Santa Orla · Data
PRIVACY
What data we process, what we use it for, and how you can exercise your rights.
1. Data controller
- Controller
- Fernando Bagué, trading as Santa Orla.
- Tax ID (NIF)
- 47658356X
- Address
- Calle Pallars 74, 2nd floor 1st door, door A, 08018 Barcelona, Spain
- Contact
- santa@santaorla.com · +34 657 01 42 52
2. People and data processed
Depending on the relationship you have with us, Santa Orla may process:
- Identification and contact data: name, surname, email address, phone number and language.
- Academic and organisational data: university, faculty, degree, year, class, cohort and student or class-rep status.
- Booking and transaction data: appointment, pack, payment, billing, delivery, shipping, incidents and communications.
- Images and photographic production: portraits, photos supplied by the student, individual and group photos, selections, photomontages, retouching and approvals.
- Personal-area data: credentials, access history, available files, downloads and requested changes.
- Browsing and analytics data: IP address, online identifiers, pages visited, referral source, campaign parameters, conversion events and cookie preferences, when you consent to analytics or advertising cookies in the settings panel.
- The content of communications made through the form, email, phone or WhatsApp.
Photographs will be treated as personal data. They will not be used for facial recognition, biometric identification or automated decision-making.
3. Purposes and legal bases
| Purpose | What it covers | Legal basis |
|---|---|---|
| Information and enquiries | Responding to enquiries received by form, email, phone or WhatsApp, informing class reps and organising a possible class activation. | Pre-contractual measures; consent for marketing communications where applicable. |
| In-person booking and session | Managing the appointment, taking the photos, charging, selecting, retouching and delivering the pack. | Performance of the contract and legal obligations. |
| Online participation | Validating the photo submitted, creating the photomontage, managing the proof, changes, approval, production and delivery. | Performance of the contract and your express request for personalisation. |
| Group graduation composite | Composing the graduation panel with photo, name, surname and degree, and distributing it via the agreed method. | Performance of the contract and the cohort's shared expectations. |
| Group photos | Giving access only to the people who appear in each photo. | Performance of the contract and legitimate interest in security and access control. |
| Billing and claims | Meeting accounting, tax and consumer-law obligations and keeping evidence. | Legal obligation and defence of claims. |
| Our own marketing | Sending news and promotions and measuring campaigns. | Consent; or the legal basis applicable to customers, with a right to object. |
| Promotional use of images | Publication on the website, social media, ads, Google, flyers, posters, portfolio and presentations. | Specific, separate, optional and revocable consent. |
| Web measurement and analytics | Analysing site usage (pages visited, referral source, conversions) to improve the service. | Consent given through the cookie settings panel. |
| Security | Preventing fraud, unauthorised access and loss of information. | Legitimate interest and security obligations. |
4. Where the data comes from
Each student's data is obtained directly when they request information, register, book, participate, pay or contact Santa Orla, including through the WhatsApp contact button. The class rep acts as the class's organisational point of contact but does not provide Santa Orla with personal lists of students: each student must register directly.
5. Required data and consequences
Fields marked as required are necessary to manage the booking, verify class membership, produce the composite, charge for or deliver the products. If they are not provided, it may not be possible to provide the service. Consent for marketing, analytics/advertising cookies and promotional use of images is voluntary and declining it does not affect the contract.
6. Individual photos, group photos and the graduation panel
Images will be processed to provide the contracted service. Group photos will only be available in the personal area to those who appear in them. The group graduation panel will contain the photo, name, surname and degree confirmed by each participant and will be delivered to members of the cohort through the method agreed with the class. Participants must be informed of this distribution before confirming their inclusion.
7. Contact via WhatsApp
The website includes a button that opens a WhatsApp conversation with Santa Orla's contact number. By using it, you leave the website and the conversation is handled directly within WhatsApp: its content is stored on WhatsApp/Meta's servers and on the mobile device Santa Orla uses to reply, under WhatsApp's own privacy policy, which is outside Santa Orla's control. Santa Orla processes the content of those conversations to respond to your enquiry and, if it leads to a booking or order, to manage it, on the same legal basis and with the same retention periods as other information requests (sections 3 and 10). Santa Orla does not automatically add WhatsApp contacts to Brevo or any other marketing list; it will only do so if you expressly request it through the corresponding subscription channel.
8. Recipients and providers
Santa Orla does not sell personal data. The following may access it, when necessary and under the appropriate legal framework:
- Microsoft Azure, for hosting the personal area, applications, databases, photos and backups.
- Brevo, for forms, lead capture, CRM and marketing communications by email.
- Microsoft 365, for email, documents and internal management.
- IONOS, for the domain, hosting or technical services linked to the site.
- Redsys and the bank, to process online payments without Santa Orla storing full card details.
- Meta/WhatsApp, when you choose to start a WhatsApp conversation from the website's contact button (see section 7).
- Google, through Google Analytics, and Meta and TikTok, through their advertising pixels, only when you accept the corresponding cookie category in the settings panel.
- Accountants, advisors, printing and shipping providers and photography collaborators, only to the extent necessary to invoice, produce or deliver.
- Public authorities, courts or regulators, when there is a legal obligation to do so.
Before publishing this policy, Santa Orla will verify that the contractual identity, role, location and processing conditions of each provider remain accurate.
9. International transfers
Some technology providers may process information from countries outside the European Economic Area. When this happens, Santa Orla will verify that the transfer is covered by an adequacy decision, standard contractual clauses or another valid safeguard, and will provide additional information or a copy of the safeguards where legally required.
10. Retention
- Leads who only request information — including WhatsApp enquiries —: up to 24 months from the last interaction, unless they have consented to marketing communications.
- Marketing subscribers: until they withdraw consent or unsubscribe, after which only the minimum evidence of the unsubscribe is kept.
- Bookings, contracts, payments and invoices: for the duration of the relationship and the applicable tax, accounting and liability periods.
- Photos, photomontages, graduation panels and personal-area downloads: up to five years from delivery, unless deletion is requested, there is a legal obligation, a pending claim, or promotional consent remains in force.
- Promotional photos: until consent is withdrawn or they are no longer needed for the authorised purpose.
- Analytics and advertising cookies: as set out in the Cookie Policy.
- Technical and security logs: for the period proportionate to security and incident-resolution purposes.
Withdrawal or deletion will also apply to active copies within a reasonable period. Backups may remain blocked until they are securely rotated.
11. Minors
People over 14 may provide their data and take part in the service, without prejudice to the civil rules applicable to contracting. Santa Orla will not use the image of a person under 18 for promotional purposes without the specific authorisation of their parent or legal guardian. Where necessary due to age, the nature of the order or the payment method, the guardian's involvement or authorisation may also be requested to formalise the contract.
12. Promotional use of images
Promotional use requires an authorisation separate from the contracting terms. It may cover the website, organic social media, paid ads on social media and Google, flyers, posters, portfolio and business presentations. The authorisation is optional, will not change the price or affect the service, and can be revoked for future uses. Revocation will not affect processing already lawfully carried out, without prejudice to Santa Orla removing content from channels under its control where reasonably possible.
13. Your rights
Data subjects can request access, rectification, erasure, objection, restriction or portability, and withdraw their consent, by writing to santa@santaorla.com. The request must allow identity verification without collecting excessive information. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).
14. Security and automated decisions
Santa Orla applies appropriate technical and organisational measures, including access control to the personal area and to shared photos. Access to the Brevo contact database is limited to those who need it to provide the service, based on the profiles and permissions configured in the tool itself. No decisions are made based solely on automated processing that produce legal or similarly significant effects on individuals.