Privacy policy
Last updated: 8 October 2026
This policy explains, in plain language, which personal data we process when you visit the website, buy, ask us for a quote or write to us, what we use it for, for how long, and which rights you have. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Who is the controller
- Controller: Diana Laura Martínez Camacho (trading as Nüvo Studio)
- Tax ID (NIF/CIF): Z1741153N
- Address: Carretera de Sabadell 70 Rubí - Barcelona
- E-mail for privacy matters: info@nuvostudiobcn.com
We have not appointed a data protection officer because we are not required to; for any question about your data you can contact us directly.
What data we process, why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Managing your orders: taking payment, preparing, shipping or holding them for pick-up, and handling issues | Name, e-mail, phone, delivery address, products, amounts, personalisation text or files, payment details (amount, date and method; never your card number) | Performance of the sales contract (art. 6.1.b GDPR) |
| Preparing and charging custom quotes (including 3D printing) | Contact details, description of the job, files you attach, messages, deposit and balance paid | Pre-contractual steps and performance of the contract (art. 6.1.b) |
| Payments outside the website (cash, Bizum, bank transfer or card terminal agreed with the studio) | Amount, date, method and reference of the payment, recorded on your order or quote | Performance of the contract (art. 6.1.b) and accounting obligations (art. 6.1.c) |
| Your customer account (saved addresses, order history, favourites) | Name, e-mail, password (stored irreversibly encrypted), addresses | Performance of the service you request (art. 6.1.b) |
| Answering your enquiries through the contact form, e-mail or WhatsApp | Name, e-mail, phone (if you give it) and the content of the message | Legitimate interest in replying to you (art. 6.1.f) and, if the enquiry is about an order or quote, performance of the contract (art. 6.1.b) |
| Invoicing and legal obligations (tax, accounting and consumer law) | Order and payment data, identification and address | Legal obligation (art. 6.1.c) |
| Product reviews, with or without photos | Rating, text, the name you choose to display, photos and the related order | Your consent (art. 6.1.a) |
| Back-in-stock notices and cart reminders | E-mail, language, date of consent and a hash of your IP address | Your consent (art. 6.1.a and art. 21 LSSI-CE) |
| Favourites and shareable list | Saved products and, if you share the list, the list's name | Performance of the service you request (art. 6.1.b) |
| Service e-mails (confirmation, dispatch, tracking, delivery) | E-mail and order data | Performance of the contract (art. 6.1.b) |
| Security and fraud and abuse prevention (sending limits, detecting improper access) | Hash of your IP address and minimal technical logs | Legitimate interest in protecting the website and its users (art. 6.1.f) |
| Handling your rights requests | E-mail and the content of the request | Legal obligation (art. 6.1.c) |
The data marked as required on our forms is necessary to provide the service: without it we cannot process the order or quote. We do not take automated decisions or build profiles about you that produce legal effects or significantly affect you.
Who else receives your data
To provide the service we rely on providers that process data on our behalf, with whom we have or accept the data processing terms required by the GDPR:
- Stripe (payment by card, Apple Pay and Google Pay): receives your name, e-mail, amount and the payment details you enter on its page. We never see your card number. Stripe also acts as controller for its own obligations (fraud prevention and financial regulation).
- Packlink and the carrier you choose: name, address and phone (and, where applicable, the drop-off point) to deliver your order.
- Resend, the service we use to send e-mails (confirmations, notices, replies): receives your e-mail address and the content of the message.
- The hosting provider where the website and its database run, and backup services.
- Your bank or the service you use (Bizum, bank transfer), if you pay that way; and WhatsApp (Meta), if you write to us there, under its own terms.
- Public authorities, judges and courts where the law requires it, and our tax or accounting adviser, if any, bound by confidentiality.
International transfers. Some of these providers (for example Stripe or Resend) may process data outside the European Economic Area, in particular in the United States. They do so with appropriate safeguards: the adequacy decision of the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission. We do not sell your data or use it for third-party advertising.
How long we keep your data
- Paid orders and quotes: until 31 December of the sixth year after payment (tax and commercial obligation); then anonymised. If you ask us to delete your data, we keep only the minimum required (name and delivery address) until that period ends.
- Orders that are never paid: anonymised after 90 days. Unpaid quotes: after 24 months.
- Your account, addresses, favourites and reviews: as long as you keep the account; you delete them yourself whenever you like, or ask us to. The favourites list of someone without an account is deleted after 180 days without activity.
- Contact messages: we keep them as long as needed to deal with your enquiry and delete them at your request.
- Stock notices and cart reminders: the periods given in their sections below.
- Copies of your data that you download: the link lasts 48 hours (and, if you ask without an account, works only once); then we delete the file. The link to confirm your identity in a request without an account expires after 24 hours, and unconfirmed requests are deleted after 48 hours.
- Log of rights requests: 3 years, with no personal data, as proof that we handled them; your e-mail is removed from the request 7 days after we reply.
- Proof of consent (acceptance of the terms, review photos, notices): 6 years from when you gave it, so that we can defend ourselves against possible claims; we only store hashes of your IP and e-mail, not the plain data.
Once the periods end, data is deleted or anonymised so that it no longer identifies you. During the legal retention periods the data is blocked and used only to deal with possible liabilities.
Your rights and how to exercise them
You can access your data, have it corrected, ask us to delete it, restrict or object to its processing and receive it in a reusable format (portability), and withdraw at any time any consent you gave, without affecting what has already been done.
- If you have an account: under "My account > My data" you can download a copy of your data and delete your account yourself, with no intermediaries.
- If you do not have an account: use the rights form. We will e-mail you to check that the address is yours; until you confirm it we do not act.
- You can also write to us at info@nuvostudiobcn.com.
We reply within a maximum of one month of receiving your request (extendable in complex cases, and we will tell you). Some data cannot be deleted while the law requires us to keep it (for example, a paid order, for tax reasons), and payments already made remain recorded at Stripe and your bank under their own obligations. If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Cart reminders
If, at checkout, you tick "Remind me about my cart by e-mail if I do not finish my purchase" (or switch that preference on in your account), we store your e-mail address, language, the date of your consent and a pseudonymised fingerprint (hash) of your IP address, against your cart. Before writing to you we send a single e-mail asking you to confirm the address is yours (not needed if you are signed in with your verified account and it is that same address). Then we send up to three e-mails reminding you (roughly after one hour, one day and three days), with a link to restore your cart; the last one may include a personal, single-use discount coupon tied to your e-mail. The legal basis is your consent (art. 6.1.a GDPR and art. 21 LSSI-CE), which you can withdraw at any time with the "Unsubscribe" link in each e-mail or from your account. We keep this data for 90 days at most and then delete your e-mail address and the IP fingerprint; the unsubscribe list only keeps a pseudonymised fingerprint (hash) of your address so we never write to you again. We do not share this data with third parties, except the provider that sends e-mails on our behalf.
Back-in-stock notices
If you ask us to let you know when a sold-out product is back, we store your e-mail address, language, the date of your request and a pseudonymised fingerprint (hash) of your IP address. Unless you are signed in with your verified account and it is that same address, we send you a single e-mail asking you to confirm it is yours. We write to you once, when it is back in stock. The legal basis is your consent (art. 6.1.a GDPR and art. 21 LSSI-CE), which you can withdraw with the "No more notices" link in the e-mail. We delete the notice 30 days after it is sent or cancelled, after 7 days if nobody confirms it, and after 12 months at most if the product never returns; the unsubscribe list only keeps a pseudonymised fingerprint (hash) of your address.
Favourites
If you save products to your favourites without signing in, the list is tied to a random identifier of your browser (the cart cookie), with no personal data; we delete it after 180 days without activity. If you have an account, the list is kept with it until you delete it. If you switch on "Share my list", a link is created that only the people you choose know: it shows the list's name and the products, never your name or e-mail, it is not indexed by search engines, and you can change or switch it off whenever you like.
Product reviews
Only people who bought the product can review it. If you leave a review, we store the rating, the text, the name you choose to display, the order it belongs to, a pseudonymised fingerprint (hash) of your e-mail (to allow one review per product and let you edit or delete it) and a fingerprint of your IP. Photos you upload are shrunk and saved again without their hidden data (such as location) and are not visible until we approve the review. We publish the review under the name you choose until you ask us to delete it; you can edit or delete it yourself during the days the page states. A few days after your order is delivered we may send you a single e-mail asking for your opinion, with an unsubscribe link; it is a message about an order you already placed (art. 21.2 LSSI-CE). We may reply to your review in public.
Minors
To buy you must be of legal age. If you are 14 or over you can browse the website and write to us; if you are younger, you need the consent of your parent or guardian to give us your data. If we find that we have collected data from a minor without that consent, we will delete it.
Security
We apply appropriate technical and organisational measures: encrypted connection (HTTPS), irreversibly stored passwords, role-based access to data, signed and expiring links in e-mails, hashes instead of plain IP addresses and e-mails where that is enough, and automatic deletion of what we no longer need. Your card details are handled only by Stripe and your bank. If a security breach affected you with a risk to your rights, we would tell you and notify the authority, as the law requires.
Changes to this policy
If we change the way we process your data, we will update this page and its date, and notify you prominently if the change is significant. You can always check the current version here. We also recommend reading the cookie policy and the terms of sale.
Any questions? Write to us · FAQ