1. Data controller information

The data controller responsible for personal data collected through this Website is:

2. Principles applied to personal data processing

We adhere to the core principles established under Article 5 of the GDPR:

  • Lawfulness, fairness, and transparency: Data is processed under a legitimate legal ground, with transparent information provided to data subjects.
  • Purpose limitation: Data is collected only for specified, explicit, and legitimate commercial and technical purposes.
  • Data minimization: We request only the data strictly necessary to fulfill your request or execute contracted services.
  • Accuracy: We maintain data accuracy based on the details you provide.
  • Storage limitation: Data is retained only as long as necessary for the purpose it was gathered.
  • Integrity and confidentiality: Appropriate technical safeguards protect data against unauthorized access, alteration, or loss.

3. Categories of personal data collected

We collect only the following categories of data:

  • Contact form data: Name, professional email address, Amazon product listing link (URL or ASIN), and project briefs or comments submitted voluntarily.
  • Technical and aggregated analytics data: Anonymized IP addresses, session duration, and page interaction metrics collected via Google Analytics 4 (only upon explicit consent given via the cookie preferences center).

We do not collect sensitive personal data (e.g., health, biometric, or religious data), nor do we engage in automated decision-making or profiling with legal consequences.

4. Purposes of processing

We process personal data for the following specific purposes:

  1. Preparing and delivering the free mini visual audit: Reviewing your Amazon listing to identify top prioritized visual opportunities and sending our written diagnosis.
  2. Quoting and pre-contractual discussions: Answering inquiries regarding package scopes (Visual Essential, Visual Premium, Brand Experience) and providing commercial proposals.
  3. Contract execution: Delivering visual strategy, graphic design, revision rounds, and final Amazon-ready asset packages.
  4. Customer support: Responding to direct inquiries sent via email.
  5. Aggregated analytics: Evaluating Website performance to optimize structure and loading speeds when analytical cookies are consented to.

5. Legal bases for processing

Processing of your data is grounded on:

  • Performance of a contract or pre-contractual measures (GDPR Art. 6.1.b): For audit requests, customized quotes, and design project execution.
  • Explicit consent (GDPR Art. 6.1.a): For voluntary inquiry submissions and analytical cookies. You can withdraw your consent at any time.
  • Legal compliance (GDPR Art. 6.1.c): For tax and commercial documentation retention where applicable.

6. Data retention periods

Personal data is retained only for the periods strictly necessary:

  • Inquiries and audit requests: Kept for a maximum of 12 months after the last communication if no contractual engagement ensues, after which data is securely erased.
  • Contracted clients: Retained for the duration of the commercial relationship and subsequently for statutory periods required under commercial and fiscal laws (typically 4 to 6 years).
  • Analytics cookies: Retained in aggregated, anonymized format for up to 14 months.

7. Data recipients and international transfers

Skuvia Studio never sells, rents, or trades your personal data to third-party commercial brokers or advertisers.

We rely on trusted technical data processors operating under strict data protection guarantees:

  • Hosting and Global CDN: Cloudflare, Inc., adhering to the EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Form transmission gateway: Web3Forms, delivering encrypted TLS form submissions to our official inbox.
  • Analytics: Google LLC (Google Analytics 4), enabled only with explicit user consent, utilizing IP anonymization and certified under the EU-US Data Privacy Framework.

8. Data subject rights under GDPR

Under European privacy laws, you hold the following rights regarding your personal data:

  • Access: Obtain confirmation of whether your data is processed and request copies.
  • Rectification: Request correction of inaccurate or incomplete records.
  • Erasure («Right to be forgotten»): Request deletion when data is no longer necessary.
  • Restriction: Request limitation of processing under statutory conditions.
  • Portability: Receive your data in a structured, commonly used, machine-readable format.
  • Objection: Object to processing based on personal circumstances.
  • Withdrawal of consent: Revoke previously granted cookie or communication consent at any time without retroactive effects.

To exercise any of these rights, email [email protected] with the subject «Data Protection — Exercise of Rights» along with proof of your identity.

You also have the right to lodge a complaint with a supervisory authority, such as the Spanish Data Protection Agency (AEPD) or your local European data protection regulator.

9. Technical security safeguards

We implement robust organizational and technical safeguards, including HTTPS TLS 1.3 encryption, static decoupled server architecture, and least-privilege administrative access protocols.