Last updated: 25 October 2026
This is an English translation provided for your convenience. In case of any discrepancy, the Spanish version shall prevail.
At MdArte we take your data seriously. Here we explain clearly who processes it, for what purpose and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: Vanderlei de Oliveira de Souza (MdArte)
- Tax ID (NIF): 60990266Q
- Address: Calle García de Paredes, 24, bajo 2, 28010 Madrid (Spain)
- Privacy contact email: info@mdarte.com
- Phone: +34 613 966 042
2. What data we process and why
We only process the data you provide to us directly through the website or when you contact us.
| When | Data | Purpose | Legal basis | How long |
|---|---|---|---|---|
| Contact form | Name, email and message | Replying to your enquiry | Your consent (art. 6.1.a GDPR) | Until your enquiry is resolved and, after that, a maximum of 12 months |
| Quote form | Name, email, phone, company, service, indicative budget, timeframe and message | Preparing and sending you a quote | Taking pre-contractual steps at your request (art. 6.1.b GDPR) | Up to 12 months if no contract is signed; if it is, as long as required by law (see section 4) |
| Newsletter and launch notice | Sending you news from the blog and from MdArte | Your consent (art. 6.1.a GDPR and art. 21 LSSI-CE) | Until you unsubscribe | |
| WhatsApp, email or phone | Name, number or email and whatever you tell us | Handling your enquiry | Your consent (art. 6.1.a GDPR) | Until your enquiry is resolved and, after that, a maximum of 12 months |
| Asistente MdArte chat (artificial intelligence) | The messages you write and any data you choose to include in them (for example, your name or contact details) | Automatically answering your questions about MdArte and its services and, if you ask, helping you request a quote; reviewing conversations to improve our service | Your consent (art. 6.1.a GDPR), which you give by clicking “Entendido” (Understood) in the chat notice | A maximum of 90 days |
| Clients | Contact, billing and project data | Providing and invoicing the contracted service | Performance of the contract (art. 6.1.b) and legal obligations (art. 6.1.c GDPR) | For the duration of the relationship and, after that, the legal retention periods |
The fields marked as required in the forms are necessary to handle your request. If you do not fill them in, we will not be able to reply.
We do not make automated decisions or create profiles with your data.
About the Asistente MdArte: it is an artificial intelligence assistant. Its answers are generated automatically and may contain errors; it does not make decisions about you, and quotes and terms are always confirmed by a person. Please do not include sensitive data in the chat (health, bank details, passwords or identity documents).
3. Who else may access your data
We do not sell or transfer your data to third parties, unless legally required. For the website and the agency to work, some providers access it as data processors, under a contract and with safeguards in accordance with article 28 of the GDPR:
- Web hosting: IONOS, with servers in the European Union.
- Email: IONOS, which hosts the info@mdarte.com account.
- Newsletter sending: Mailjet (Mailjet SAS, France, European Union). The emails always include a link to unsubscribe.
- Artificial intelligence chat assistant: Anthropic, PBC (United States), provider of the Claude AI model, which processes the chat messages to generate the answers. This involves an international data transfer, carried out with the appropriate safeguards provided for in the GDPR (standard contractual clauses approved by the European Commission). Under its commercial terms, Anthropic does not use this data to train its models. The conversations are stored on our IONOS hosting.
- Accounting or tax advisers: only the client data needed for invoicing.
If you write to us on WhatsApp, your data is also processed by WhatsApp (Meta) under its own privacy policy, and may be transferred outside the European Economic Area with the safeguards that service applies.
4. Retention periods
We keep your data only for as long as needed for the purpose for which we collected it. After that, we block it for the periods during which liabilities may be claimed and then delete it. Client billing data is kept for the periods set by tax and commercial law (generally between 4 and 6 years).
5. Your rights
You can exercise these rights at any time:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data.
- Objection and restriction: ask us to stop processing it or to restrict its use.
- Portability: receive your data in a commonly used format.
- Withdraw your consent whenever you wish, without affecting processing carried out before. For the newsletter, just click the unsubscribe link in any email.
To exercise them, write to us at info@mdarte.com or by post to the address in section 1, stating which right you wish to exercise and providing what is needed to prove your identity. We will reply within one month at most.
If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
6. Minors
This website is not intended for children under 14. If you are under 14, do not provide us with data without the consent of your parents or guardians.
7. Security
We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), restricted access, strong passwords and backups.
8. Changes to this policy
We may update this policy to adapt it to legal changes or new services. We will always publish the current version on this page, with its update date.