Privacy Policy

1. Data Controller

• Name: LEÓN BORJA GONZÁLEZ CORTÉS
• Tax ID (NIF): 43827490R
• Address: C/ San Martín 95, 38001 Santa Cruz de Tenerife, Spain
• Email: info@bokstudio.com
• Phone: 922 296 810

2. Purpose and Legal Basis of Processing

2.1. Users and Website Visitors

• Purpose: Managing requests and inquiries submitted through contact forms.
• Legal basis: Consent of the data subject (Art. 6.1.a GDPR).
• Retention period: 6 months from the last contact.

2.2. Clients and Suppliers

• Purpose: Contractual, administrative, tax and accounting management.
• Legal basis: Performance of a contract (Art. 6.1.b) and legal obligations (Art. 6.1.c GDPR).
• Retention period: 6 years from the end of the contractual relationship.

2.3. Quote Requesters

• Purpose: Preparing and sending quotes and commercial follow-up.
• Legal basis: Pre-contractual measures (Art. 6.1.b GDPR).
• Retention period: Validity of the proposal plus 5 years.

2.4. Job Applicants

• Purpose: Personnel recruitment processes.
• Legal basis: Consent (Art. 6.1.a GDPR).
• Retention period: Maximum 2 years.

2.5. Registered Users of the Private Panel

• Data processed: email, name, company, account type (client/agency), associated projects, documentation and support ticket messages.
• Purpose: managing authenticated access to the private panel (/login) and providing contracted services: delivery of documentation and technical support.
• Legal basis: Performance of a contract (Art. 6.1.b GDPR).
• Retention period: for the duration of the contractual relationship and, after its termination, for the legal tax and commercial retention periods (6 years).
• Authentication: access is via a single-use link ("magic link") sent to the user's email; no passwords are stored.

3. Third-Party Data

If you provide data belonging to third parties, you represent that you have their express consent and have informed them of this policy.

4. Private Panel and Infrastructure Provider (Supabase)

The private client panel relies on Supabase Inc., a provider acting as data processor that provides database, authentication and file storage (documentation) services.

• Each user can only access their own data, through row-level security policies configured in the database.
• Documents are stored in private, non-publicly-accessible containers and can only be downloaded by their authenticated recipient.
• A data processing agreement (DPA) is in place with Supabase in accordance with GDPR; see section 5 for more information on international transfers.

5. Disclosure and Transfer of Data to Third Parties

Data may be disclosed to third parties essential for contractual management, to the competent Public Administration, and to technical service providers (hosting, private panel database and authentication, email delivery, web analytics tools) under confidentiality conditions.

6. International Data Transfers

This site uses Google Analytics (GA4) for statistical purposes, subject to your consent. This provider may transfer data to servers in the US under Standard Contractual Clauses in accordance with GDPR. The private panel provider, Supabase Inc., may also involve data transfers outside the European Economic Area, subject to the corresponding Standard Contractual Clauses. See our Cookie Policy for more detail on analytics. We also have a presence on social networks (Facebook, LinkedIn) based in the US.

7. Data Security

Measures in place include: HTTPS/TLS encryption, passwordless authentication via a single-use link, row-level security (RLS) policies in the private panel database, restricted access to the site's management systems, regular backups and continuous security monitoring.

8. Exercising Your Rights

8.1. Withdrawing Consent

You may withdraw your consent at any time, without affecting the lawfulness of processing prior to its withdrawal.

8.2. Access, Rectification, Erasure and Objection Rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by sending a request with proof of identity to info@bokstudio.com. Response within a maximum of 30 days.

8.3. Complaint to the Supervisory Authority

You may file a complaint with the Spanish Data Protection Agency (AEPD).

9. Changes and Updates

This policy took effect in June 2026. Any material change will be communicated in advance.