Privacy policy

1. Data controller

The controller of the personal data processed through this website is Andreu Cabot SL. For any privacy question you can write to info@andreucabot.com.

Controller

Andreu Cabot SL

Email

info@andreucabot.com

Phone

+34 650 876 727

2. What data we process

You give us the data when you use the contact form, except for the technical data of your visit:

• Form: name, company, email, phone (optional), project type, approximate number of images and desired delivery date (optional), your message and the brief checkboxes you tick.
• Attached files: the plans, images or documents you choose to attach (up to 5 files of 100 MB). They may contain personal or confidential data, so attach only what is necessary.
• Technical data of your visit: our hosting provider automatically records data such as the IP address, the date and time or the browser, which are needed to serve the page and keep it secure.
• Antispam: when you submit the form, we check how long it took you to fill it in and how many submissions have been made from your IP address. This check is done in the server's temporary memory and is not stored permanently.

The fields marked as required are necessary to be able to answer you; without them we cannot process your request. We do not use analytics or advertising cookies, or tracking tools (see the cookie policy).

3. What we use it for and the legal basis

• Answering your request for information or a proposal and keeping in touch with you. Legal basis: taking pre-contractual steps at your request (Article 6(1)(b) GDPR).
• Managing the commission, if we reach an agreement, and complying with tax and accounting obligations. Legal basis: performance of the contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
• Keeping the site secure and preventing abuse and spam. Legal basis: the controller's legitimate interest in the security of the site (Article 6(1)(f)).

We do not make automated decisions or build profiles, and we do not use your data to send you advertising or newsletters.

4. Who else has access to the data

We do not sell or disclose your data. To provide the service we use providers that process it on our behalf, as data processors:

• Vercel Inc. (USA): hosting of the website, running of the form and temporary storage of attached files in a private space.
• Resend (Resend, Inc., USA): sending the email with your request to our inbox.
• Google Workspace (Google): the email service in which we receive and manage your messages.

In addition, the typefaces and, in the 360 virtual tours, a viewer library are loaded from third-party servers (Google Fonts and cdnjs, by Cloudflare). When this happens, your browser sends them your IP address. We explain this in the cookie policy.

5. International transfers

These providers may process data outside the European Economic Area, in particular in the USA. According to the documentation each one publishes (consulted in November 2026):

• Vercel states that its main processing facilities are in the USA, that it is certified under the EU-U.S. Data Privacy Framework, and that its data processing addendum incorporates the European Commission's standard contractual clauses (Decision 2021/914).
• Resend states that its main processing takes place in the USA and that transfers are covered by the European Commission's standard contractual clauses (Decision 2021/914) included in its data processing addendum.
• Google states that it may process data in any country where Google or its subprocessors have facilities and that, when a transfer requires it, it applies the European Commission's standard contractual clauses or a recognized alternative transfer solution.

If you would like more information about these safeguards, write to us at info@andreucabot.com.

6. How long we keep it

• Attached files: they are deleted automatically 90 days after upload, and the download links we receive stop working within that period.
• Requests and messages: for as long as they are needed to handle your request and any relationship that may result from it. After that they are kept blocked, available to the authorities, for the legal limitation periods, and then deleted.
• Technical logs: Vercel and Resend keep logs of their activity under their own retention policies.

7. How we protect the files

Attached files are uploaded from your browser to private storage that is not publicly accessible. We receive them only through signed links that expire, and the connection to the site is encrypted (HTTPS).

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@andreucabot.com and saying which right you want to exercise. If we have doubts about your identity, we may ask you to prove it. We will reply within one month.

If you believe your data is not being processed properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).