Privacy Policy

Last updated: 20 July 2026

This Privacy Policy explains how Casa Barro Studio ("we", "us", "our") collects, uses, and protects personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD), and guidelines issued by the Spanish Data Protection Agency (AEPD).

1. Data controller

Identity: Elena Vargas — Casa Barro Studio
Address: Calle Compás 14, 29008 Málaga, Spain
Email: [email protected]
Phone: +34 952 218 447
Website: goldenframehouse.pics

For data protection enquiries or to exercise your rights, contact us using the details above. We will respond within one month, extendable by two further months where requests are complex.

2. Personal data we collect

Depending on your interaction with us, we may process:

• Identity and contact data: name, email address, phone number, postal address.
• Order and transaction data: products purchased, payment references, delivery details, invoices.
• Communication data: messages sent via contact forms, email, phone, or in person at the studio.
• Technical data: IP address, browser type, device information, pages visited, cookie identifiers (see our Cookie Policy).
• Visit data: group booking details, workshop attendance records where applicable.

We do not knowingly collect data from children under 14 without parental consent. If you believe we have received such data, please contact us immediately.

3. Purposes and legal bases

We process personal data for the following purposes and on these legal bases under Article 6 GDPR:

• Order fulfilment and customer service — performance of a contract (Art. 6(1)(b)).
• Studio visits and workshop administration — performance of a contract or pre-contractual steps (Art. 6(1)(b)).
• Legal and tax obligations — compliance with Spanish commercial and tax law (Art. 6(1)(c)).
• Website security and essential functionality — legitimate interest in operating a secure site (Art. 6(1)(f)).
• Analytics and marketing communications — your consent (Art. 6(1)(a)), which you may withdraw at any time.

4. Data retention

We retain personal data only as long as necessary for the purposes described:

• Customer and order records: up to 6 years from the last transaction (Spanish accounting obligations).
• Contact form enquiries: up to 2 years unless an order follows.
• Marketing consent records: until you withdraw consent, plus 3 years for proof of consent.
• Technical logs: up to 12 months.

5. Recipients and international transfers

We may share data with:

• Payment processors and banks for transaction handling.
• Courier and postal services for deliveries within Spain and the EU.
• IT and hosting providers bound by data processing agreements.
• Professional advisers (accountants, lawyers) where required.
• Public authorities when legally obliged.

Where processors are located outside the European Economic Area, we ensure appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

6. Your rights

Under GDPR and LOPDGDD, you have the right to:

• Access your personal data and obtain a copy.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") where legally applicable.
• Restriction of processing in certain circumstances.
• Data portability for data processed by automated means on the basis of consent or contract.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time without affecting prior lawful processing.

To exercise these rights, email [email protected]. You also have the right to lodge a complaint with the AEPD (www.aepd.es).

7. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission over the internet is completely secure; we encourage you to use strong passwords and protect your own devices.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. Material changes will be communicated where appropriate.