Privacy Policy

Last updated: 8 September 2026

Controller

For website enquiries and marketing activity, the controller is Maria Gabriela Torres Villegas, trading as PIC MOTION STUDIO, at Madrid, 28027, email gabifreelancemgr@gmail.com. For an assignment contracted through the UK business, MGTV Photography may be the controller for that assignment as identified in its estimate and privacy information.

Information processed, purposes and normal retention

Name, email, telephone and enquiry details

Purpose and legal basis: Respond to enquiries and take steps requested before a contract. Legitimate interests and pre-contractual necessity.

Normal retention: Unsuccessful enquiries are normally kept for 24 months after the last meaningful contact.

Client, supplier, estimate, contract and invoice records

Purpose and legal basis: Administer assignments, receive payment, maintain accounts, and establish or defend legal claims. Contract, legal obligation and legitimate interests.

Normal retention: Statutory accounting and tax periods; claim records for the applicable limitation period.

Photographs, video and production records containing identifiable people

Purpose and legal basis: Perform the assignment, deliver material, manage rights and clearances, preserve authorship evidence, and use material for an authorised portfolio. Contract, legitimate interests, legal claims and consent where required.

Normal retention: As stated in the assignment; selected archival copies may be kept longer where lawful. Clients must keep their own delivery backup.

Newsletter email and consent record

Purpose and legal basis: Send requested news and marketing. Consent.

Normal retention: Until consent is withdrawn, plus a suppression record needed to honour the withdrawal.

Website and device information, including IP address and cookie identifiers

Purpose and legal basis: Operate and secure the site; measure use where consent is required and obtained. Legal obligation, legitimate interests for essential security, and consent for non-essential analytics.

Normal retention: According to the Cookie Policy and provider settings.

Correspondence and privacy requests

Purpose and legal basis: Respond to communications, complaints and data-protection requests. Legal obligation and legitimate interests.

Normal retention: For as long as needed to resolve the matter and document compliance.

Sources of information

Information normally comes from you, your employer or commissioning client, people involved in an assignment, website technology, or publicly available professional sources relevant to the assignment. If a client provides information about another person, the client must be authorised to do so and provide any required notice.

Recipients and service providers

Information may be shared only as needed with Squarespace for website hosting, forms and mailing lists; Microsoft for business email and documents; Dropbox and WeTransfer for file storage or transfer; professional advisers; payment and accounting providers identified in an assignment; and assistants, retouchers, videographers, producers or other suppliers engaged for the work. Public authorities may receive information where required by law.

International transfers

Some providers may process information outside Spain, the European Economic Area or the United Kingdom. Where required, the controller relies on an adequacy decision, approved contractual clauses, the EU-US Data Privacy Framework or UK Extension where valid for the recipient, or another lawful transfer mechanism. Information about the relevant safeguard may be requested at gabifreelancemgr@gmail.com.

Your rights

Subject to applicable law, you may request access, correction, erasure, restriction or portability; object to processing based on legitimate interests or direct marketing; and withdraw consent without affecting earlier lawful processing. Send a request to gabifreelancemgr@gmail.com. Reasonable identity verification may be required.

You may complain to the Spanish Data Protection Authority at https://www.aepd.es. If UK data-protection law applies, you may also complain to the Information Commissioner at https://ico.org.uk/make-a-complaint/. Please contact us first if you would like us to investigate a concern directly.

Security and required information

Reasonable technical and organisational safeguards are used. No internet service is completely secure. Information marked as required on a form is needed to answer the request; without it, the enquiry or assignment may not be handled.

Automated decisions and children

The website does not currently make decisions producing legal or similarly significant effects solely by automated means. The website is aimed at business and adult clients. Information about children may be processed only where necessary for an assignment and with the appropriate authority and safeguards.

Changes

This policy may be updated when services, providers or legal requirements change. The current version and update date will appear on this page.