Privacy notice
How Oniru handles project enquiries and website security data.
Last updated 23 August 2026
Controller
Álvaro Gil, trading as Oniru, is the controller of the personal data described in this notice. His public contact details are Calle Fobos 5, 28030 Madrid, Spain, [email protected], and NIF 02312382P.
Data we process
When you submit a project enquiry, we process the following intake fields:
- Name
- Work email
- Agency
- Optional website
- Project need
- Systems
- Timing
- Budget
- Stage
We also process the following technical security data:
- Request time
- Transient IP-derived limiter state
- Necessary request headers
- The Turnstile result
Why we process it
We process enquiry data to consider and respond to your request under Article 6(1)(b) GDPR. We process security data to protect the website and project-intake form under Article 6(1)(f) GDPR, based on our legitimate interest in preventing abuse and maintaining service security. We process data where necessary to comply with applicable legal duties under Article 6(1)(c) GDPR.
Service providers and international processing
Recipients are:
- Cloudflare
- Self-hosted Coolify/Next.js and n8n infrastructure
- Email providers
- Professional advisers only where needed
Cloudflare processes IP address, user agent, TLS/browser characteristics, site key, and origin for Turnstile. Enquiry prose is not sent to Turnstile. Cloudflare's international processing is subject to its applicable safeguards; see the Cloudflare Privacy Policy and Cloudflare Turnstile Privacy Policy.
How long we keep it
We keep enquiries for up to 12 months after last contact. Client, legal, and accounting records are kept for the applicable Spanish retention periods. Short limiter records expire automatically.
Your rights
Subject to applicable law, you may request the following rights where applicable:
- Access
- Rectification
- Erasure
- Restriction
- Objection
- Portability
To exercise these rights, email [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
Cookies and technical storage
This version of the website has no intentional non-essential advertising or analytics cookies. Managed Turnstile is necessary security, and pre-clearance is disabled.
Security
We use technical and organisational measures appropriate to the processing described here, including the security controls described in this notice.
Changes to this notice
We will publish material changes to this notice on this page.