Last updated: 29 July 2026
1. Data Controller
The personal data collected through this website and professional contact channels will be processed by:
- Data Controller: María Vélez-Bracho Suárez.
- Tax identification number (NIF): 48982941W.
- Professional activity: Interior designer.
- Address: Calle Río Tajo, 7, 41530 Morón de la Frontera, Seville, Spain.
- Email address:hola@mariavelez.es
- Website: https://mariavelez.es.
Hereinafter, María Vélez-Bracho Suárez will be referred to as the ‘Controller’.
2. Applicable legislation
Personal data will be processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation —GDPR—; Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights —LOPDGDD—; and all other applicable provisions.
3. Personal data processed
Depending on the channel used and the relationship with the Controller, the following categories of data may be processed:
- Full name.
- Email address.
- Telephone number.
- Information contained in messages, emails or conversations.
- Data required to prepare a proposal or provide a service.
- Address of the property associated with the project.
- Plans, photographs, measurements and characteristics of the space.
- Preferences and requirements relating to the project.
- Billing details, tax identification number and tax address.
- Quotations, contracts, invoices and proof of payment.
- Technical and browsing data obtained through cookies or analytics tools, where the user has given consent.
- Images of completed projects, solely in accordance with what has been agreed with the property owner.
The Controller will apply the principle of data minimisation and will request only data that are adequate, relevant and necessary for each purpose.
Users must not provide special categories of data —such as information concerning health, beliefs, political opinions or other particularly sensitive information— unless strictly necessary and agreed in advance.
4. Source of the data
Data are obtained directly from the data subject when they:
- Complete the contact form.
- Send an email.
- Make an enquiry by telephone or WhatsApp.
- Request information, a proposal or a quotation.
- Engage or participate in an interior design project.
- Provide documentation required to carry out the project.
Where a person provides third-party data, they must have a lawful basis for doing so and must have informed those individuals in advance where necessary.
5. Purposes and lawful bases
5.1. Responding to enquiries and requests for information
Data submitted via the form, email, telephone or WhatsApp will be used to:
- Identify and respond to the data subject.
- Respond to enquiries about the services.
- Carry out an initial assessment of a potential project.
- Arrange a conversation, visit or meeting.
- Prepare a proposal or quotation, where appropriate.
The lawful basis is the implementation of pre-contractual measures requested by the data subject, pursuant to Article 6(1)(b) of the GDPR.
Where an enquiry is not directly related to a potential engagement, processing may be based on the Controller’s legitimate interest in responding to communications received and properly managing her professional activity, pursuant to Article 6(1)(f) of the GDPR.
Submitting an enquiry does not automatically constitute the engagement of any service.
5.2. Managing projects and professional relationships
Where a professional relationship exists, data may be used to:
- Define the project’s requirements, scope and terms.
- Prepare and manage proposals, quotations and contracts.
- Deliver, coordinate and supervise the agreed services.
- Maintain communication with the client.
- Manage suppliers, orders, deliveries, installation and issues where these form part of the service.
- Manage payments, invoicing and administrative documentation.
- Handle requests, liabilities or claims relating to the project.
The lawful basis will be the performance of a contract or the implementation of pre-contractual measures, pursuant to Article 6(1)(b) of the GDPR.
Where it is necessary to disclose data to suppliers or professionals involved in the project, the client will be informed and their authorisation will be requested where appropriate.
5.3. Compliance with legal obligations
Certain data will be processed to comply with tax, accounting, administrative, consumer protection or other obligations applicable to the professional activity.
The lawful basis will be compliance with a legal obligation, pursuant to Article 6(1)(c) of the GDPR.
5.4. Photographs and publication of projects
The Controller may photograph completed projects and use the images in her portfolio, website, social media, presentations or professional materials only where she has the relevant authorisation.
The scope of publication will be agreed with the property owner. Depending on that authorisation, only the spaces may be shown, or other expressly agreed elements may also be included.
Whenever possible, names, exact addresses, personal belongings or information that could identify the property owner or reveal the property’s location will not be published.
The lawful basis will be the consent or authorisation of the person concerned, pursuant to Article 6(1)(a) of the GDPR. Consent may be withdrawn for future uses without affecting any processing lawfully carried out before its withdrawal.
5.5. Website analytics and measurement
The website uses Google Analytics 4 and Google Tag Manager to obtain statistics on use of the site, understand in aggregate terms how it is used, and improve its content and operation.
These tools may process online identifiers, technical information about the device and browser, pages visited, interactions and approximate location data.
Analytics tools will be activated only where the user has given consent through the cookie settings panel. The lawful basis will be that consent, pursuant to Article 6(1)(a) of the GDPR.
Users may withdraw or change their consent at any time using the Manage consent option available on the website. Further information can be found in the Cookie Policy.
6. Marketing communications
The Controller does not currently use data obtained through the form to send newsletters, promotions or regular marketing communications.
Responding to an enquiry, sending a requested proposal or maintaining communications relating to a project is not considered advertising.
If a newsletter or any other promotional activity is introduced in future, the relevant consent will be requested in advance and this Privacy Policy will be updated.
7. Recipients and service providers
Data will not be sold or disclosed to third parties for commercial purposes.
The following service providers may be involved in the operation of the website and the management of communications:
- Soluciones Web On Line, S.L.U. —Sered—: website hosting and related technical services.
- Google Ireland Limited: provision of Gmail email services and the Google Analytics and Google Tag Manager tools.
- WhatsApp Ireland Limited: messaging channel used where the data subject chooses to make contact via WhatsApp.
Data may also be disclosed:
- To public authorities, regulatory bodies, courts or tribunals where there is a legal obligation.
- To professional advisers or legal professionals where necessary to comply with obligations or handle claims.
- To shops, suppliers, carriers, installers, tradespeople, architects, technicians or other professionals involved in a project, only where necessary and in accordance with the information provided to, or authorisation given by, the client.
Some of these recipients may act as processors and others as independent controllers, depending on the nature of the service and their own terms.
8. International transfers
Google and WhatsApp may process certain data from countries outside the European Economic Area.
Where international transfers take place, they must be carried out using mechanisms recognised by law, such as adequacy decisions, standard contractual clauses approved by the European Commission or other applicable safeguards.
Users may consult further information in Google’s and WhatsApp’s privacy policies.
9. Data retention
Data will be retained for the following periods:
- Enquiries that do not become projects: for up to 12 months from the last communication, unless it is necessary to retain them for longer in order to respond to a request or potential claim.
- Clients and projects: for the duration of the professional relationship and, once it has ended, for the statutory periods necessary to address contractual liabilities.
- Invoices and financial documentation: for the legally applicable tax, accounting and commercial retention periods.
- Data communicated via WhatsApp or email: for as long as necessary to respond to the enquiry or manage the professional relationship, after which the relevant retention periods for enquiries or projects will apply.
- Photographs authorised for the portfolio: for as long as the authorisation remains in force or until it is withdrawn for future uses, without prejudice to any processing lawfully carried out before its withdrawal.
- Google Analytics data: for the period configured in the Google Analytics property and while consent remains in force, within the limits established by Google.
When data are no longer required, they will be deleted or retained in blocked form solely to address potential legal liabilities.
10. Rights of data subjects
Data subjects may exercise the following rights:
- Access their personal data.
- Request the rectification of inaccurate data.
- Request the erasure of their data where they are no longer required.
- Request restriction of processing.
- Object to processing where the lawful basis is legitimate interest.
- Request data portability where applicable.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- Not be subject to decisions based solely on automated processing where they produce legal effects or significantly affect them.
To exercise these rights, a request may be sent to hola@mariavelez.es, specifying the right to be exercised and including the information required to verify the requester’s identity where there are reasonable doubts about it.
If you believe that your data have not been processed correctly, you may lodge a complaint with the Spanish Data Protection Agency via https://www.aepd.es.
11. Mandatory nature of the data
Fields marked as mandatory on the form are required in order to identify and respond to the data subject.
If these data are not provided, it may not be possible to respond to the enquiry. Users are responsible for ensuring that the information provided is accurate, complete and up to date.
12. Minors
The website and the services offered are not specifically directed at minors.
Minors must not submit personal data via the form without the involvement of their parents or legal guardians.
13. Automated decision-making and profiling
The Controller does not make automated decisions or create personal profiles that produce legal effects or significantly affect users.
14. Security and confidentiality
The Controller will implement reasonable technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or unlawful processing.
Individuals and service providers who may legitimately access the data must respect their confidentiality and use them solely for authorised purposes.
Nevertheless, no system connected to the Internet can guarantee absolute security. If a security breach is detected that may pose a risk to individuals’ rights, the notification and response measures required by law will be implemented.
15. External links and services
The website may include links to pages or services managed by third parties. When leaving the website, the privacy policies of the relevant service will apply.
The Controller does not control the processing of data carried out by external websites.
16. Changes to this policy
This Privacy Policy may be updated to reflect regulatory, technical or professional changes, or changes relating to the services used.
The applicable version will be the one published on the website at any given time, identified by its latest update date.
17. Contact
For any enquiry relating to this Privacy Policy or the processing of personal data, please write to: