PRIVACY POLICY

Last updated: 27 September 2026.

1. Data controller

• Controller: ALAMEDA 6 ARQUITECTURA, S.L. — tax ID B67726406.
• Trading name: Lorenzo Díaz Arquitecto.
• Contact address: Alameda Principal 6, 2-J, 29005 Málaga, Spain.
• Privacy email: [email protected] (use “Data protection” as the subject).
• Telephone: +34 952 21 72 33.
• Data protection officer: Alejandro Fariñas Nubla, available through the privacy email above.

2. Data processed and source

The website has no forms, accounts, bookings or purchases. If a user contacts the studio voluntarily by email or telephone, they may provide identity and contact data, the contents of their enquiry and any files they choose to attach.

The infrastructure delivering the website may process technical connection data such as IP address, date and time, requested resource and browser data to deliver, protect and diagnose the site. Exact log fields and periods depend on the provider configuration described in section 4.

3. Purposes and legal bases

• Answering general enquiries: the controller's legitimate interest in responding to people who voluntarily contact the studio (Article 6(1)(f) GDPR).
• Preparing requested quotations or services and managing the professional relationship: pre-contractual steps or performance of a contract (Article 6(1)(b) GDPR).
• Meeting professional, tax, accounting or administrative duties: compliance with applicable legal obligations (Article 6(1)(c) GDPR).
• Delivering, maintaining and protecting the website: legitimate interest in its availability, integrity and security (Article 6(1)(f) GDPR).
• Marketing: the website has no newsletter or marketing-consent mechanism. Contact details will not be reused for advertising without a valid legal basis and the required prior information.

4. Recipients and processors

Where necessary, data may be accessed on the controller's behalf by Cloudflare Pages (website hosting, delivery and protection) and the infrastructure providers supporting the principal architect's professional mailbox and technical support. These providers must process data under their contracts and the controller's instructions.

Data may also be disclosed to public authorities and courts where required by law.

5. Retention

• Enquiries that do not lead to a professional relationship will be retained for no more than one year after the last communication.
• Pre-contractual and client data will be retained while the request is handled or the relationship remains active and will then be restricted for the statutory limitation periods during which liabilities may arise.
• Documents subject to professional, tax or accounting duties will be retained for the periods required by applicable law.
• Cloudflare Pages technical logs will be retained only for the minimum period necessary for security and diagnosis, according to the account configuration and the periods applicable to the service.

6. International transfers

Cloudflare, Inc. is a US company with global infrastructure and may process data in the United States, the European Economic Area and other countries. Where an international transfer takes place, Cloudflare states that it relies on the EU-US Data Privacy Framework and, where that framework does not apply, the European Commission's Standard Contractual Clauses and supplementary measures described in its Data Processing Addendum. Professional-email providers must offer equivalent safeguards when processing data outside the EEA.

7. Rights

Data subjects may request access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent without affecting prior lawful processing where consent is the legal basis. Requests may be sent to the email above, with proof of identity where necessary.

Requests may be sent to the privacy email or the data protection officer named in section 1. A complaint may also be lodged with the Spanish Data Protection Agency.

8. Automated decisions, storage and security

This website's code performs no profiling or automated decision-making and installs no cookies, pixels, local storage or session storage. See the cookie and similar technologies policy.

The published domain redirects to HTTPS. The controller must maintain technical and organisational measures proportionate to risk and periodically review access, backups, logs and incident-response procedures.

9. Changes

This information must be reviewed before adding forms, analytics, maps, videos, social embeds, bookings or any new third-party service.