Privacy Policy

01 Who is responsible for this data

Controller

IMC PROJECT MANAGEMENT, S.L., trading as TaurozStudios

Tax ID (NIF)

B23916729

Address

Passeig de Sant Gervasi 71, 4-1, 08022 Barcelona, Spain

Contact

jan@taurozstudios.com

We haven't appointed a Data Protection Officer: our activity doesn't fall under Article 37 GDPR. For any data question, write to the address above. We also haven't appointed a UK representative under Article 27 UK GDPR, given our current volume of UK contacts; you can still reach us directly, or the ICO (§10), for anything UK-related.

02 What data we process, and where it comes from

The Vault sign-up

To give you access to the resources, we ask for your first name, your email, what you do (creator, agency, local business, SaaS or "just curious") and, optionally, a phone number in case you'd like a call. Alongside your sign-up we keep proof of your consent: the exact text of the boxes you ticked and their version, the date and time, your IP address, the country it maps to, your browser and the page you signed up from, and whether and when you confirmed your email. The GDPR requires us to be able to demonstrate that consent existed.

If the sign-up is for your business (you choose "It's for my business" in the form) we also ask for the business name and its sector, and, optionally, the city or area, its website or Instagram, a phone number and what you are interested in (having us do it all for you with Motor IA, more customers, Google profile, a website, ads, showing up in ChatGPT, automating WhatsApp and bookings, content). We also record which resource or episode you came in through and, if you answer the optional "How did you find us?" question, where you found us (Instagram Reel, TikTok, YouTube, X, Google, a recommendation or other), plus the src tag of the link you used, if it had one. All of this is voluntary except the business name and the sector. Only if you tick the specific commercial contact box (separate, unticked and optional) do we copy these details into our prospect records so we can contact you; if you don't tick it, the resources open anyway and we don't contact you.

If it is for personal use (you choose "It's for personal use") we ask for nothing more, but you may optionally tell us whether you have or plan to start a business (no, I'm thinking about it, yes in the coming months, I work in one), your city and, only if the answer is not "No", what you are interested in. We use this to choose what to send you. If you also tick the specific commercial contact box (separate, unticked and optional) we copy these details into our prospect records so we can contact you about your project; if you don't tick it, we don't contact you.

If you tick the personalisation box, we additionally record which resources you open in The Vault and which emails and links you open and click, so we can choose what to send you. Without that box, we record none of that.

Instagram comments and messages

See §05 below for what we process when you comment a keyword or message us on Instagram.

Sales calls to businesses

If you run a business and we call you, we process the phone number and the public data about your business. What data, where it comes from and how to object are in §06.

Our contact form and inbox

If you write to our contact address, we process whatever is in that message: your address, the name you sign with, details about your business or project, and anything else you choose to tell us or attach. We don't ask for or need special categories of data — please don't include them.

What the server generates

Every time a page is served, our hosting provider logs technical data: IP address, date and time, the resource requested and browser type. This keeps the site running, helps us spot abuse and protects it against attacks. We don't cross-reference it with anything else or use it to identify you.

03 What we use it for, and on what legal basis

Access to The Vault's resources never depends on accepting marketing or personalisation: you can withdraw either consent and keep opening the library with your key.

04 The Vault: how the email side works

The Vault is the part of this site built for creators, agencies and businesses in the US, the UK and everywhere else. Here's what happens when you sign up:

• Double opt-in. We send a confirmation email with a signed link that expires after seven days. Tapping it always opens the resources you asked for, whether or not you ticked the marketing box — if someone entered your address without your permission, ignoring the email is enough and nothing else happens.
• What you get if you ticked the marketing box. On top of unlocking the resources: a welcome sequence that explains how the studio works, a weekly note on new tools and methods, and, occasionally, an offer for our services. Without that box, your confirmation email only unlocks the resources — nothing else arrives. Nothing from third parties either way: we never sell, rent or share the list.
• Unsubscribe in one click. Every marketing email carries an unsubscribe link that applies instantly, with no sign-in and no questions asked, plus our full identification and postal address. You can also unsubscribe by writing to jan@taurozstudios.com.
• Personalisation only if you ask for it. Tracking what you open and click is a separate processing activity with its own, separate box. Leave it unticked and you get the same sequence as everyone else, with no per-contact tracking. Tick it, and you can turn it off — or back on — any time from the preferences link in any email, or by writing to us; we stop profiling you the moment you do.
• Phone number is optional. We only ask for it in case you'd like a call. We never send marketing SMS or WhatsApp messages to that number.
• If you're in the US or the UK. We also follow the CAN-SPAM Act (clear identification, postal address, a visible unsubscribe link applied immediately) and UK GDPR / PECR (prior consent, no pre-ticked boxes). You can exercise your rights the same way as anyone in the EU, at the same address (§10).

05 Instagram messages

If you comment a keyword on one of our Instagram posts, or send it to us by direct message, we use Meta's official Instagram API to reply and send you the free resource you asked for.

• What we process. Your Instagram username and Instagram-scoped ID, the text of that comment or message, which resource we sent you and when, and whether you follow our account.
• Why. To deliver the resource you asked for, and to count, in aggregate, how many people ask for each one.
• Legal basis. Your request — Art. 6.1(b) GDPR — and our legitimate interest in measuring our content — Art. 6.1(f) GDPR.
• Retention. 12 months. You can ask us to delete it at any time at jan@taurozstudios.com.
• Who sends it today. Until our own Instagram bot is live, these replies go out through Metricool, acting on our behalf over Meta's official API. We'll update this section when that changes.

06 Sales calls to businesses

We phone businesses — sole traders, professionals and small companies — to offer them web design and digital marketing. Because we hadn't asked your permission before calling, Article 14 GDPR requires us to explain the following at the latest on that first call. This is it.

• Who is calling. IMC PROJECT MANAGEMENT, S.L., trading as TaurozStudios, Tax ID B23916729, the details in §01. We identify ourselves at the start of every call. If we record a call, we tell you at the start.
• What data we process. The business's phone number and name, the contact person's name where it is public, and what happens on the call (whether there's interest, whether you'd like us to call back, or whether you tell us no). To decide which businesses to call, we look at public data about the business itself, such as whether it has a website and what reviews it has. We don't collect special categories of data.
• Where it comes from. Public sources: the business's Google listing, its own website and, in some cases, open maps such as OpenStreetMap, where the business itself or the community publishes the phone number. We don't call randomly generated numbers or numbers taken from subscriber directories.
• Legal basis. Our legitimate interest in making our services known to other businesses — Art. 6.1(f) GDPR, read with Art. 66.1(b) of Spain's General Telecommunications Act and, for the contact details of sole traders and professionals, Art. 19 of the Spanish data protection act (LOPDGDD).
• Who receives it. We don't pass it to third parties for their own purposes. It is seen by whoever makes the calls on our behalf and by the telephony provider the calls go through, which acts as a processor strictly on our instructions (§08).
• How long we keep it. Up to 12 months after the last call, unless you object or ask us to erase it sooner. If you object, we don't erase everything: see below.
• How to ask us not to call again. You have the right to object at any time (Art. 21 GDPR), including during the call. Just say so, or write to jan@taurozstudios.com with the number you don't want us to call. We add it to our own exclusion list, permanent and with no expiry, which we check before every batch of calls. We keep only the minimum needed to honour your request (Art. 23 LOPDGDD): your phone number, the business name, the date and what you asked. If you also ask us to erase your data, we keep just that phone number on the list, because it is the only way to make sure we never call you again.
• If you don't want advertising from anyone. You can sign up to the Robinson List, the free Spanish do-not-advertise service for individuals.
• Your rights and complaints. Besides objecting, you can ask us for access, rectification, erasure, restriction of processing and portability at the same address (§10), and complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).

07 How long we keep it

• The Vault sign-ups: for as long as you stay subscribed, and up to 24 months of inactivity (no opens, no clicks). When you unsubscribe we stop emailing you instantly, and keep only what's needed to prove your consent and your unsubscribe while liability could still arise.
• Instagram comments and messages: 12 months (§05).
• Sales calls to businesses: up to 12 months after the last call. If you ask us not to call, only your phone number stays, with no expiry, on the exclusion list (§06).
• Enquiries that don't turn into a project: kept for as long as the conversation runs, deleted at most a year after the last contact.
• Client data: for the length of the relationship and, afterwards, blocked while legal, accounting or tax liability could still arise.
• Invoicing: the periods set by Spanish commercial and tax law.
• Contact-form messages: not stored in any database. They arrive as an alert to the studio's internal messaging and are deleted at most a year after the last contact.
• Measurement data: if you accept the Google Analytics cookie, events are kept for the period configured in that tool, up to 14 months.
• Server logs: the limited period our hosting provider applies, after which they're deleted automatically.

08 Who else can see this data

We don't sell or share data with third parties. Only the providers our service needs can access it, and they act as processors, strictly on our instructions:

• Vercel Inc. (USA) — hosting and delivery of the site and its forms, and the aggregated, cookie-less measurement of visits and load speed (§09).
• Notion Labs, Inc. (USA) — the database where The Vault's sign-ups and proof of consent live.
• Hetzner Online GmbH (Germany; server in Finland, EU) — hosting of our own server, where we copy only the sign-ups that ticked the commercial contact box so we can follow them up.
• Resend, Inc. (USA) — sends The Vault's confirmation email and, with box A ticked, the welcome sequence and the newsletter. We also track whether you open these emails and which links you click, to measure delivery and improve what we send — this applies to every email we send you, not only if you opted into personalisation with the second checkbox.
• Metricool S.L. (Spain) — sends today's Instagram comment and DM replies on our behalf, over Meta's official API, until our own bot is live (§05).
• Google — our corporate email (Google Workspace).
• Google Ireland Ltd. — measures use of the site with Google Analytics, only if you accept it.
• Meta Platforms Ireland Ltd. — the Instagram API (§05), and, only if you accept measurement cookies, the Meta pixel that tells us which network a Vault sign-up came from.
• Microsoft Ireland Operations Ltd. — heatmaps and anonymous session recording through Microsoft Clarity, only if you accept measurement cookies (§09).
• Telegram FZ-LLC — the internal messaging that alerts the studio to every form sent and every Vault sign-up.
• Telephony provider — the switchboard the sales calls to businesses go through (§06); it sees the number called and the length of the call.
• Accounting and admin support — when a relationship turns into invoicing, to the extent the legal obligation requires.

Several of these providers process data in the United States. The transfer relies on the EU-US Data Privacy Framework adequacy decision where the provider is certified, and, in every case, on the standard contractual clauses under Article 46 GDPR built into their processing agreements.

Data may also be shared with public authorities, courts and tribunals where the law requires it.

09 Cookies and measurement

10 Your rights

At any time you can exercise your rights of access, rectification, erasure, objection (including to direct marketing and to any profiling tied to it), restriction of processing and portability, and withdraw any consent you gave, without affecting the lawfulness of processing carried out before the withdrawal.

To stop receiving emails, the unsubscribe link in any of them is enough. To stop receiving calls, say so on the call or write to us with your phone number (§06). For everything else, write to jan@taurozstudios.com telling us which right you want to exercise. We reply within one month at most. We may ask you to confirm your identity if there's reasonable doubt about who is making the request.

If you think we haven't handled your request properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD): www.aepd.es, C/ Jorge Juan 6, 28001 Madrid, Spain. If you're in the UK, you can instead complain to the Information Commissioner's Office (ICO): ico.org.uk.

11 Profiles, automated decisions and minors

We only build profiles if you tick The Vault's personalisation box, and for a single purpose: deciding which resource or offer to send you. Separately, to choose which businesses to call, we look at public data about the business itself (§06), a commercial selection. We don't make automated decisions with legal effects, or that significantly affect you.

This site's services are aimed at businesses and professionals, not minors. If we find we've received a minor's data without a guardian's authorisation, we'll delete it.

12 Changes to this policy

If how we process data changes, we'll update this policy before that change takes effect, and the date above will reflect it. If a change affects something you consented to, we'll tell you by email before applying it.