Privacy policy
Last updated
What we do with your data when you write to us, join the newsletter or work with us. No small print: we ask for what we need, use it for what we said, and never sell it to anyone.
Controller
- Controller: HELLO DOKO S.L. (DOKO STUDIO)
- Tax ID (CIF): B19783562
- Address: Calle Almazora, 6 — 46010, Valencia, Spain
- Phone: (+34) 621 03 44 47
- Email: [email protected]
We don't have a data protection officer, as we aren't required to. For anything about your data, email us at that address.
What data we process
- Contact form: your name, what people call you, company, role, email, phone and what you tell us about what you need. Only your name, email and what you need are required.
- Newsletter: your email.
- If you contact us by email, WhatsApp or phone: whatever you share in that conversation.
- If you're a client: the contact and billing details the contract needs.
- When you browse: our server and Cloudflare, which protects the site, keep technical logs (IP address, browser, date and page requested) for security. We don't use analytics or advertising cookies, as the cookie policy explains.
We don't ask for special category data (health, beliefs…). Please don't include it in your messages.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Replying to your message and, if you ask, preparing a proposal. | Your consent when you send the form, and steps taken at your request before entering a contract (Art. 6(1)(a) and 6(1)(b) GDPR). |
| Sending you the newsletter: stories from projects and tips on branding, software and cybersecurity. | Your consent when you sign up (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email. |
| Running the project, invoicing and meeting our accounting and tax obligations, if you're a client. | Performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR). |
| Keeping the site secure and detecting abuse. | Our legitimate interest in protecting the site and its users (Art. 6(1)(f) GDPR). |
We don't make automated decisions or build profiles from your data.
How long we keep it
- Contact: as long as we need to reply and, if we don't end up working together, one year at most.
- Newsletter: until you unsubscribe.
- Clients: for as long as we work together and then for the periods the law requires (six years for business records and four for tax records, under Spanish law).
- Technical logs: a few days, unless a security incident means we need to keep them longer.
Who else sees it
We don't sell or share your data with anyone, unless the law requires it (for example, the tax authority or a court).
Our website and email are hosted by OVHcloud (OVH SAS, Roubaix, France), which processes data on our behalf: it is bound by a data processing agreement and may only use the data to provide that service. Its servers are in the European Union.
In front of the site sits Cloudflare (Cloudflare, Inc., USA), which serves it faster and protects it from attacks and bots. To do so it sees your IP address and the technical details of each visit, also as a processor. As a US company it may process them outside the EU: it is certified under the EU-US Data Privacy Framework (a European Commission adequacy decision), and its contract also includes standard contractual clauses.
If you message us on WhatsApp, Meta also processes that conversation under its own policy, which may involve transfers outside the EU with GDPR safeguards.
Your rights
You can ask us at any time for:
- Access: to know what data of yours we hold.
- Rectification: to correct anything that's wrong.
- Erasure: to delete it.
- Objection and restriction: to stop using it, or use it only for some things.
- Portability: to receive it in a format you can take elsewhere.
- Withdrawal of consent, without affecting what we did with it before.
Email us at [email protected] or write to our address, saying which right you want to exercise. If we have reasonable doubts about your identity, we'll ask you to confirm it. We reply within one month at most.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es). We'd rather you told us first, but it's your right.
Security
We're a cybersecurity studio too, so we take this seriously: the site is encrypted (HTTPS), the forms are protected against bots, and only the people who need your data to help you can access it.
Children
This site isn't meant for children under 14. If you are under 14, please don't send us any data without your parents' or guardians' permission.
Changes
If we change this policy (for example, because we start using a new tool), you'll see it here with the date of the last update. If the change is significant and we have your email, we'll let you know.