Privacy Policy

1. Data controller

• Owner: Alejandro Ávila Gómez, trading as HeyDay Studio
• ABN: 18 133 543 510 (sole trader registered in Australia)
• Location: Manunda, Queensland, Australia
• Email: hello@estudioheyday.com

The full postal address is available on request at hello@estudioheyday.com.

2. Why the GDPR applies

The controller is established in Australia, not in the European Union. Even so, this site is expressly aimed at people and businesses in Spain and the wider EU, so the processing falls under the General Data Protection Regulation by virtue of its article 3(2)(a).

In practice that means you have the same rights you would have against an EU-established controller, and you can exercise them as described below.

3. What data we process

We only process what you give us voluntarily, plus the strictly technical data needed for the site to work:

• Contact form: your name, email address and the content of your message.
• AIday assistant: your name and email address, if you choose to leave them.
• Technical data: your IP address is processed temporarily and in memory only, to limit how many times the form can be submitted and to stop spam. It is never written to disk or attached to your message.

We do not collect special categories of data. We do not profile you and we make no automated decisions about you.

4. Why we use it and on what legal basis

• To answer your enquiry and, where relevant, send you a proposal — legal basis: your consent, given by ticking the acceptance box (GDPR art. 6(1)(a)).
• To protect the form from abuse and automated submissions — legal basis: our legitimate interest in site security (GDPR art. 6(1)(f)).

We do not use your data to send unsolicited marketing, and we do not share it with third parties for advertising.

5. How long we keep it

Your message arrives in our inbox and is kept for as long as the conversation lasts. If a working relationship follows, it is kept for its duration and for the record-keeping periods required by applicable Australian law (generally 5 years for tax records).

If the enquiry goes nowhere, we delete the message once it is no longer needed. You can ask us to delete it at any time.

6. Who else is involved in the processing

We do not sell or transfer your data. The following providers are involved in delivering the service and act as processors under a signed data processing agreement:

• Vercel Inc. (USA) — website hosting and form execution.
• Resend (USA) — delivery of the email containing your message to our inbox.

Worth knowing: this site does not store your messages in any database. The form sends them by email, and our inbox is the only place they are recorded.

7. International transfers

Your data is processed outside the European Economic Area. The detail matters:

• Australia, where the controller is established and where messages are read and answered. Australia has no adequacy decision from the European Commission. When you use the form you provide your data directly to us, and we process it in line with this document and with the GDPR, which applies to us under article 3(2).
• The United States, where Vercel and Resend operate. Those transfers rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission.

If you would like the detail of the safeguards applied, write to us at hello@estudioheyday.com.

8. Your rights

You can exercise the following rights at any time, free of charge:

• Access — find out what data of yours we process.
• Rectification — correct anything inaccurate.
• Erasure — ask us to delete it.
• Objection — object to processing based on legitimate interest.
• Restriction — ask us to pause processing while a complaint is resolved.
• Portability — receive your data in a structured, commonly used format.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise them, write to hello@estudioheyday.com stating which right you want to exercise. We will reply within one month at the latest.

If you believe we have not handled your request properly, you can lodge a complaint with the supervisory authority of your country of residence. In Spain that is the Spanish Data Protection Agency (www.aepd.es).

9. Cookies

This site uses no analytics, advertising or tracking cookies, and embeds no third-party service that sets them. That is why you will not see a cookie banner: there is nothing to consent to.

The only cookie the system can create is a technical session cookie for the internal admin panel, and it is only issued when the studio logs in. As a visitor, you never receive it.

10. Security

The site is served entirely over HTTPS with strict security headers (HSTS, content security policy, and protection against clickjacking and MIME-type sniffing). Form data is validated server-side, and the internal panel is protected with authentication and signed, expiring sessions.

11. Minors

This site is aimed at professionals and businesses. It is not intended for children under 16, and we do not knowingly collect their data.

12. Changes to this policy

If we change how we process data, we will update this page and its last-updated date. We recommend checking back from time to time.