Last updated: March 21, 2026
Introduction
We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.
Data Controller
The entity responsible for the processing of your personal data is:
- Controller: Javier Expósito Martínez (natural person)
- Tax ID (NIF): 53912693A
- Contact Email: nikastudio.dev@gmail.com (direct and effective means of contact)
- Website: nikastudio.dev
- Data Protection Officer (DPO): Not applicable — a DPO is not mandatory for this processing (Art. 37 GDPR)
Information We Collect
We may collect personal data that you voluntarily provide when you register, place an order, subscribe to our newsletter, fill out a form, or otherwise interact with our services. This includes: name, email address, phone number, postal address, payment information, and any other data you choose to provide.
How We Use Your Data
We use the information we collect to: provide and maintain our services, process transactions, send communications, improve our website, comply with legal obligations, and protect against fraud.
Legal Basis for Processing
We process your personal data based on: contract execution (account management, order processing), consent (marketing communications), legitimate interest (analytics, security), and legal obligation (tax compliance).
Sharing Your Information
We do not sell your personal information. We may share data with: service providers (payment processing, hosting, email delivery) who have signed Data Processing Agreements (DPAs) per Article 28 GDPR, legal authorities when required by law, and third parties with your explicit consent.
Data Retention
We retain your data only as long as necessary: account data (duration + 30 days), orders (5 years for tax), contact submissions (2 years), security logs (12 months), cookie preferences (12 months).
International Data Transfers
Some of our service providers may process your data outside the European Economic Area (EEA). In all cases, we ensure adequate protection through one of the following mechanisms:
- Adequacy decisions by the European Commission (Art. 45 GDPR)
- Standard Contractual Clauses (SCCs) approved by the Commission (Art. 46.2.c GDPR)
- EU-US Data Privacy Framework (DPF), adopted by the European Commission on July 10, 2023, for transfers to certified US organizations
- Binding Corporate Rules (BCRs) where applicable (Art. 47 GDPR)
| Service | Provider | Country | Transfer Mechanism |
|---|---|---|---|
| Email (contact mailbox) | Google LLC (Gmail) | United States | EU-US Data Privacy Framework (DPF) — Adequacy Decision of 10 July 2023 |
Note: Analytics and marketing services are not active. The only current international transfer is the email service above. This table will be updated to add the hosting provider once contracted and any further processors before they begin operating.
Security
We implement appropriate technical and organizational measures to protect your data, including encryption, access controls, and regular security assessments.
Your Rights (GDPR)
You have the right to: access your data (Art. 15), rectify inaccurate data (Art. 16), request erasure (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), and withdraw consent at any time. To exercise these rights, contact us at the email above. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Children's Privacy
Our services are not directed to individuals under the age of 14. We do not knowingly collect personal data from children under 14 (Article 7, LOPDGDD).
Cookies
We use cookies as described in our Cookie Policy. You can manage your preferences through our cookie consent banner.
Rights of Deceased Persons' Relatives
In accordance with Article 3 of the LOPDGDD (Organic Law 3/2018), heirs or family members of a deceased person may request access to, rectification of, or erasure of the deceased's personal data, unless the deceased person explicitly prohibited it during their lifetime or by legal provision. To exercise these rights, please contact us at the email provided above, along with supporting documentation (death certificate, proof of kinship, or proof of heir status).
Changes to This Policy
We may update this Privacy Policy from time to time. Changes are effective when posted, and we will update the "Last updated" date accordingly.
Contact
If you have questions about this Privacy Policy, please contact us at the email address provided above.