Legal information / 02
Privacy Policy
This policy explains what data may be processed when you visit the website or contact ALUNA, why it is used and how to exercise your rights.
Last updated: 2 September 20261. Data controller
Controller: Borja Mayor Palonés, trading as ALUNA. Privacy and rights contact: contacto@madebyaluna.com. No data protection officer has been appointed because one is not currently required for the activity described.
2. Data processed
- Information voluntarily included in an email, such as your name, email address, company if supplied and the contents of the enquiry.
- The two brief answers included in the draft email, only if you ultimately choose to send it.
- Technical data that hosting may generate, such as IP address, device, browser, date, security logs and strictly necessary usage data.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to enquiries and preparing a proposal | Steps taken at the individual’s request before entering into a contract (Article 6(1)(b) GDPR). |
| Keeping the context of a conversation | Pre-contractual steps and a limited legitimate interest in handling the request correctly. |
| Website operation and security | Legitimate interest in preventing abuse and providing a secure service (Article 6(1)(f) GDPR). |
| Handling rights or legal requests | Compliance with legal obligations (Article 6(1)(c) GDPR). |
4. How contact works
The brief is processed in your browser and sends nothing by itself. It opens your email program with a draft; data only leaves the website if you send that email.
Contact details are not used for advertising or added to a newsletter. Separate consent would be requested if that purpose changed.
5. Retention
- Enquiries that do not become a contract: up to 12 months after the last communication, unless needed for a complaint.
- Formalised projects: for the duration of the relationship and afterwards for the statutory periods needed to address liabilities.
- Hosting logs: for the period strictly necessary for security, operation and compliance with the provider’s terms.
6. Providers and recipients
OpenAI Ireland Ltd. provides ChatGPT Sites hosting and processes hosted data on the owner’s behalf under the applicable data processing agreement. It may use sub-processors for hosting, infrastructure, security, moderation and support.
Google Ireland Limited provides the email service used to receive and answer enquiries. Messages are also subject to that provider’s terms and security measures.
Data is not sold or disclosed for third-party advertising. It may be provided to authorities where legally required.
7. International transfers
Sites does not guarantee exclusive EEA data residency. OpenAI states that transfers outside the EEA rely on adequacy decisions or standard contractual clauses. Google operates servers worldwide and states that it uses adequacy decisions, the EU–US Data Privacy Framework and standard contractual clauses where applicable.
8. Your rights
You may request access, correction, deletion, restriction, objection or portability by emailing contacto@madebyaluna.com and identifying the right you wish to exercise. Additional information will only be requested to verify identity where necessary.
9. Children and sensitive data
The website is not directed at children and does not intentionally request special-category data. Do not send medical, biometric, financial or other particularly sensitive information through the contact email.
10. Automated decisions
ALUNA does not perform profiling or automated decision-making with legal or similarly significant effects on visitors or contacts.
11. Changes to this policy
This policy will be updated if the purposes, providers or website functions change. The update date identifies the version in force.