Privacy Policy
Last updated: 14 September 2026
Studio Baobab respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information when you visit our website, contact us, book a call or enquire about our services.
It also explains your privacy rights and how to contact us if you have any questions or concerns.
1. Who we are
Studio Baobab is a design and branding studio specialising in places, property and the built environment.
The data controller responsible for your personal data is:
Studio Baobab SL
Calle Jalón, 14
29004 Málaga
Spain
Email: hello@studiobaobab.com
This Privacy Policy applies under the General Data Protection Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) and, where applicable, the UK GDPR and UK Data Protection Act 2018.
2. Personal data we collect
Information you provide through our contact form
When you contact us through our website, we may collect information including:
- your name;
- your organisation;
- your email address;
- information about the project or services you are interested in;
- information about timings, requirements or budget where requested; and
- any other information you choose to provide as part of your enquiry.
Our contact form is operated using Contact Form 7.
Form submissions are transmitted to Studio Baobab through our email systems and are also stored in the website’s WordPress database using Flamingo. This allows us to retain a copy of an enquiry if an email notification fails or needs to be retrieved later.
The stored submission may also include technical information associated with the request, such as the date and time of submission, IP address, browser or user-agent information and the page from which the form was submitted.
Enquiry information may subsequently be stored in our private customer relationship management systems where this is necessary to assess, manage or respond to a potential project or client relationship.
Fields marked as required are necessary for us to process and respond to your enquiry. If you do not provide them, we may not be able to respond.
Please avoid providing sensitive or special-category personal information unless it is strictly necessary for your enquiry.
Booking a call
Our website allows you to schedule a call using Microsoft Bookings.
The Microsoft Bookings calendar is not loaded automatically on the contact page. It is loaded when you choose to open the calendar or when you follow the link to Microsoft Bookings.
If you arrange a meeting through Microsoft Bookings, we may receive and process information such as:
- your name;
- your email address;
- the date and time of your appointment;
- meeting and scheduling information; and
- any other information you choose to provide when making the booking.
Booking information is processed using our Microsoft 365 environment and may be stored within Microsoft Bookings, Outlook and Exchange Online.
Information collected automatically
When you visit the website, certain technical information may be generated automatically.
Our hosting and security systems may process information such as:
- IP address;
- date and time of requests;
- pages or resources requested;
- browser and device information;
- operating system;
- referring page or source; and
- technical information required to detect errors, misuse or security incidents.
Where you have provided consent for analytics, we also collect information about how the website is used, including pages visited, sessions, interactions, approximate geographical location, traffic source and pseudonymous identifiers.
3. How we use your personal data
Responding to enquiries
We use the information you provide to:
- respond to your enquiry;
- understand your requirements;
- discuss potential work;
- prepare proposals or estimates; and
- manage a potential client or project relationship.
Our lawful basis is taking steps at your request before entering into a contract and, where appropriate, our legitimate interest in responding to business enquiries and managing potential client relationships.
Scheduling and managing meetings
Where you use Microsoft Bookings, we process your information to arrange, administer and communicate with you about the requested meeting.
Our lawful basis is taking steps at your request before entering into a contract and our legitimate interest in managing business enquiries and appointments efficiently.
Providing our services
Where an enquiry develops into a client relationship, we may use your information to:
- communicate with you;
- prepare and manage proposals and contracts;
- deliver our services;
- administer projects;
- issue and process invoices and payments; and
- maintain appropriate business and accounting records.
Our lawful bases may include performance of a contract, compliance with legal obligations and our legitimate interests in managing Studio Baobab’s business and client relationships.
Operating and protecting the website
We may process technical information to operate, maintain and secure the website, diagnose technical problems, prevent misuse, detect malicious activity and protect our systems.
Our lawful basis is our legitimate interest in maintaining a secure and functional website and protecting our business and users.
Understanding website use
With your consent, we use Google Analytics 4 to understand how visitors find and use the website, measure its performance and improve its content, navigation and user experience.
The lawful basis for the processing of personal data associated with non-essential analytics technologies is your consent.
You may withdraw or change your consent at any time through the cookie settings available on the website.
Complying with legal obligations
We may process or retain personal information where necessary to comply with tax, accounting, regulatory or other legal requirements, or to establish, exercise or defend legal claims.
4. Cookies, analytics and third-party content
The website uses cookies and similar technologies.
These may include:
Strictly necessary technologies, which are required for the website to operate, maintain security or remember your privacy preferences.
Analytics technologies, which help us understand how visitors use the website and assess its performance.
We use Google Analytics 4, an analytics service provided by Google. Google Analytics may process information such as device and browser information, approximate location, pages visited, traffic source, website interactions and pseudonymous identifiers.
Google Analytics and other non-essential analytics technologies should only be activated after you have provided the relevant consent through our cookie controls.
Microsoft Bookings
Our contact page provides access to a Microsoft Bookings calendar.
The embedded Microsoft service is not loaded automatically when you first visit the page. When you choose to load or access Microsoft Bookings, your browser connects to Microsoft and Microsoft may process technical information and use cookies or similar technologies in accordance with its own policies and the configuration of the service.
Embedded Canva content
Some pages on our website may contain content hosted by Canva.
When Canva-hosted content is loaded, your browser connects directly to Canva. Canva may consequently receive technical information such as your IP address, browser and device information and information about the page from which the content was loaded. Canva may also use cookies or similar technologies in connection with its embedded services.
Where consent is legally required for non-essential cookies or similar technologies, these technologies should be controlled through our cookie consent system.
You can accept, reject or change your cookie choices through the cookie settings available on the website. You can also restrict or delete cookies through your browser settings.
5. Who we share your information with
We do not sell your personal information.
We may make limited personal data available to trusted service providers where necessary to operate our website and business, including:
- Hostinger, which provides hosting infrastructure for our website and its database;
- Microsoft, through services including Microsoft 365, Outlook, Exchange Online and Microsoft Bookings;
- Google, through Google Analytics 4 where you have consented to analytics;
- Canva, where third-party Canva content embedded on our website is loaded;
- service providers supporting our business systems, customer relationship management or IT infrastructure;
- accountants, legal advisers and other professional advisers; and
- regulators, courts, public authorities or law-enforcement bodies where disclosure is required by law.
These organisations may act as data processors or as independent data controllers depending on the service they provide and the circumstances.
Where a provider processes personal information on our behalf, we require the information to be processed only for the relevant purposes and subject to appropriate security and contractual safeguards.
6. International data transfers
Some of the service providers we use operate internationally and may process or make personal information accessible from countries outside Spain, the European Economic Area or the United Kingdom.
Where an international transfer is subject to data protection restrictions, we rely on an appropriate legal transfer mechanism.
Depending on the provider and destination, this may include:
- an applicable adequacy decision;
- the EU Standard Contractual Clauses;
- the UK International Data Transfer Agreement or UK Addendum, where applicable; or
- another legally recognised transfer mechanism.
You may contact us if you would like further information about the safeguards applicable to a particular transfer.
7. How long we keep your information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting and reporting obligations.
As a general rule:
- enquiries that do not result in a client relationship, including copies stored in our email systems, CRM and WordPress database through Flamingo, are retained for up to 12 months after the last relevant communication;
- appointment and booking information is retained for as long as necessary to manage the meeting and any resulting enquiry or business relationship;
- client and project information is retained for the duration of the professional relationship and afterwards for as long as required by applicable tax, accounting, contractual and legal obligations;
- Google Analytics event-level data is retained for up to 14 months;
- technical and security logs are retained only for as long as reasonably required for website administration, security and troubleshooting;
- cookie consent records and preferences are retained for the period configured through our consent management system; and
- records relating to privacy requests or complaints may be retained where necessary to demonstrate how the request or complaint was handled.
When personal information is no longer required, we delete it, anonymise it or securely dispose of it.
8. How we protect your information
We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.
Access to personal information is limited to people and service providers who need it for legitimate business purposes.
We also seek to keep the software and systems supporting the website appropriately maintained and secured.
However, no website, email service or internet transmission can be guaranteed to be completely secure.
9. Your data protection rights
Depending on your location, the nature of the processing and the applicable legislation, you may have the right to:
- request access to the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request deletion of your personal information;
- request restriction of how your information is used;
- object to processing based on legitimate interests;
- receive certain personal information in a structured, commonly used and machine-readable format;
- withdraw your consent at any time where processing is based on consent; and
- lodge a complaint with a competent data protection authority.
These rights are not absolute and may be subject to legal limitations or exceptions.
Where we rely on legitimate interests as our lawful basis, you have the right to object to that processing in circumstances provided by applicable data protection law.
To exercise any of these rights, contact us at hello@studiobaobab.com.
We may ask for information reasonably necessary to confirm your identity before processing a request.
10. Complaints
If you have questions or concerns about how Studio Baobab processes your personal information, you can contact us at:
You also have the right to complain directly to a competent data protection authority.
For matters relating to Spain or the European Union, you may contact the Agencia Española de Protección de Datos (AEPD) or the supervisory authority in the EU or EEA country where you live, work or believe an infringement has taken place.
Where UK data protection law applies, you may contact the Information Commissioner’s Office (ICO).
11. Children’s information
Our website and services are intended primarily for businesses and adult users.
We do not knowingly collect personal information from children through the website. If you believe that a child has provided us with personal information, please contact us so that we can review and, where appropriate, delete it.
12. Automated decision-making
Studio Baobab does not use personal information collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
Google Analytics may be used to generate aggregated statistics and insights about website use, but we do not use this information to make automated decisions about individual visitors.
13. Third-party websites and services
Our website contains links to websites and services operated by third parties.
It may also contain third-party embedded content, such as Microsoft Bookings or Canva content.
When you follow an external link or interact with third-party content, the relevant provider may process personal information independently in accordance with its own privacy policies and terms.
Studio Baobab does not control the privacy practices of independent third-party websites and recommends reviewing their privacy information before providing personal data.
14. Changes to this Privacy Policy
We may update this Privacy Policy periodically to reflect changes to our website, services, technologies, suppliers or legal obligations.
The latest version will be published on this page together with the date on which it was last updated.
15. Contact us
For questions about this Privacy Policy or how Studio Baobab handles personal information, contact:
Studio Baobab SL
Calle Jalón, 14
29004 Málaga
Spain