1. Data controller
- Controller: MDC21 Agency S.L.
- Tax ID (NIF): B70918503
- Address: C/ Mar Denoruega 2, 04770 Adra (Almería), Spain
- Email: contact@mdc21.agency
Given its size, MDC21 Agency S.L. is not required to appoint a Data Protection Officer (DPO). Privacy questions are handled at the email above.
2. What we process and why
2.1 Contact form
When you write to us from the contact page we process:
- Name and email.
- Company, phone number and country code (if you provide them).
- Project type and your message.
- Language of the request, IP address and browser, to prevent spam and abuse of the form.
Purpose: answering your request, assessing the project and, if it fits, preparing a proposal. We also send you an automatic email confirming we received it.
Legal basis: pre-contractual steps taken at your request (GDPR art. 6.1.b). Technical data used to prevent abuse is processed under our legitimate interest in protecting the service (GDPR art. 6.1.f).
Retention: if the request does not lead to a project, we delete the data 12 months after the last contact. If you become a client, we keep it for the duration of the relationship and then for the periods required by law (for example, 6 years for commercial records under art. 30 of the Spanish Commercial Code).
2.2 Accepting a quote
If you accept online a quote we sent you, we process the billing details you provide (company or name, tax ID, address, billing email and the person accepting) to formalise and invoice the engagement.
Legal basis: performance of a contract (GDPR art. 6.1.b) and compliance with legal, tax and accounting obligations (GDPR art. 6.1.c). Retention: for the relationship and the legal periods afterwards.
2.3 Web analytics (only with your consent)
If you accept analytics cookies, we use Google Analytics 4 to learn which pages are visited and how people navigate the site (page views, device, browser, approximate location and traffic source). If you don't accept, or you reject them, the site does not load Google Analytics and sends no data to Google.
Legal basis: your consent (GDPR art. 6.1.a and art. 22.2 of the Spanish LSSI). You can withdraw it at any time from the "Cookie settings" link in the footer. More details in the cookie policy.
3. Who processes data on our behalf
We never sell or share your data. To run the service we use these providers (data processors):
- Amazon Web Services EMEA SARL (Luxembourg): hosting of the website and database in the Paris region (EU), and delivery of transactional emails through Amazon SES.
- Google Ireland Ltd (Ireland): Google Analytics 4, only if you accept analytics. Google may transfer data to Google LLC (USA), certified under the EU-US Data Privacy Framework and covered by Standard Contractual Clauses.
When a request arrives, our team also gets an internal Telegram notice that only contains the request number and project type — no personal data.
The site's fonts are served from our own server: we make no requests to third-party font services.
4. Your rights
You can exercise these rights at any time by writing to contact@mdc21.agency and saying which one. If we cannot verify your identity from the email you write from, we will ask for the minimum needed to do so.
- Access: find out what data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: have your data deleted when no longer needed.
- Restriction: have it kept only for possible claims.
- Portability: receive it in a structured format.
- Objection: object to processing based on our legitimate interest.
- Withdrawing consent (analytics), without affecting earlier processing.
If you think we have mishandled your data, you can complain to the Spanish Data Protection Agency (AEPD) (opens in a new tab).
5. Security
We apply proportionate technical and organisational measures: all traffic is encrypted (HTTPS), servers run in AWS data centres in the EU, access to the management panel is restricted and protected by authentication, and we take regular backups.