← Back to IVONDA

Privacy Policy

This privacy policy explains how IVONDA ("we", "us", "our") collects, uses and protects personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and the Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).

1. Data Controller

2. What Data We Collect

Data you provide

• Contact information you send to us (name, email, phone, company) when you contact us via the website, email or social media.
• Project information you share during briefings, proposals or contractual relationships.

Data collected automatically

• Technical data: IP address, browser type, device type, operating system, referring URL, pages visited and session duration.
• This is processed by our hosting provider (Vercel Inc.) in order to deliver the website and protect it from abuse.

3. Legal Basis & Purpose

Purpose	Legal basis (GDPR)
Responding to enquiries	Art. 6(1)(b) — pre-contractual / contractual
Providing creative services	Art. 6(1)(b) — contract performance
Tax & accounting records	Art. 6(1)(c) — legal obligation
Website security & functioning	Art. 6(1)(f) — legitimate interest
Marketing emails (if opted in)	Art. 6(1)(a) — consent

4. Cookies & Tracking

This website uses only strictly necessary cookies required for the site to function (for example, storing your selected theme preference in localStorage). We do not use advertising, profiling or cross-site tracking cookies.

If we introduce analytics or marketing cookies in the future, we will request your prior consent via a cookie banner, in line with Article 22 of LSSI-CE and the ePrivacy Directive.

5. Data Sharing

We do not sell your personal data. We only share data with the following categories of processors, who act strictly on our instructions:

• Vercel Inc. (USA/EU) — hosting of this website. Data is transferred under EU Standard Contractual Clauses.
• Google LLC — font delivery via Google Fonts. No personal profile is built from font requests.
• Professional advisors (accountants, lawyers) when legally required.

6. International Transfers

Some of our service providers may process data outside the European Economic Area. In such cases, we rely on adequacy decisions of the European Commission or on the EU Standard Contractual Clauses to guarantee an equivalent level of protection.

7. Retention

• Contact enquiries: up to 24 months after the last interaction.
• Contract & billing data: 6 years (Spanish Commercial Code, Art. 30).
• Server logs: up to 30 days for security purposes.

8. Your Rights

Under the GDPR, you have the right to:

• Access your personal data.
• Request correction or deletion.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with the Spanish Data Protection Agency (AEPD).

To exercise any of these rights, please email hello@ivonda.com. We will respond within one month.

9. Security

We apply appropriate technical and organisational measures to protect personal data, including HTTPS encryption, strict access controls, strong Content-Security-Policy headers and regular security reviews.

10. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date above will reflect the most recent version. Material changes will be highlighted on the website.