Who is responsible
The controller of your personal data is the titular behind the DABA STUDIO trade name — a self-employed professional (autónomo) in Spain. DABA STUDIO is not a separate legal entity.
- Controller
- Danny Andreas Johannes Badenbroek
- Trade name
- DABA STUDIO
- NIF / NIE
- Y4592401M
- Address
- Calle Rei Jaume I 26D, 03520 Polop (Alicante), Spain
- Telephone
- +34 669 903 894
This policy follows the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (“LOPDGDD”). For any privacy question or request, write to support@dabastudio.eu.
What data we process, and when
Project enquiries. When you send a project through the intake on this website, or write or call us about one, we process: your name; your business name; your email address; optionally your phone number and preferred way of contact; and the project information you choose to give us — what you want to build, your goals, desired features, languages, a budget range and timing if you wish to share them, and the address of your current website.
What is sent when you press “Send project”. Your answers are transmitted over an encrypted connection (HTTPS) to a small server function of this website. It also receives the language of the form, a random identifier of the attempt (so that a repeated click does not create a second request), the date and time, and a record that you ticked the privacy box together with the version of the wording you agreed to. The server then emails your request to us and sends a confirmation email to the address you gave. We do not keep your enquiry in a database of our own: it exists as an email in our mailbox and, for delivery, with the email service named below.
Files. The intake lets you select files as references. They are not uploaded or sent: only the file name, size and type are included with your request, so that we know what you have. If we need the files themselves, we will ask you for them separately. If file upload is introduced later, this policy will be updated before it goes live.
Technical and anti-abuse data. When you visit the website, the hosting provider that delivers the pages (Vercel) necessarily processes technical connection data, such as your IP address, the date and time of the request and your browser type, in server logs, in order to deliver and protect the service. To protect the form against spam and abuse, the server turns your IP address and the email address you entered into one-way keyed hashes and uses them as counters, so that it can limit how often the form can be used; these hashes are kept for at most 24 hours, and the form function does not log or store the IP address itself. The form also contains a hidden field that people never see: if it is filled in, the request is discarded as automated.
What we do not do. This website does not use analytics, advertising or social-media trackers, does not set cookies, and does not load third-party embeds. See Cookies and storage.
Why we use your data, and on what legal basis
- To answer your project enquiry and talk to you about it — including preparing a proposal or quote at your request. Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
- To confirm by email that your request has arrived, sent to the address you gave. Legal basis: taking steps at your request (Article 6(1)(b) GDPR).
- To carry out a project and manage the client relationship, if we end up working together. Legal basis: performance of the contract (Article 6(1)(b) GDPR).
- To meet legal obligations, for example tax and accounting duties that apply to an independent professional in Spain. Legal basis: Article 6(1)(c) GDPR.
- To keep the website and the form secure, to protect them from spam and abuse, and to establish, exercise or defend legal claims. Legal basis: our legitimate interest (Article 6(1)(f) GDPR), balanced against your rights and expectations.
The tick box in the project intake confirms that you have read this policy and understand how we will use the information you provide to answer your enquiry. It is not the main legal basis for that processing — that is the pre-contractual step you ask us to take — and it is separate from any marketing. We do not send newsletters or marketing messages as part of the intake. Where we ever rely on your consent for something, we will ask for it separately, and you can withdraw it at any time without affecting what happened before.
Providing the information marked as required in the intake is necessary for us to reply to you; without it, we cannot process your enquiry. Everything else is optional.
Who receives your data
We do not sell your data and we do not use it for third-party advertising. Your data is received by the following parties, who act on our instructions, and — where the law requires it — by public authorities:
- Our support mailbox (support@dabastudio.eu), where your request arrives as an email that is read by the titular.
- Resend (resend.com), the email delivery service that sends us your request and sends you the confirmation. It acts as our processor.
- Vercel (vercel.com), which hosts this website and runs the small server function that receives the form.
- Upstash (upstash.com), a managed Redis database service used only for the anti-abuse counters described above (hashed values, nothing from the content of your request).
No analytics provider, advertising network or social network receives personal data from this website.
International transfers
Some of these providers may process data outside the European Economic Area. Where that is the case, a valid transfer mechanism under Chapter V of the GDPR has to apply. We will describe the specific arrangements for each provider here once they have been confirmed for the production set-up; if you would like to know the current position before then, write to support@dabastudio.eu.
How long we keep your data
We keep personal data only as long as it is needed for the purpose it was collected for, and afterwards only as far as the law requires or permits. In practice:
- Enquiries that do not lead to a project are kept in our mailbox for as long as it takes to reply and follow up, and for a reasonable period afterwards in case you come back to us; then they are deleted or anonymised.
- Client data is kept for the duration of the relationship and afterwards for the periods set by tax, accounting and limitation rules.
- Delivery records of the email service are kept by that service according to its own retention practice.
- Anti-abuse counters (hashed values, no content) expire automatically after at most 24 hours.
- Logs. The form function records only the reference number, the outcome, the language and the time of a request — never your name, email address, phone number or what you wrote. These records, and the technical connection logs mentioned above, are kept by Vercel according to its own retention practice.
- The local draft of the intake stays in your own browser for up to 30 days, or until you remove it or send the form (see Cookies and storage).
Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data erased (“right to be forgotten”) where the law gives you that right;
- ask us to restrict the processing of your data;
- object to processing that is based on our legitimate interest;
- receive your data in a structured, commonly used format where the right to data portability applies;
- withdraw your consent at any time, where processing is based on consent.
To exercise any of these rights, write to support@dabastudio.eu. We may ask you to confirm your identity first. We will answer within one month, as the GDPR requires; in complex cases this can be extended, and we will tell you.
You also have the right to lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD); you may also contact the data-protection authority of the EU country where you live or work. We would appreciate the chance to put things right first, so please feel free to contact us.
Security
We apply technical and organisational measures that are appropriate to the data involved:
- the website and the form are served over an encrypted connection (HTTPS);
- the server checks every request itself — where it comes from, its size, format and content — and does not rely on the checks made in your browser;
- the form accepts requests only from this website, and only a limited number of times per connection and per email address;
- a hidden field and these limits protect it against automated abuse;
- the credentials of the email service exist only on the server, never in your browser;
- the server log contains no personal data from your request.
No system is perfectly secure, so please do not send us sensitive information that the project does not need.
Cookies and browser storage
This website does not set cookies. The project intake saves a draft in your browser’s local storage so that you do not lose your answers if you reload the page or switch language. That draft never leaves your device and is explained in detail in Cookies and storage.
Changes to this policy
We will update this policy when our processing changes — in particular before project enquiries are received through the website, or before any new service provider is used. The version in force is the one published here, with the date shown at the top.