Privacy Policy
Information about how we process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish data protection law (LOPD-GDD).
Last updated: 22 September 2026
1. Data controller
- Controller: Hipnosia
- Address: Madrid, Spain
- Email: info@hipnosia.com
2. What data we process, why and on what legal basis
| Processing | Data | Purpose | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|---|
| Contact form / information request | name, email, phone number, service of interest and message | Reply to your enquiry and, where applicable, manage the relationship you request. | Consent (6.1.a) and steps taken at your request prior to entering into a contract (6.1.b). | For as long as needed to handle the request and, afterwards, during the limitation periods for possible liabilities. |
| Web analytics (Google Analytics 4) | Online identifiers, browsing data, device and approximate location. | Obtain aggregated usage statistics to improve the website. | Consent (6.1.a) given in the cookie banner. | 14 months in Google Analytics (max. 14 months). |
| Site security and operation | IP address and server technical logs. | Provide the service, prevent abuse and ensure security. | Legitimate interest (6.1.f). | Short period, according to the hosting provider. |
The data marked as mandatory in the forms is necessary to handle your request; if you do not provide it, we will not be able to do so. No automated decisions are made and no profiles are built with legal effects on you.
3. Recipients and processors
We do not disclose your data to third parties except where legally required. To provide the service we rely on providers acting as processors under a contract compliant with GDPR art. 28:
- Web hosting: Netlify, Inc. (USA).
- Form handling / email: Make (Celonis), an automation platform that receives the form data and forwards it to our email and management tools.
- Analytics: Google Ireland Ltd. (Google Analytics), only if you accept.
4. International transfers
Some providers (for example Google, Meta or Netlify, Inc. (USA)) may process data in the United States. These transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (10 July 2023) for certified companies and, failing that, on standard contractual clauses approved by the Commission (GDPR art. 46).
5. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw the consent you have given without affecting the lawfulness of prior processing. Write to info@hipnosia.com stating the right you wish to exercise; we may ask you to prove your identity. We will reply within one month (GDPR art. 12).
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country.
6. Cookies
We use necessary first-party cookies and, only with your consent, third-party cookies. See the Cookie policy or change your choice here:
7. Minors
This website is not aimed at children under 14. Children below that age may not give us personal data without the consent of their parents or guardians (art. 7 of Spanish Organic Law 3/2018).
8. Security
We apply appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access, taking into account the state of the art and the risks of the processing (GDPR art. 32).
9. Changes to this policy
We may update this policy to adapt it to legal changes or to the services we use. We will always publish the current version with its update date.