Privacy Policy
Last updated: August 2026
This Privacy Policy explains how Tanto Creators SL, trading as Tanto Creators (“we”, “us”, “our”), collects and uses personal data when you visit tantocreators.com, contact us, or work with us as a client or supplier.
We are committed to handling your data lawfully and transparently under the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD). For details on cookies specifically, see our Cookie Policy.
1. Who we are
Data controller: Tanto Creators SL
Alicante, Spain
Email: contact@tantocreators.com
2. What this policy covers
This policy applies when we act as the data controller — that is, when we decide why and how personal data is processed. That covers visitors to our website, people who contact us, our clients and their staff, our suppliers, and applicants for roles with us.
It does not cover data we process on behalf of a client as a data processor. See Section 11.
3. What data we collect
3.1 Data you give us
- Identity and contact details: name, company, role, email, phone.
- Project information: brief details, budget range, goals and any files you send us.
- Correspondence: emails, messages, call notes and meeting records.
- Billing details: billing address, tax ID and payment references.
- Applications: CV, portfolio and cover letter, if you apply to work with us.
3.2 Data collected automatically
- Technical data: IP address, browser type, device, operating system and language.
- Usage data: pages visited, time on page, referring source and interactions.
- Cookie and pixel data, as described in our Cookie Policy.
3.3 Data from third parties
- Advertising and analytics platforms, in aggregated or pseudonymised form.
- Publicly available business sources such as company registers and LinkedIn.
- Referrals, where a client or contact introduces you to us.
We do not deliberately collect special category data (health, beliefs, biometrics and similar). Please do not send it to us in briefs, forms or attachments.
4. Why we use your data, and our legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to enquiries and preparing proposals | Steps prior to entering a contract (Art. 6.1.b) | 12 months from last contact |
| Delivering our services and managing the client relationship | Performance of a contract (Art. 6.1.b) | Duration of contract + 6 years |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6.1.c) | 6 years (Spanish Commercial Code) |
| Website security, error logging and abuse prevention | Legitimate interest (Art. 6.1.f) | Up to 12 months |
| Analytics and improving the website | Consent (Art. 6.1.a) | Up to 14 months |
| Advertising, remarketing and audience building | Consent (Art. 6.1.a) | Up to 13 months |
| Newsletters and marketing emails | Consent, or soft opt-in to existing clients (Art. 21 LSSI-CE) | Until you unsubscribe |
| Recruitment | Steps prior to a contract / consent | 12 months, then deleted |
Where we rely on legitimate interest, we have assessed that our interest does not override your rights and freedoms. You can ask us for that assessment at any time.
5. Marketing communications
We send marketing emails only where you have consented, or where you are an existing client and the content relates to services similar to those we already provided to you.
Every email includes an unsubscribe link. You can also email us to opt out at any time. Opting out of marketing does not stop service-related messages such as invoices or project updates.
6. International transfers
Some providers are based outside the European Economic Area, mainly in the United States. Where personal data is transferred, we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, or on Standard Contractual Clauses together with supplementary technical and organisational safeguards.
You may request a copy of the safeguards in place by emailing us.
7. How long we keep data
Retention periods are listed in the table in Section 4. In general we keep personal data only as long as needed for the purpose it was collected, plus any period required by Spanish accounting, tax and commercial law.
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
8. How we protect your data
We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls and least-privilege permissions, two-factor authentication on business-critical accounts, regular backups, and contractual confidentiality obligations on staff and contractors.
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the AEPD as required by Articles 33 and 34 GDPR.
9. Your rights
- Access — request a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where no legal ground to keep it applies.
- Restriction — ask us to limit how we use your data while a matter is resolved.
- Objection — object to processing based on our legitimate interest, and to direct marketing at any time.
- Portability — receive data you gave us in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting processing already carried out.
To exercise any of these, email contact@tantocreators.com with enough information for us to identify you. We respond within one month, extendable by two further months for complex requests.
If you are not satisfied with our response, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
10. Data we process for our clients
When we run campaigns, manage advertising accounts, build audiences or handle customer data on behalf of a client, the client is the data controller and we act as a data processor.
In that role we process personal data only on the client’s documented instructions, under a data processing agreement meeting Article 28 GDPR. If you are a customer of one of our clients and want to exercise your rights over that data, contact that company directly — we will forward any request we receive and assist them in responding.
11. Automated decisions and profiling
We do not make decisions producing legal or similarly significant effects about you by automated means alone.
We do use advertising platforms that build audience segments from website activity. This happens only with your consent, and you can withdraw it through our cookie settings or the platform’s own ad preferences.
12. Children
Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect data from anyone under 14, the age of digital consent in Spain under Article 7 LOPDGDD. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as our services, tools or legal obligations change. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you directly where we hold your contact details.
14. Contact
Questions or requests about this policy? Write to contact@tantocreators.com.