1. Who is responsible for your data?

The data controller is the business trading as Atelier Frame, based in Marbella, Málaga, Spain.

Trading name: Atelier Frame
Business location: Marbella, Málaga, Spain
Email: hello@atelierframe.eu
Telephone / WhatsApp: +34 663 911 116 · +34 632 157 355

Use the email above for privacy questions or to exercise your rights.

2. Information we collect

Depending on how you use the site, we may receive:

your name, email address, telephone number and preferred contact method;
details of your property, location, project scope, products, timing, notes and configuration choices;
photographs you choose to attach to a quotation request, plus their file name, type and size;
messages and information you send by email, telephone or WhatsApp;
limited technical information needed for security and delivery, such as IP address, request time, browser/device information and server logs; and
your cookie and tracking preferences stored in your browser.

Please do not send sensitive personal data or photographs that reveal more than is needed for your enquiry.

3. Why we use it and our legal basis

To answer enquiries and prepare quotations: to take steps at your request before entering or entering into a contract (Article 6(1)(b) GDPR) and, where the form asks for it, your consent (Article 6(1)(a)).
To communicate by your selected channel: to respond to your request and manage the resulting business relationship. WhatsApp is used only when you choose or initiate that channel.
To deliver services and keep business records: performance of a contract and compliance with accounting, tax and other legal duties (Articles 6(1)(b) and 6(1)(c)).
To protect the website and prevent abuse: our legitimate interests in security, fraud prevention and reliable operation (Article 6(1)(f)). The quote endpoint uses an IP address temporarily for rate limiting.
Optional analytics or advertising measurement: only with your prior consent (Article 6(1)(a)). The live site audit found no active analytics or advertising identifier. See the Cookie Policy.

We do not use website enquiry data for automated decisions that have legal or similarly significant effects. We do not sell personal data.

4. How long we keep information

We keep information only for as long as needed for the purpose described and to meet legal obligations. Successful customer and transaction records may be retained for the periods required by Spanish tax, accounting and claims law. Security rate-limit data held by the application expires after approximately one hour and is not stored with the enquiry.

Enquiries that do not become customer projects are periodically reviewed and deleted when they are no longer reasonably needed for follow-up, record keeping or the establishment, exercise or defence of legal claims.

Cookie choices stay in browser storage until you clear them or the consent version changes. Processor backups and logs may persist briefly under the relevant provider's retention cycle.

5. Who may receive information

Access is limited to Atelier Frame personnel and service providers that need the information to operate the website or handle your request. The codebase currently uses:

Vercel for website hosting and site asset storage;
the configured PostgreSQL hosting provider for the protected enquiry database (the production provider is not identified in the repository);
Resend to deliver enquiry notification emails; optional photos are sent as attachments and their metadata is recorded with the enquiry; and
WhatsApp / Meta when you choose to contact us through WhatsApp. In that case, Meta processes information under its own terms and privacy notice.

Professional advisers or authorities may receive data where necessary to meet a legal duty or establish, exercise or defend legal claims.

6. International transfers

Some technology or communication providers may process data outside the European Economic Area. Where this happens, processing is subject to a lawful transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with any additional safeguards required.

7. Your rights

Subject to the conditions in the GDPR, you may ask Atelier Frame to:

give you access to your personal data;
correct inaccurate or incomplete data;
delete data that is no longer needed;
restrict how data is used;
provide portable data where the right applies;
object to processing based on legitimate interests; and
stop direct marketing at any time.

You may withdraw consent at any time without affecting processing that was lawful before withdrawal. For cookies, use Cookie Settings in the footer. For other requests, email hello@atelierframe.eu. We may ask for proportionate information to verify your identity.

You may complain to the Spanish Data Protection Agency (AEPD). The AEPD generally recommends contacting the controller first where the complaint concerns exercise of a right.

8. Security

We use proportionate technical and organisational safeguards, including access-controlled administration, validation, rate limiting and encrypted HTTPS transport. No internet service is completely risk-free, so we cannot promise absolute security.

9. Children

This commercial website is not directed at children and we do not knowingly request information from minors. A parent or guardian who believes a child has provided information should contact us so we can review and, where appropriate, delete it.

10. External links and services

The site links to third-party services and manufacturer websites. Their privacy practices are controlled by those providers. Review their notices before providing information. Telephone, email and WhatsApp links open the relevant service on your device.

11. Changes to this policy

We may update this policy when the website, providers or law changes. The revised date will appear at the top. Material changes that require new consent will be presented through the consent interface.