Last updated: 7 November 2026
This policy explains what personal data Onesto Studio collects through this website, why we collect it, how long we keep it and the rights you have over it.
Who we are
Onesto Studio is a creative studio based in Bilbao, Spain, and is responsible (the “controller”) for the personal data described here. For anything to do with your data, write to us at connect@onestostudio.com.
What we collect
- When you send an enquiry through the Connect page: your first and last name and email address, plus anything else you choose to tell us — your business or brand name, where you are based, the service you are interested in and the details of your project.
- When you email us: your email address and whatever your message contains.
- When you visit the site: our hosting provider’s servers automatically record technical information such as your IP address, browser type and the pages requested. These server logs are used to keep the site secure and running.
- If you accept analytics cookies: information about how you use the site (see “Cookies and analytics” below).
How we use it, and why
- To reply to your enquiry and, if you wish, to discuss and prepare a proposal. These are steps you ask us to take before any agreement (Article 6(1)(b) of the GDPR), and we have a legitimate interest in answering people who contact us (Article 6(1)(f)).
- To keep the site and the enquiry form secure and free of spam, which is in our legitimate interest (Article 6(1)(f)). The form uses a scrambled (hashed) version of your IP address for 30 seconds to stop repeated submissions; it is not stored.
- To understand how visitors use the site so we can improve it, only with your consent (Article 6(1)(a)).
We do not sell your data, use it to make automated decisions about you, or add you to a mailing list without asking first.
Cookies and analytics
The site does not set cookies of its own for visitors. WordPress sets cookies only for people who log in to manage the site.
We use Google Analytics to see, in aggregate, how people find and use the site — for example which pages are visited and for how long. It runs only if you accept analytics cookies when the cookie notice appears, and you can change or withdraw that choice at any time from the cookie settings on the site.
Fonts
The site’s typefaces are served by Google Fonts. To display them, your browser connects to Google’s servers, which receive your IP address. Google Fonts does not set cookies. We rely on our legitimate interest in presenting the site consistently (Article 6(1)(f)).
Who we share it with
We share personal data only with the service providers that help us run the studio and this website, who process it on our behalf and under data processing agreements:
- our hosting provider, Hostinger, which hosts the website and stores enquiries;
- our email provider, which delivers and stores our email;
- Google, for Google Analytics (only with your consent) and Google Fonts.
We may also disclose data where the law requires it. Our Instagram and LinkedIn pages are linked, not embedded: if you follow those links, the platforms’ own privacy policies apply.
Transfers outside Europe
Some of these providers, such as Google, may process data outside the European Economic Area, including in the United States. Where they do, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
How long we keep it
- Enquiries and related emails: for as long as we need to deal with your enquiry, and no longer than two years after our last contact — unless we start working together, in which case we keep business records for as long as the law requires.
- Server logs: for the limited period set by our hosting provider.
- Analytics data: up to 14 months.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it or send it to you or another organisation in a portable format, and you can object to our using it on the basis of legitimate interest. Where we rely on your consent, you can withdraw it at any time; this does not affect anything done before.
To exercise any of these rights, email connect@onestostudio.com. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
Children
This site is not aimed at children under 14, and we do not knowingly collect their personal data.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.