Privacy policy
This is a courtesy translation. The Spanish version is the legally binding one.
Last updated: 15 October 2026
1. Who processes your data
- Controller: Emilio Fernández Lezcano
- NIF (Spanish tax ID): 54152996W
- Address: Plaza de Ría 8, 15174 Culleredo, A Coruña, Spain
- Contact: hola@molde.studio
No data protection officer has been appointed, because none of the cases set out in article 37 of the General Data Protection Regulation (GDPR, RGPD in Spanish) or article 34 of Ley Orgánica 3/2018 (Spanish Data Protection and Digital Rights Act) applies.
2. What data is processed and where it comes from
All data is provided by the data subject themselves. It is not obtained from third parties or from public sources.
- Contact and identification data: first name and surname(s), email address, phone number.
- Billing data: NIF or CIF (Spanish tax ID for individuals or companies), company name and registered tax address.
- Brand data: information about the business, tone, audience and materials that the client provides so the creatives can be produced.
- Payment data: collected and held by Stripe. Molde does not see or store card numbers or full bank details.
3. What it is used for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Signing up and managing the subscription, producing and delivering the creatives | Performance of the contract (art. 6.1.b GDPR) |
| Answering enquiries before purchase | Pre-contractual steps at the data subject's request (art. 6.1.b GDPR) |
| Answering enquiries not aimed at purchasing | Legitimate interest in replying to whoever writes in (art. 6.1.f GDPR) |
| Issuing invoices and meeting tax and accounting obligations | Legal obligation (art. 6.1.c GDPR) |
| Sending clients notices about the service itself | Legitimate interest and article 21.2 of Ley 34/2002 (Spanish Information Society Services Act, LSSI) |
| Sending marketing news to non-clients | Consent (art. 6.1.a GDPR), which can be withdrawn at any time |
Providing identification and billing data is necessary to provide the service and issue the invoice. Without it, purchase is not possible.
No automated decisions are made and no profiling is carried out.
4. How long it is kept
- Client data: for as long as the subscription lasts and for five years after it ends, because of the limitation period for legal actions under article 1964.2 of the Código Civil (Spanish Civil Code).
- Invoices and accounting records: six years, under article 30 of the Código de Comercio (Spanish Commercial Code). The Agencia Tributaria (Spanish Tax Agency) may review them for four years.
- Email enquiries that do not lead to a purchase: until they are resolved, and for one year at most.
- Marketing data: until consent is withdrawn.
Once those periods have passed, the data is blocked and kept available only to judges, courts and public authorities for as long as liabilities may arise, in accordance with article 32 of Ley Orgánica 3/2018.
5. Who else has access to the data
Providers that process data on the controller's behalf are used, under a signed data processing agreement:
| Provider | Purpose | Where |
|---|---|---|
| Lovable Labs Incorporated AB | Website hosting | Sweden, with transfers to the United States covered by standard contractual clauses |
| Stripe Payments Europe Ltd. | Subscription billing, receipts and payment portal | Ireland. Acts as an independent controller of payment data |
| Tally BV | Sign-up form | Belgium, data hosted in the European Union |
| Zoho Corporation B.V. | Email for the domain | European Union data centre |
| Google Ireland Limited | Client portal, shared Google Drive folder and sending of email notices | Ireland, with transfers to the United States covered by standard contractual clauses |
| Holded Technologies S.L. | Invoicing and accounting | Spain |
| Canva Pty Ltd. | Delivery of editable creatives | Australia, with European Union standard contractual clauses |
In addition, data is disclosed to the Agencia Tributaria and to the accounting firm (gestoría) when required by a legal obligation.
Data is not disclosed to anyone else, nor is it sold.
6. Transfers of data outside the European Union
Those shown in the table above. Where the provider is outside the European Economic Area, the transfer is covered by standard contractual clauses approved by the European Commission or by the relevant adequacy decision. You can request a copy of the safeguards by writing to hola@molde.studio.
7. Your rights
You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection at any time, and withdraw any consent you have given.
Just write to hola@molde.studio stating which right you are exercising. You will receive a reply within one month, which can be extended to two if the request is complex. It is free of charge.
If you believe your data is not being processed properly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency) (calle Jorge Juan 6, 28001 Madrid, www.aepd.es), without having to complain here first.
8. Minors
This service is aimed at professionals and businesses. It is not aimed at children under fourteen, and their data is not knowingly collected.
9. Security
Reasonable technical and organisational measures are applied to protect the data: two-factor access to the tools, backups, and providers that encrypt information in transit and at rest.
10. Changes to this policy
Any change will be published on this page with its date. If the change substantially affects the processing, active clients will be notified by email.