Privacy policy

The purpose of this Privacy Policy is to provide clear, transparent and detailed information on how Positiva processes the personal data collected through the website positiva.studio (hereinafter, "the Website") and its audiovisual gallery management platform (hereinafter, "the Platform"), in accordance with the GDPR (Regulation (EU) 2016/679) and the LOPDGDD (Ley Orgánica 3/2018, the Spanish Data Protection and Digital Rights Act).

1. Controller

• Identity: Rodrigo Marquez Rapela (hereinafter, "Positiva")
• Tax ID (NIF): 29195596V
• Address: Carrer dels Dofins 41 - 4, Valencia (España)
• Contact email: hola@positiva.studio
• Privacy: privacidad@positiva.studio

2. Data processed, purposes and legal basis

The processing of data at Positiva is strictly divided according to the profile of the person concerned:

2.1. Website Visitors and Waiting List

• Data collected: Email address provided voluntarily.
• Purpose: To manage the subscription to the launch list and to inform exclusively about the opening of the Platform's services.
• Legal basis: The explicit consent of the data subject (Art. 6.1.a GDPR), given by actively submitting the form.
• Retention: The data will be kept until the data subject has been informed of the opening of the Platform's services or until they request the withdrawal of their consent, whichever occurs first.

2.2. Registered Users (professional Photographers and Videographers)

• Data collected: First name, surname(s), trade or company name, email address, billing details (tax ID (NIF/CIF), postal address) and technical usage data (volume of storage consumed, access logs).
• Purpose: Provision and technical support of the contracted SaaS service, processing of payments, issuing of legal invoices and essential administrative communications relating to the account.
• Legal basis: The performance of a contract for the provision of services (Art. 6.1.b GDPR) and compliance with legal obligations of a fiscal and tax nature (Art. 6.1.c GDPR).
• Retention: For as long as the account remains active and, after its closure, blocked for the applicable statutory limitation periods (generally, 6 years under commercial and tax regulations).

2.3. Third parties photographed or recorded (Guests and Attendees at events)

Statement of the Platform's Role: Positiva is a technical infrastructure tool. With regard to the multimedia files uploaded to the galleries by Registered Users, Positiva acts solely and exclusively as Processor (in accordance with Annex I to the Terms and Conditions). The status of Controller lies entirely with the User/Photographer who takes the pictures and manages the gallery.

• Responsibility for capture and upload: The lawful basis for capturing, hosting and disseminating the images or voices of third parties (whether by legitimate interest, consent or contractual relationship) is the exclusive responsibility of the User of the Platform. Positiva does not preselect, supervise, moderate or audit the content uploaded by professionals.
• Protection of minors: Hosting images of minors without the due and express authorisation of their parents or legal guardians is strictly prohibited. Such verification is the responsibility of the User of the Platform.
• Immediate Removal Procedure (Takedown Procedure): If you are an attendee, guest or third party who has been photographed and you notice that your image or voice appears in a gallery hosted on Positiva without your consent, or you simply wish it to be removed, you may request its immediate erasure. To do so, send an email to privacidad@positiva.studio stating the exact URL of the image or of the gallery, attaching a screenshot or description that allows us to locate the file unequivocally. Positiva will process the technical deletion of the file within a maximum of two (2) working days and will notify the responsible photographer accordingly.

2.4. Gallery visitors and reviewers (the photographer's clients)

• Data collected: Email address provided when accessing a gallery or when marking favourites and its verification, the comments and favourites left, the language chosen, the preference regarding email notifications and the record of activity in the gallery (visits, plays and downloads).
• Purpose: To enable the photographer to deliver the gallery and receive their client's review, to send the email notifications that the visitor has accepted and to show the photographer the activity in their gallery.
• Positiva's role: As in section 2.3, Positiva processes these data as Processor on behalf of the photographer, who is the Controller (Annex I to the Terms and Conditions). Requests to exercise rights may be addressed to the photographer or to privacidad@positiva.studio, which will forward them to the photographer.
• Retention: For as long as the photographer keeps the gallery and, thereafter, in accordance with Annex I to the Terms and Conditions.

3. Recipients and location of the data

Personal data will not be disclosed to third-party commercial companies under any circumstances. In order to provide the service optimally, Positiva engages the services of the following technology providers as processors:

• Cloudflare, Inc.: Network infrastructure, CDN security and optimised cloud storage (R2, Workers and Pages services). Production data hosted under the jurisdiction of the European Union.
• Supabase, Inc.: Database management and infrastructure and logical authentication tools. Data located in the Frankfurt region (Germany, EU).
• Stripe Payments Europe, Ltd.: Technical gateway for the secure processing of encrypted payments and recurring billing. For certain processing of its own (fraud prevention and regulatory compliance) it acts as an independent controller, in accordance with its own privacy policy.
• Resend, Inc.: Sending of the Platform's emails (account confirmation, verification, notices and notifications).
• Functional Software, Inc. (Sentry): Logging of technical errors in the web application. Data hosted in the European Union.
• Cuéntica: Issuing and safekeeping of Registered Users' invoices.

Should any of these providers carry out technical support access from outside the European Economic Area (EEA), it is guaranteed that they adhere to the EU-U.S. Data Privacy Framework or that the service is safeguarded by the signing of Standard Contractual Clauses (SCCs) approved by the European Commission.

4. Security measures

Positiva adopts the organisational and technical security measures required by Article 32 GDPR to prevent the alteration, loss, cyberattack or unauthorised access to the data. Among other measures, encryption of data in transit (SSL/TLS protocols), encrypted storage at rest, secure password policies and segmented database environments are implemented.

5. Rights of data subjects

Any natural person whose data are processed by Positiva may exercise, free of charge, the following rights provided for by the regulations:

• Access: To know which personal data we are processing.
• Rectification: To request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): To request the deletion of their data when they are no longer necessary for the purposes for which they were collected.
• Objection or Restriction: To object to the processing or to request the restriction of processing (its temporary suspension) in the cases provided for by law.
• Portability: To receive their data in a structured, commonly used electronic format.

To exercise these rights, the data subject must send a written communication to hola@positiva.studio or privacidad@positiva.studio, providing proof of their identity.

If you consider that your rights have not been properly addressed, you are fully entitled to lodge a formal complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency) through its electronic office (www.aepd.es).

6. Cookies and tracking technologies

This Website maintains a strict privacy-by-design policy. No third-party analytics cookies (such as Google Analytics) or behavioural advertising cookies are used.

Only first-party and session cookies are used, where technically necessary, for purely operational purposes (keeping the photographer's session open or remembering technical preferences, such as the language or those of the gallery). As these are technical cookies exempted under Article 22.2 of the LSSI (Ley 34/2002, the Spanish Information Society Services and Electronic Commerce Act), the implementation of an intrusive cookie consent banner is not required, ensuring clean and private browsing.