove before go-live): the identification details were not available on the previous website and must be confirmed in writing by the client; “TODO” fields are still open. Not legal advice – to be reviewed by a lawyer before publication.

1. Controller

Eva Giselle Paz Fúnez (Vertical Art – Movement Experience), TODO: domicilio (calle y número), TODO: CP Barcelona, Spain. Email: [email protected].

2. What we process and why

Contact and group-proposal forms

Name, email, phone (optional) and your message, solely to answer your enquiry. Legal basis: consent (art. 6(1)(a) GDPR) and pre-contractual steps (art. 6(1)(b) GDPR).

Booking a spot

Name, email, phone, chosen mode (in person or online) and the optional note, to manage your booking, send you the details (place, Google Meet link) and keep the participant list. Legal basis: performance of a contract (art. 6(1)(b) GDPR). The website stores no database: data reaches us by email and is kept for the duration of the relationship and statutory retention periods.

Payment

Payment takes place outside this site on Stripe (Stripe Payments Europe Ltd., Ireland), an independent controller of payment data. We only receive the payment confirmation with your name and email. See Stripe’s privacy policy.

3. Hosting and security

The site is hosted and delivered by Cloudflare (Cloudflare, Inc., USA), which processes technical connection data (IP address, time, requested resource) to provide the service securely (art. 6(1)(f) GDPR). International transfers are covered by the EU-US Data Privacy Framework (Cloudflare is certified) and standard contractual clauses. Forms are protected against spam with Cloudflare Turnstile, which uses no tracking cookies.

4. Form delivery (Brevo)

Form messages are delivered to us through the transactional email service Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany), acting as processor under a data processing agreement. If delivery fails technically, the request is kept briefly in our host’s server log so it is not lost; the log is deleted automatically after a short time.

5. Appointments (Cal.com)

For one-to-one ExpresARTE sessions you may book a time through Cal.com. Data entered there is processed to arrange and hold the appointment (art. 6(1)(b) GDPR); see the provider’s privacy policy.

6. Online gatherings (Google Meet)

Online gatherings take place on Google Meet. When joining, Google processes the data needed for the video call under its own privacy policy. The link is sent only to registered participants.

7. Analytics

We use Cloudflare Web Analytics, which works without cookies and without identifying individuals (art. 6(1)(f) GDPR). We do not use Google Analytics or advertising pixels, so this site needs no cookie banner.

8. Cookies

This site sets no tracking cookies. Only strictly necessary technical storage may be used (e.g. spam verification), exempt from consent under art. 22.2 LSSI-CE.

9. Images

At some gatherings we take photos or videos to share the experience on our channels. We only publish images of people who have given express consent; you may refuse or withdraw consent at any time by writing to us.

10. Recipients and transfers

We do not share your data with third parties other than the processors and providers named above (Cloudflare, Brevo, Stripe, Google, Cal.com) and where required by law. Transfers outside the EEA rely on adequacy decisions or standard contractual clauses.

11. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).