Privacy

Data controller and information collected

Name on this website

Alexander Vorontsov

Legal name

Oleksandr Vorontsov

The data controller is the owner of BlackSign Studio, identified under Owner and contact details. For data protection inquiries, email info@blacksign.studio. The telephone number and postal address are listed there too.

When you contact the studio, it processes the name and contact details you provide, your correspondence and material needed to discuss or carry out the engagement. A short description is enough for the first conversation. Documents, identifiers and information about other people are requested only as needed.

To deliver pages and protect the infrastructure, hosting providers process technical information such as your IP address, browser and device details, the time of a request and its characteristics. This is distinct from the content of your correspondence with the studio.

Providing information for an initial inquiry is voluntary. The studio needs a way to contact you to reply and may be unable to assess or carry out an engagement without the relevant documents. Required information and the grounds for requesting it are identified before the work begins.

The site has no document submission form, payment facility or client account. You send a message through the channel you choose. Simply opening a link does not send a message on your behalf.

Purposes and lawful bases

Preparing an engagement

Steps taken at a prospective client’s request before entering into a contract are based on Article 6(1)(b) GDPR where that person will be a party to the contract.

Performing an engagement

Article 6(1)(b) GDPR applies to data necessary to perform a contract with the individual concerned. Information about other participants is assessed separately.

Business correspondence

The basis for answering general inquiries and contacting an organization’s representative is the legitimate interest in necessary business communication under Article 6(1)(f) GDPR, taking account of the individual’s rights and reasonable expectations.

Operating and protecting the site

Delivering pages, keeping the site available and preventing abuse serve the legitimate interest in operating the site under Article 6(1)(f) GDPR.

Legal obligations

Documents needed to meet applicable tax, accounting or other legal duties are processed under Article 6(1)(c) GDPR. The particular obligation determines what data is needed.

Separate consent

Where consent is the basis for an activity, it is requested for a specific purpose and may be withdrawn under Article 6(1)(a) GDPR. Visiting the site or corresponding with the studio does not constitute consent to advertising.

The site does not profile visitors or make decisions based solely on automated processing that produce legal or similarly significant effects for an individual.

This policy covers the website, inquiries and dealings with the studio. Where a client instructs the studio to process data on its behalf, the parties’ roles, instructions and required terms are documented separately.

Documents and other people’s information

If an anonymized description is enough for the initial discussion, there is no need to send a full document containing personal information. Remove any details that are unrelated to the matter from the copy you share.

Processing data about a representative, employee or other participant requires its own lawful basis. If the information was obtained from someone else, the individual must be informed about the processing, categories and source of the data in the circumstances and within the time limits set out in Article 14 GDPR.

Health information, other special categories of personal data and data relating to criminal offenses require a separate assessment of the legal basis and processing conditions. Before you send such material, we agree what is needed and a suitable channel. A contract alone does not override those requirements.

Retention periods

Information is kept only as long as needed for the purpose for which it was obtained. For an initial inquiry, this takes account of the time needed to assess it, conclude discussions and answer related questions. If no engagement follows and there is no other lawful need, the information need not be retained further.

For an engagement that proceeds, retention depends on its duration, legal requirements for particular documents and applicable periods for legal claims. A duty to keep a contract or accounting record does not justify keeping every attachment and message indefinitely.

When the retention period ends, information is erased or irreversibly anonymized. If the law requires data to be blocked in case liability needs to be established, it is separated from active use and kept only for the relevant period. These criteria apply separately to documents, correspondence and working copies.

Retention of technical logs and backups depends on their purpose, the provider’s terms and security or recovery needs. Contact the studio for information about the periods or criteria that apply to your data.

Access and recipients

Access is limited to participants who need the data for the work in question. They may include hosting and communications providers, agreed contractors and, where relevant to the engagement, accounting, legal or technical specialists.

Before sharing data, the studio determines the purpose, the information needed, the lawful basis and the recipient’s role. Processing on the studio’s behalf is documented in line with Article 28 GDPR. A specialist who determines the purposes and means of processing independently has the obligations of a separate controller. Calling someone a partner does not in itself determine that role.

Data may be disclosed to competent authorities where there is a legal duty or lawful demand, and used as necessary to establish, exercise or defend legal claims. Listing specialists on the site does not automatically give them access to visitors’ data.

Communication and hosting services

WhatsApp is the main contact channel. Instagram hosts the studio’s profile and offers another way to get in touch. When you follow a link or send a message, you use the service under its own terms. The studio’s handling of correspondence and the service’s processing of data serve different purposes and involve different roles.

The mailbox at info@blacksign.studio is hosted by Tuta, a service of Tutao GmbH in Germany. The provider transmits and stores messages, attachments and the necessary technical information. Tuta’s policy covers its email service. This notice also governs how the studio uses correspondence it receives.

OpenAI hosts the website. Under its hosting terms, the provider processes data on the owner’s behalf to deliver, operate and maintain the site under a data processing agreement. It may use technical subprocessors for its infrastructure. Its privacy policy separately describes how it processes data for its own purposes.

The site does not embed a WhatsApp chat, Instagram feed or Google map. These services open when you choose to use them. Their policies are linked below.

International data processing

Hosting and communications providers use international infrastructure. Depending on the service, data may be processed outside the European Economic Area, including in the United States. A provider’s European address does not in itself mean all processing takes place in the EEA.

OpenAI’s published data processing agreement provides for transfers from the EEA on the basis of European Commission adequacy decisions or contractual safeguards using standard contractual clauses. The provider publishes its subprocessors and their locations. WhatsApp and Instagram describe their independent processing in their own policies.

For transfers made as part of a studio engagement, the recipient, purpose, applicable legal basis and safeguards under Chapter V GDPR are identified. You can ask about how your data is processed, request information about the safeguards or obtain a copy by writing to info@blacksign.studio.

Your rights and how to contact us

Where the law provides, you can access your data, correct inaccuracies, request erasure or restriction, object to processing and exercise the right to data portability. Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.

Email info@blacksign.studio, call +34 644 987 176, contact the studio through WhatsApp or write to the postal address in the contact details. Briefly identify the data concerned and how you would like a reply. Additional proof of identity is requested only where there is reasonable doubt and only to the extent necessary.

The normal response period is one month from receipt of the request. Where necessary, it may be extended by a further two months. The reasons must be explained within the first month. If a request is refused, the reasons and available means of redress must be provided.

Exercising your rights is generally free of charge. The law allows exceptions for manifestly unfounded or excessive requests. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority and may seek a judicial remedy. You do not need the studio’s consent to contact a supervisory authority.