Privacy policy

1. Data controller

The controller is the owner identified at the top of this page. For any question about your data you can write to info@filmagency.es with «Data protection» in the subject line.

2. What data we process and why

Contact form: name, email address, phone number where you provide it, and the content of your message, for the sole purpose of answering your enquiry and, where appropriate, preparing a quote.

Call request: name, WhatsApp number, email address and, if you provide it, your business sector, so that we can contact you and arrange the call you requested. We get in touch by WhatsApp or email, using the details you left.

Measurement: if you accept analytics, Google Analytics 4 records your visit with its cookies, and Vercel Web Analytics and Plausible count it in aggregate, with no cookies. If you accept marketing, the Meta Pixel and Google Ads link your visit to an identifier to attribute ads and show you ours again. Without your permission, Google only receives cookieless signals with no browser identifiers. The detail is in the cookie policy.

Website journey: we count how many times a day the site is opened, “Get started” is clicked, the form is started, each of its steps is completed and it is sent, and how many times the WhatsApp or phone link is clicked. These are daily totals only: they hold no IP address, cookie or identifier, cannot be linked to a person and never leave our servers. That is why they are counted even if you decline cookies.

Source of the request: with each request we store which campaign brought you (utm parameters, landing page and referring site) and whether you had accepted marketing. Ad click identifiers (gclid or fbclid) are only stored if you had accepted marketing, and only then do we share that identifier with Google Ads and, when you send the form, your email and phone number as an irreversible hash (SHA-256), so we know which ads bring clients.

We do not take automated decisions producing legal effects concerning you, nor do we build profiles for that purpose.

FILMAGENCY emails: if you tick the box “I want to receive ideas and offers from FILMAGENCY by email”, we use your name, your email, your type of business and what you told us you need to send you commercial communications by email. It is optional and you do not need to tick it for us to reply.

3. Legal basis

Contact form and call booking: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) and, where applicable, your consent given when submitting the form (Art. 6(1)(a)).

Analytics and marketing: your express consent given in the cookie manager (Art. 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of prior processing. The cookieless signals Google receives when you do not give permission rely on our legitimate interest in measuring in aggregate whether our advertising works (Art. 6(1)(f) GDPR): they store nothing on your device and carry no browser identifiers, and you can object at any time by turning off «Cookieless signals to Google» in the cookie panel (your browser's Global Privacy Control signal is also honoured).

Source of the request: utm parameters, landing page and referring site, on the basis of our legitimate interest in knowing which campaign brings each request (Art. 6(1)(f) GDPR), with the right to object at info@filmagency.es; ad click identifiers only with your marketing consent (Art. 6(1)(a) GDPR).

Retention of communications and invoicing once you become a client: compliance with legal obligations (Art. 6(1)(c) GDPR).

Commercial emails: your express consent (art. 6.1.a GDPR and art. 21 of the Spanish LSSI), which you can withdraw at any time with the unsubscribe link in every email or by writing to info@filmagency.es.

4. Recipients

Resend (Resend, Inc.), as processor, provides the email delivery service triggered by the form.

Upstash, Inc., as processor, stores the data from the requests received.

Vercel Inc., as processor, hosts the website and processes technical access logs.

Meta Platforms Ireland Ltd. receives advertising measurement data only if you have accepted the marketing category.

Google Ireland Ltd. provides Google Analytics and Google Ads (advertising measurement, according to your cookie preferences) and Google Workspace, which we use for email and calls (Google Calendar and Meet).

Some of these providers may process data outside the European Economic Area; in that case transfers rely on the EU-US Data Privacy Framework, on the European Commission's standard contractual clauses or on other adequacy decisions in force. No data is disclosed to other third parties except where legally required.

5. Retention period

Form and booking data is kept for the duration of the relationship and, afterwards, for a maximum of one year if no engagement follows. If you become a client, data linked to the commercial relationship is kept for the statutory tax and accounting limitation periods (up to six years).

Measurement data is kept for the periods stated in the cookie policy: 13 months for Google Analytics cookies and 90 days for Google Ads cookies.

Mailing list data is kept until you unsubscribe. After that we only keep the address, so that we do not write to you again.

6. Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing, portability, objection and not to be subject to automated individual decisions by writing to info@filmagency.es, proving your identity and stating the right you are exercising. We will reply within one month at the latest.

You may also withdraw any consent given at any time, without retroactive effect, and lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es) if you believe the processing does not comply with the rules.

7. Security

Technical and organisational measures appropriate to the risk are applied: encryption in transit (HTTPS), access control over the providers used, and minimisation of the data requested to what is strictly needed to reply to you.