Last updated: 24 August 2026

Versión original en español

Privacy policy

This policy explains how data is processed through HEYDE Studio’s current forms, services and infrastructure. Submitting an inquiry does not create marketing consent.

Controller and identification

The controller and service provider is Oliver Heyde Arias, Spanish tax ID 03958826C, with legal and tax address at Calle Tempranillo 9, Toledo. He is a self-employed individual established in Spain operating under the HEYDE Studio brand, and services are directly contracted with and provided by him. Legal and privacy contact: contact@heydestudio.com.

Local audit and project inquiry

/audit collects business, area, website or Instagram, contact name, email and optional phone details to register, prepare and deliver an audit (lead_type=local_audit). /contact collects name, company, email, optional online presence, project type and brief to review and answer a brand inquiry (lead_type=brand_inquiry). Each flow stores an identifier, timestamps and confirmation states. Neither creates a Deal automatically.

Purposes and legal bases

  • Audits and inquiries: pre-contractual steps requested by the data subject, where applicable.
  • Client services: performance of a contract.
  • Invoices, accounts and tax records: compliance with legal obligations.
  • Minimal technical logs, rate limiting, abuse prevention and security: legitimate interest limited to protecting the website, forms and their users, applied where necessary and proportionate.
  • Google Analytics 4: consent, which can be rejected or withdrawn at any time.

What the privacy checkbox means

The required checkbox on /audit and /contact confirms that you have read this information and request that the inquiry be handled. It is not blanket consent for every processing activity, does not subscribe you to a newsletter and does not replace the legal bases stated for contracts, legal obligations, security or analytics.

Marketing

Audit and project submissions are not automatically added to a marketing list. Promotional consent is not inferred from either form. Marketing to non-clients introduced in the future would require an appropriate basis and, where required, separate explicit consent.

Retention

  • Leads and inquiries that do not become clients: no more than 12 months after the last meaningful interaction, then deletion or anonymisation unless another documented legal ground applies.
  • Operational client data: for the relationship and only as long afterwards as reasonably necessary to close the service or address liabilities.
  • Contracts, invoices and accounting or business documentation: 6 years where necessary or appropriate for Spanish commercial, tax or claims obligations.
  • Data kept solely for legal duties or claims after its active purpose ends is blocked or restricted and is not reused for commercial purposes.

Providers and international transfers

Only providers required by the current system are listed. The applicable account and contractual settings must be checked before Production:

  • Vercel: hosting and infrastructure. Its DPA describes Vercel as processor for customer data, primary processing in the United States and safeguards such as Standard Contractual Clauses where applicable. Coverage under the contracted plan must be verified.
  • HubSpot: CRM and system of record. Its DPA provides processor terms for customer data and SCCs for restricted transfers. The actual hosting region of the HEYDE account has not been publicly verified.
  • Brevo: transactional email. It publishes a DPA within its terms and documents database storage in the EU (France, Germany and Belgium). Access by subprocessors from third countries must be checked against the current agreement.
  • Google Analytics 4: analytics only after consent. Google publishes processor terms for Analytics; some data-sharing settings may introduce additional roles. Google documents adequacy frameworks and SCCs for international transfers where applicable.

Analytics and external channels

First-party /audit and /contact events contain only event name, category, route and language, never form values or PII. WhatsApp is an external channel opened only when you choose its link; HEYDE Studio does not send form data to WhatsApp.

Your rights and complaints

You may request access, rectification, erasure, restriction, objection and portability, and withdraw analytics consent without affecting prior processing, by emailing contact@heydestudio.com. Identity may be verified proportionately where needed. You may also complain to the Spanish Data Protection Agency (AEPD).