Privacy and Data Protection Policy
This policy explains how personal data is handled when you visit this website, contact Almas Brasileiras, or interact with services linked from it.
Effective and last updated:
1. Controller and contact details
- Controller: Roxanne, responsible for Almas Brasileiras.
- Location: Poble-sec, Barcelona, Spain.
- Tax identification number (NIF): not supplied.
- Data Protection Officer: none has been appointed.
2. Data categories and sources
- Contact data supplied directly by you: name, email address, optional phone number, inquiry type, and message.
- Technical data generated when a form is submitted, including the connection IP address used for abuse prevention and rate limiting.
- Booking data, if a Cal.com booking option is introduced, consisting of the information you choose to provide through that external service.
- Names, review text, ratings, photographs, or audiovisual material used as testimonials or to document activities, obtained directly from the person concerned or from a publicly visible review platform where lawful.
3. Purposes and lawful bases
| Purpose | Data involved | Lawful basis |
|---|---|---|
| Respond to contact or collaboration requests | Contact form data and correspondence | Steps requested before entering a contract and the legitimate interest in responding to genuine inquiries |
| Organise services or bookings, if booking is enabled | Contact and booking details | Performance of a contract or steps requested before entering a contract |
| Protect the form and website from abuse | Connection and rate-limit data | Legitimate interest in security, availability, and fraud prevention |
| Publish testimonials or activity images | Name, review, rating, image, or recording | Consent where required, or legitimate interests only where a documented balancing assessment supports publication and rights do not override those interests |
| Meet legal obligations and address claims | Data relevant to the obligation or claim | Legal obligation and the establishment, exercise, or defence of legal claims |
4. Required and optional information
The contact form requires your name, email address, inquiry type, and message so that the request can be understood and answered. The phone field is optional. If required information is not provided, the form cannot be processed. Please do not include sensitive or unnecessary personal data in free-text fields.
5. Recipients and service providers
Personal data is not sold. Access is limited to Roxanne and service providers that need it to supply the relevant function, subject to their applicable terms and data protection roles.
- Formspree processes contact form submissions and forwards them to the recipient configured in the Almas Brasileiras Formspree account. The recipient is controlled in Formspree, not in this website’s source code.
- Hosting, security, rate-limiting, and email infrastructure providers may process limited data to operate and protect the service.
- Cal.com will receive data only if a booking link is introduced and you choose to use it.
- Behold may support an Instagram feed only if that integration is enabled in the future. No active Behold integration is currently verified on this website.
- Courts, regulators, or public authorities may receive data where disclosure is legally required.
6. International transfers
Some service providers may process data outside Spain or the European Economic Area, depending on their infrastructure and account configuration. We do not independently verify where each provider processes data, nor whether an adequacy decision, standard contractual clauses, or other safeguards apply. For any provider-specific information that may be available, contact the privacy email.
7. Retention
- Contact correspondence controlled by Almas Brasileiras is kept only for as long as needed for the purposes described in this policy and to comply with legal obligations or to establish, exercise, or defend legal claims.
- Copies held in the Formspree account and in email are governed by the settings and terms of those services; Almas Brasileiras does not run an automatic periodic deletion of those copies.
- Rate-limit records are server-side technical records. Under the Redis-backed configuration they expire after 10 minutes; the in-memory fallback may keep an expired record until its periodic five-minute cleanup, at most around 15 minutes.
- Booking records, if Cal.com is introduced, are kept for the service relationship and any applicable statutory obligations or limitation periods.
- Testimonials and images are kept while they remain relevant and lawfully published, and are removed following a valid withdrawal or objection where the applicable lawful basis requires it.
8. Your data protection rights
You may request access, rectification, erasure, restriction of processing, objection, and data portability where applicable. Where processing is based on consent, you may withdraw consent at any time without affecting processing already carried out lawfully. You may also object to processing based on legitimate interests.
Send a request to the privacy email above and identify the right you wish to exercise. Information necessary to verify identity may be requested. Requests are normally answered within one month, subject to the extensions permitted by the RGPD.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Minors
This website and its contact form are not directed at children under 14. A parent or legal guardian should contact Almas Brasileiras regarding participation by a minor and should avoid sending unnecessary information about the child. If data from a child has been submitted without appropriate authorisation, request its deletion using the privacy email.
10. Security
Reasonable technical and organisational measures are used to reduce risks such as unauthorised access, loss, alteration, or disclosure. These include validation, abuse controls, limited access, and encrypted transport where supported. No online service can guarantee absolute security.
11. Changes to this policy
This policy may be updated when services, providers, or legal requirements change. The effective and last-updated date will be revised, and significant changes will be communicated through the website where appropriate.
12. Legal framework
This policy is based on Regulation (EU) 2016/679 (RGPD) and Spanish Organic Law 3/2018 (LOPDGDD). Rules on cookies and electronic communications are also addressed under Law 34/2002 (LSSI-CE).