Privacy

What data this site handles, why, and for how long.

This policy follows Regulation (EU) 2016/679 (GDPR), Spain’s Organic Law 3/2018 (LOPDGDD) and the Swiss Federal Act on Data Protection (revFADP). The site has no newsletter and no accounts: we handle the email you choose to send us, what you type into the enquiry form, and the technical data the hosting needs to serve the pages.

Data controller

Laura López Real, NIF 12342824N, Calle Piedra del Cormorán 2, bloque A, planta 1, puerta 8, 39520 Comillas, Cantabria, Spain. Privacy contact: studio@airellum.com.

What we process, and why

You write to us by email

Data: Your address, your name if you give it, and the content of the message
Purpose: To reply and, if you ask, to prepare a proposal
Legal basis: Legitimate interest in answering your enquiry; steps prior to a contract if you ask for a quote (art. 6(1)(b) and (f) GDPR)
Retention: For the length of the conversation and up to two years after it, unless it becomes a contract

You are a client

Data: Contact and billing details, project communications
Purpose: To deliver the service, invoice and meet tax obligations
Legal basis: Performance of the contract; legal obligation (art. 6(1)(b) and (c) GDPR)
Retention: For the term of the contract and the statutory periods after it: in general, four years for tax obligations and six for commercial records

You visit the site

Data: IP address and technical connection data, processed by our hosting provider to serve the pages and protect them from attack
Purpose: Security and operation of the site
Legal basis: Legitimate interest (art. 6(1)(f) GDPR)
Retention: The provider’s technical logs, for short periods

You fill in the enquiry form

Data: Your name, your email address, your phone number if you give it, the topic, your message and any details you add
Purpose: To reply and, if you ask, to prepare a proposal
Legal basis: Your consent, given with the form; steps prior to a contract if you ask for a quote (art. 6(1)(a) and (b) GDPR)
Retention: For the length of the conversation and up to two years after it, unless it becomes a contract

We make no automated decisions and build no profiles.

Cookies

This site sets no cookies: none for tracking, advertising or analytics, and none for technical purposes either. Its pages load no third-party scripts, so there is nothing to accept or decline. The one thing kept in your browser is what you type into the enquiry form, held in the tab’s session storage while you send it so that a failed send does not lose it; it is removed on the thanks page and when the tab closes, and it never leaves your browser. Should the hosting provider ever enable a strictly necessary cookie to protect the site from attack, it would need no consent and would be listed here.

Recipients

We do not pass your data to third parties unless the law requires it. To deliver the service we use providers that act as processors under the safeguards of art. 28 GDPR:

Hosting, content delivery and the sending of the enquiry form’s email: Cloudflare, Inc. (USA, with operations in the EU). International transfers rest on the EU–US Data Privacy Framework, its Swiss–US extension for people resident in Switzerland, and standard contractual clauses.
Email: Google Workspace, under the same safeguards.
Code repository and, where applicable, content editing panel: GitHub, Inc. (only for clients with an editing panel; visitors to the site are not affected).

Your rights

You may access your data, correct it, have it erased, object to its processing, restrict it, ask for it to be ported and withdraw your consent at any time by writing to studio@airellum.com. We will answer within one month. If you consider that we have not dealt with your request, you may complain to the Spanish Data Protection Agency (AEPD, aepd.es). If you live in Switzerland, you may also contact the Federal Data Protection and Information Commissioner (FDPIC / EDÖB, edoeb.admin.ch).

Users in Switzerland

This policy also complies with the Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023). The European Union and Switzerland recognise each other as providing an adequate level of protection, so data exchanged between the two needs no further safeguards. The rights described above apply equally to people resident in Switzerland.

Security

We apply technical and organisational measures appropriate to the risk: the site is served over HTTPS only, with security headers; access to the systems is limited to those who need it and protected by a second authentication factor; and we store no more data than necessary.

Minors

This site is not aimed at children under 14, and we do not knowingly process their data.

Changes

Any change to this policy will be published here, with the date of its last update.

Last updated: 19 October 2026