Privacy policy.
A clear explanation of what personal data we process, why, for how long and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Last updated: 27 September 2026
1. Data controller
- Controller: [COMPANY NAME / FULL NAME] (Circco Media)
- Tax ID (NIF/CIF): [NIF]
- Address: [FULL ADDRESS], Ibiza, Balearic Islands, Spain
- Privacy contact: hola@circcomedia.com
2. What data we process
We only process the data you give us directly or that is generated when you browse the website:
- Contact form: name, email, phone (optional), how you found us, project type, approximate budget (optional) and your message.
- Newsletter: email address.
- Direct communications: data you send us by email, phone, WhatsApp or social media.
- Browsing data: IP address, device and website usage, only if you accept analytics cookies (see our Cookies policy).
We do not process special categories of data. If you are under 14, please do not send us personal data.
3. Purposes and legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Reply to your enquiry and prepare a proposal or quote. | Pre-contractual measures at your request and consent (Art. 6.1.b and 6.1.a GDPR). | While the enquiry is handled and up to 12 months afterwards if no engagement follows. |
| Provide contracted services and manage the business relationship and invoicing. | Performance of a contract and legal obligations (Art. 6.1.b and 6.1.c GDPR). | For the duration of the relationship and statutory periods (tax: 6 years). |
| Send you our newsletter about strategy, design and digital marketing. | Consent (Art. 6.1.a GDPR). | Until you unsubscribe. |
| Protect forms against spam and abuse (reCAPTCHA v3, honeypot field). | Legitimate interest in website security (Art. 6.1.f GDPR). | Only as long as needed for verification. |
| Aggregated web analytics to improve the website. | Consent via the cookie panel (Art. 6.1.a GDPR). | According to Google Analytics settings (max. 14 months). |
No automated decision-making or profiling with legal effects takes place.
4. Recipients and processors
We do not share your data with third parties unless legally required. Some providers access it as processors under a contract compliant with Art. 28 GDPR:
- Web hosting and form server: [HOSTING / VPS PROVIDER] (European Union).
- Transactional email: [EMAIL PROVIDER].
- Google Ireland Ltd. (reCAPTCHA and, if you accept it, Google Analytics). This may involve transfers to the US covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Meta Platforms Ireland Ltd., if you contact us via Instagram or WhatsApp, under its own policies.
5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw your consent, by writing to hola@circcomedia.com stating the right you wish to exercise.
If you believe we have not processed your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).
6. Security
We apply appropriate technical and organisational measures to protect your data: encrypted HTTPS connection, restricted system access, anti-spam form protection and backups.
7. Changes to this policy
We may update this policy to reflect legal or service changes. The current version will always be published on this page with its update date.