Filmmaiker Studio
Privacy policy
Informational policy prepared for review by a lawyer before final publication.
Controller
The data controller is Sebastián Adrián Pérez Hermosa, NIF 06301892F, Calle Liszt 11 Entresuelo 3, 08923 Santa Coloma de Gramenet, Barcelona, España, info@filmmaikerstudio.com. Privacy enquiries may be sent to info@filmmaikerstudio.com.
Data categories
We may process professional identity and contact data, project information, the linked website or professional profile, relevant public data, technical and security logs, consent preferences, and limited inferences generated by assisted analysis.
Required and optional data
Email, website or professional profile, service type, and project goal are required to handle the enquiry; without them we cannot respond. Name, phone, budget, target date, and comments are optional unless the interface states otherwise for a particular service.
Public information and Article 14
If you provide a URL, the precise source will be the publicly accessible pages of that website or profile. We may obtain professional identity and role, organisation, sector, services, public content, and professional contact data for the specific legitimate interest of contextualising the enquiry, assessing fit, and avoiding an irrelevant proposal. This information is provided when the URL is collected and, where data does not come directly from you, no later than one month or the first communication unless an Article 14.5 GDPR exception applies. You may object to this analysis.
Purposes, basis, source, and retention
| Processing | Purpose, basis, source, and retention |
|---|---|
| Enquiries and proposals | Reply to requests and prepare a proposal or pre-contractual steps; GDPR Article 6.1.b. Data comes from the person making the enquiry; up to 24 months from the last meaningful interaction if no relationship follows. |
| Linked website or professional profile analysis | Understand the project using the website or public profile supplied; legitimate interests, Article 6.1.f. Public information may trigger the Article 14 GDPR notice and is limited to relevant material. |
| AI-assisted profiling | Organise needs and prepare initial guidance using OpenAI with human review; Articles 6.1.b and 6.1.f. Retained with the enquiry record. |
| Security logs | Prevent abuse, diagnose errors, and protect systems; legitimate interests, Article 6.1.f. Retained only for the necessary technical period. |
| Google Analytics 4 (GA4) | Optional statistical measurement; consent, Article 6.1.a. Activated only after Analytics consent and retained according to the actual property setting. |
| Vimeo player | Display the external showreel; consent, Article 6.1.a. Loaded only after external-media consent and subject to Vimeo retention. |
Assisted analysis and decisions
Profiling uses simple logic: it summarises the brief and supplied professional signals to suggest fit, priority, and next steps. There is always human review. No solely automated decisions with legal or similarly significant effects, or other decisions falling within GDPR Article 22, are made.
Retention
Inactive leads are retained for up to 24 months from the last meaningful interaction. Records needed for a relationship, legal claim, or statutory duty may be kept longer and restricted where required.
Providers and recipients
| Provider | Role and safeguards |
|---|---|
| Hostinger | Infrastructure and hosting as a processor under the applicable contract. |
| Notion | Lead and document management as a processor as applicable, depending on account contract and configuration. |
| OpenAI | API for assisted analysis as a processor as applicable under the relevant contract and controls. |
| Google Workspace and Google Analytics | Email and analytics; processor or independent provider as applicable to the product, contract, and purpose. |
| Vimeo | External player; processor or independent controller as applicable to the relationship and its own purposes. |
Form processing chain
After server-side validation, the enquiry is recorded in Notion first. If PostgreSQL is configured, it is also stored there within Hostinger infrastructure managed through Dokploy. Self-hosted n8n is then invoked asynchronously for OpenAI API enrichment and email through Gmail or Google Workspace. PostgreSQL, n8n, and Dokploy are technical components, not separate recipients.
International transfers
Some providers may process data outside the EEA. Depending on the destination, a transfer must rely on an adequacy decision adopted by the European Commission or on Standard Contractual Clauses (SCC) incorporated into the contract, with supplementary measures where appropriate. The precise mechanism depends on each account’s entity and configuration and must be verified before production publication. You may request information or a copy of the safeguards from the controller.
Security
The code applies server-side input validation and limits, rejects local or private web destinations, uses parameterised SQL, and sets API timeouts. Production must retain HTTPS and the Hostinger access, update, backup, and monitoring policies must be verified before they are described as operational controls. No Internet-connected system can guarantee absolute security.
Children
The services are aimed at professionals and organisations, not children. If we identify a child’s data without valid involvement of their representative, we will delete it or request the appropriate authorisation.
Your rights
You may request access, rectification, erasure, object to processing —including objecting to analysis based on legitimate interests—, restriction, and portability, and withdraw consent without affecting prior processing, by emailing info@filmmaikerstudio.com. You may also complain to the AEPD.
Policy changes
This policy may be updated when purposes, providers, technologies, or laws change. Material changes will be communicated proportionately, and the date above identifies the current version.