Privacy notice

Controller

Álvaro Gil, trading as Oniru, is the controller of the personal data described in this notice. His public contact details are Calle Fobos 5, 28030 Madrid, Spain, [email protected], and NIF 02312382P.

Data we process

When you submit a project enquiry, we process the following intake fields:

• Name
• Work email
• Agency
• Optional website
• Project need
• Systems
• Timing
• Budget
• Stage

We also process the following technical security data:

• Request time
• Transient IP-derived limiter state
• Necessary request headers
• The Turnstile result

Agency page visits

Personalized agency pages record an aggregate visit count and the latest visit time for each page. A random event reference is retained for up to 24 hours to avoid duplicate counts, with expired references removed when the next visit is recorded. A browser session-storage marker prevents repeat counts in the same tab and day. This does not identify an individual recipient. Visit records do not store names, email addresses, IP addresses or browsing histories. Signed-in administrator previews are excluded. Aggregate counts remain while we manage the agency page.

Why we process it

We process enquiry data to consider and respond to your request under Article 6(1)(b) GDPR. We process security data to protect the website and project-intake form under Article 6(1)(f) GDPR, based on our legitimate interest in preventing abuse and maintaining service security. We process data where necessary to comply with applicable legal duties under Article 6(1)(c) GDPR.

Service providers and international processing

Recipients are:

• Cloudflare
• Self-hosted Coolify/Next.js and n8n infrastructure
• Email providers
• Professional advisers only where needed

Cloudflare processes IP address, user agent, TLS/browser characteristics, site key, and origin for Turnstile. Enquiry prose is not sent to Turnstile. Cloudflare's international processing is subject to its applicable safeguards; see the Cloudflare Privacy Policy and Cloudflare Turnstile Privacy Policy.

How long we keep it

We keep enquiries for up to 12 months after last contact. Client, legal, and accounting records are kept for the applicable Spanish retention periods. Short limiter records expire automatically.

Your rights

Subject to applicable law, you may request the following rights where applicable:

• Access
• Rectification
• Erasure
• Restriction
• Objection
• Portability

To exercise these rights, email [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Cookies and technical storage

This version of the website has no intentional non-essential advertising or analytics cookies. Managed Turnstile is necessary security, and pre-clearance is disabled.

Security

We use technical and organisational measures appropriate to the processing described here, including the security controls described in this notice.

Changes to this notice

We will publish material changes to this notice on this page.