This policy explains what personal data we collect through rollostudio.com, by email and at our studio, why, who we share it with, how long we keep it and how you can use your rights. We collect as little as we need. We do not sell your data, we do not use advertising trackers and this site sets no cookies (see our Cookie policy).
1. Who is responsible for your data
The data controller is Bryant Creative Industries, S.L.U. (Sociedad Unipersonal), trading as Rollo Studio.
- Address: Carrer de Fray Francisco Cabezas 13, Bajo C, 46019 València, Spain
- NIF: B26574954 · Registro Mercantil de Valencia, Hoja V-231290
- Privacy contact: info@rollostudio.com (subject “Privacy”) · +34 614 412 917
We are a small studio and are not required to appoint a Data Protection Officer. Write to the address above about anything in this policy.
2. What we collect and why
| What we do | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Online orders (Stripe payment page) | Name, email, phone, billing and delivery address, pieces, colours and options, order value and payment status. We never see your card details. | Performing our contract with you; our legal obligations (invoices, tax, consumer law) | Invoices: 6 years from the end of the financial year (accounting law). Order and guarantee records: up to 8 years after delivery. Who bought which piece (product safety): 10 years. See section 6. |
| Enquiries (contact form, email, phone, showroom visits) | Name, email, phone, your role or company, your message and anything you send us | Steps you ask us to take before a contract; our legitimate interest in answering messages | 12 months after our last contact if no order follows |
| Quotes, project lists and trade enquiries | The pieces, colours and notes in your list, project and client name, location, timeline; your name, email, company, role and country | Steps you ask us to take before a contract; for business contacts, our legitimate interest in the professional relationship | 24 months after our last contact if no order follows; as orders if it becomes one |
| Delivery | Name, delivery address, phone, email, contents and value of the parcel (and customs data outside the EU) | Performing our contract; customs obligations | With the order record |
| Returns, guarantee claims, complaints and safety reports | Order details, the problem, photos you send, correspondence | Our legal obligations under consumer and product safety law; our legitimate interest in defending claims | Until the claim is closed and the legal limitation periods end (up to 8 years after delivery; product safety records up to 10 years) |
| Withdrawal requests (our online withdrawal form) | Name, email, order details, your statement and its date and time | Our legal obligation to receive and acknowledge withdrawals | With the order record |
| Visit counting (no cookies) | Page viewed, referring website, campaign tags in the link, browser language, device size (phone, tablet or computer) and clicks on key buttons. We do not store your IP address or give you any identifier, so we cannot recognise you. | Our legitimate interest in knowing which pages are useful | 25 months at most |
| Website hosting and security | IP address, date and time, page requested, browser, referring page (standard server logs) | Our legitimate interest in running a secure website | For the limited period set by our hosting providers |
| Accounting and tax | Invoice data | Legal obligation | 6 years (Commercial Code), longer if tax law requires |
| Social media (Instagram, LinkedIn) | Your interactions with our pages and messages you send us there | Our legitimate interest in communicating with people who contact us there | Messages are kept like enquiries |
Do you have to give us your data? To order or get a quote, yes: we need your name, contact details and delivery address to make the contract and deliver. Everything else is optional.
Automated decisions. We do not make decisions about you by automated means or build profiles. Our payment provider, Stripe, screens payments automatically to prevent fraud and may decline a payment; if that happens, contact us and we will find another way to complete your order.
Newsletter. We do not currently send a newsletter. If we start one, we will only email you news with your consent, or, if you are a customer, about pieces similar to the ones you bought, with a simple way to opt out in every email.
3. Data stored only on your device
Your basket and your project list are saved in your own browser (local storage), so they are still there when you come back. They never reach us unless you check out or send us your list. If you create a share link for your project list, the link itself contains the list (including any project or client name and location you added), so anyone you send it to can see it. See our Cookie policy.
4. Who we share your data with
We share only what each provider needs to do its job, under contracts that oblige them to protect your data.
| Provider | What they do for us | Where |
|---|---|---|
| Stripe (Stripe Payments Europe, Ltd., Ireland) | Payment processing. Stripe also acts as an independent controller for fraud prevention and legal compliance, under its own privacy policy. | EU and United States |
| Netlify, Inc. | Website hosting, the checkout function and our web forms. Form submissions are checked for spam by Akismet (Automattic Inc.) on Netlify’s behalf. | United States |
| Google (Google Workspace) | Our email. | EU and United States |
| Supabase (Supabase Pte. Ltd.) | The database for our cookie-free visit counter and live prices. The database is in Ireland. | EU (Ireland); provider based in Singapore |
| Wix.com Ltd. | Hosting of some of the images on this site. Your browser requests them from Wix’s servers, which see your IP address. | Israel and global network |
| Packlink (Auctane, S.L.U., Madrid) and the courier that delivers your parcel (for example UPS, DHL or SEUR) | Delivery. Couriers act as independent controllers for the delivery. | Spain and the destination country |
| Our accountant and professional advisers | Accounting, tax and legal advice. | Spain |
| Public authorities | Tax, customs and other authorities, and courts, when the law requires it. | Spain and the destination country |
We do not sell your data or share it for anyone else’s marketing. For our Instagram and LinkedIn pages, Meta and LinkedIn are joint controllers with us for page statistics, under their own terms (Meta, LinkedIn). If you contact us by WhatsApp, Instagram or LinkedIn, those services also process your messages under their own terms.
5. Transfers outside the European Economic Area
Some of our providers process data in the United States (Stripe, Netlify, Akismet, Google), are based in Singapore (Supabase) or Israel (Wix). We only use providers that protect your data with the safeguards required by EU law: the European Commission’s adequacy decisions (the EU-US Data Privacy Framework for certified US companies, and Israel), and, where there is no adequacy decision or as an additional safeguard, the European Commission’s Standard Contractual Clauses in our providers’ data processing agreements. If your parcel goes outside the EU, your delivery data is shared with the courier and customs of that country because it is necessary to deliver the order you asked for. You can ask us for a copy of the safeguards.
6. How long we keep your data
We keep data only as long as we need it for the purpose we collected it for, and then for as long as the law requires or allows us to keep it to deal with claims. During that second period the data is blocked: we keep it securely and only use it if a claim, an authority or the law requires it. The main periods:
- accounting records and invoices: 6 years from the end of the financial year (Spanish Commercial Code, art. 30), longer if tax law requires;
- order and guarantee records: until the 3-year guarantee and the 5-year period to claim have passed (up to 8 years after delivery);
- product safety and traceability records (which piece went to which customer): 10 years after delivery, so we can warn you if there is ever a safety issue;
- enquiries with no order: 12 months; quotes and project lists with no order: 24 months;
- trade customers: for the business relationship and 6 years after it (Commercial Code);
- visit statistics: 25 months at most;
- requests about your data protection rights: 3 years.
7. Your rights
You can, at any time and free of charge:
- access your data and get a copy;
- correct it if it is wrong or incomplete;
- ask us to delete it;
- ask us to restrict how we use it;
- object to our use of it based on our legitimate interest, and to any marketing at any time;
- receive the data you gave us in a structured, machine-readable format (portability);
- withdraw your consent where we rely on it, without affecting what we did before.
To use your rights, email info@rollostudio.com or write to the address in section 1. We reply within one month (this can be extended by two months for complex requests, and we will tell you why). We only ask for proof of identity if we have reasonable doubts about who is asking.
If you are not happy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the authority of the EU country where you live.
8. Children
Our shop and forms are meant for adults. You must be 18 or over to order. We do not knowingly collect data from children under 14; if we learn that we have, we delete it.
9. Security
We protect your data with measures appropriate to the risk: the site is served only over encrypted connections (HTTPS with HSTS); card payments are handled entirely by Stripe, which is certified to the PCI DSS standard; your basket and project list stay on your device; access to our accounts with these providers is protected and limited to the people who need it. If a data breach ever puts your rights at risk, we notify the Spanish data protection authority within 72 hours and, where the risk is high, we tell you directly.
10. Changes to this policy
If we change how we use personal data, we update this page and its date, and keep previous versions. If a change matters to you, for example a new purpose, we tell you before it applies.