Legal
Privacy policy
What data we process, on what legal basis, how long we keep it and what you can require of us.
1 · Data controller
- Controller
- URBAN STUDIO BCN, SOCIEDAD LIMITADA
- NIF
- B75530642
- Address
- Carrer Boters, 2 — Esc. 1, Planta 4, Porta 2 · 08720 Vilafranca del Penedès (Barcelona)
- Data protection contact
- info@urbanstudiobcn.com
- Data protection officer
- Not required given the volume and nature of the processing
2 · Purposes and legal bases
We process personal data only for the purposes listed below, and each one has its own legal basis. No purpose depends on another: you can request a quote without accepting marketing communications.
| Purpose | Legal basis | Consequence of not providing the data |
|---|---|---|
| Handling your request and preparing the quote | Art. 6.1.b GDPR (RGPD) · pre-contractual measures at the request of the data subject | We cannot reply or provide a quote |
| Professional contact with company contact persons | Art. 6.1.f RGPD with the presumption of legitimate interest under Art. 19 LOPDGDD | Not applicable: these are professional activity data |
| Commercial communications by email | Art. 6.1.a RGPD · consent given in a separate, unticked box | None: it is optional and can be withdrawn |
| Contract management, invoicing and warranty | Art. 6.1.b and 6.1.c RGPD · performance of the contract and legal obligations | We cannot enter into the contract |
| Coordination of business activities and health and safety on site | Art. 6.1.c RGPD · legal obligation arising from occupational health and safety regulations | We cannot access the site |
| Job applications | Art. 6.1.a and 6.1.b RGPD · consent and recruitment process | We cannot assess the application |
| Website security and technical server logs | Art. 6.1.f RGPD · legitimate interest in protecting the site against misuse | Not applicable: the server records them when you visit the website |
We do not carry out automated decision-making or profiling with legal effects on individuals.
3 · Data we process
In the contact forms, your full name, your email address and one line about the project are mandatory. Everything else is optional. When you send it, the website’s server forwards the enquiry and any files you attach to our mailbox as an email, without keeping a copy on the server. If direct sending is unavailable at that moment, the form prepares an email with your enquiry, which you send from your own email program.
- Identification and professional contact data: first name, surname, email, telephone, company and job title.
- Project data: type, city, floor area, target opening date and any files you choose to attach.
- Billing and contractual data, where there is a business relationship.
- Technical connection data recorded by the server when you visit the website: IP address, date and time, and the page requested. This site does not use cookies (see the cookie policy).
About the files you attach
The plans, elevations and store manuals you send us may contain confidential information about your brand. We process them solely to prepare the quote, they are not shared with third parties outside the project, and they are kept with access limited to the team working on it. If the project is not awarded, they are deleted within the period stated below.
4 · Retention periods
| Data | Period |
|---|---|
| Requests not awarded and attachments | 12 months from closure |
| Contract and site documentation | For the duration of the relationship and the warranty period, and thereafter for as long as legally required |
| Invoicing and accounting | 6 years · Art. 30 of the Spanish Commercial Code (Código de Comercio); 4 years for tax purposes |
| Marketing consent | Until you withdraw it |
| Job applications | 12 months |
| Technical server logs | Up to 12 months |
Once the period has expired, the data are erased or blocked, remaining available exclusively to the competent authorities for the limitation period of any actions that may arise.
5 · Recipients and processors
We do not sell or disclose personal data. We access it through providers acting as processors, under a contract in accordance with Article 28 of the RGPD.
| Service | Provider | Location |
|---|---|---|
| Website hosting | OVHcloud | France (EU) |
| Corporate email | Arsys | Spain |
| Administrative and tax advisers | External adviser | Spain |
We also disclose data to public authorities and financial institutions where there is a legal obligation to do so, and to the coordination of business activities platform designated by the client or the main contractor on each project.
If you choose ‘Open in Gmail’ in the form, the text of your enquiry is passed to Google in the link address so that the message can be prepared in your account, and you send it from there. Google processes it under its own privacy policy.
6 · International transfers
Our providers process data within the European Economic Area, so there are no international transfers. Should a provider ever be located outside it, the transfer would be covered by an adequacy decision of the European Commission or by standard contractual clauses with the appropriate supplementary measures, and we would state it in the previous section.
7 · Your rights
You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw your consent at any time, by writing to info@urbanstudiobcn.com with the reference ‘Data protection’.
We will respond within one month of receipt, which may be extended by a further two months if the request is complex, and we will inform you of this. Exercising these rights is free of charge.
If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, aepd.es.
8 · Security
We apply technical and organisational measures appropriate to the risk: encryption in transit using TLS, access control by person and by project, backups, and access to client files restricted to the team working on each project.
9 · Changes to this policy
We may update this policy when the processing, the providers or the regulations change. The version in force is the one published on this page, with its date of update.
Last updated: 21 October 2026