Last updated: June 2026 · EU Regulation 2016/679 and Spanish Law 3/2018
At bodioagency we take your privacy seriously. This policy explains what data we collect, why, how long we keep it and what rights you have, in accordance with the GDPR and the LOPDGDD.
| Field | Information |
|---|---|
| Controller | Claire Bicong (bodioagency) |
| NIE (Tax ID) | Z2376236L |
| Address | Calle Manuel Candela 6, Camins al Grau, 43021 Valencia, Spain |
| Contact email | cb@bodioagency.com |
| Website | www.bodioagency.com |
| DPO | Not required (sole trader). Privacy queries to the contact email above. |
Depending on how you interact with our website, we may collect the following data:
We process your data for the following purposes and legal bases:
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Responding to enquiries and contact requests | Name, email, message | Legitimate interest (6.1.f) |
| Managing client contracts | Contract and billing data | Contract performance (6.1.b) |
| Sending newsletters and marketing communications | Name, email | Consent (6.1.a) |
| Compliance with legal and tax obligations | Billing and accounting data | Legal obligation (6.1.c) |
| Website analytics and improvement | Anonymised browsing data | Legitimate interest (6.1.f) |
| Social media and digital marketing management | Public social profile data | Legitimate interest (6.1.f) |
Important: where processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
| Data type | Retention period | Reason |
|---|---|---|
| Enquiries and contact requests | 1 year from response | Legitimate interest / closure of enquiry |
| Client data (contract) | 5 years after contract end | Commercial obligations (Spanish Commercial Code, Art. 30) |
| Billing data | 4 years | Tax obligations (Spanish General Tax Law) |
| Newsletter and marketing | Until consent is withdrawn | User consent |
| Browsing data (analytics) | 14 months (GA4 setting) | Statistical analysis |
| Security logs | 12 months | Security and fraud prevention |
Once retention periods expire, data will be securely deleted or anonymised.
bodioagency does not sell or share your data with third parties, except in the following circumstances:
| Provider | Service | Country | Safeguards |
|---|---|---|---|
| Google LLC | Google Analytics, Gmail, Workspace | USA | EU-US DPF / SCCs |
| Vercel Inc. | Web hosting | USA | SCCs / EU-US DPF |
| Calendly LLC | Meeting scheduling and booking | USA | SCCs / EU-US DPF |
| Mailchimp / Brevo | Newsletter (if applicable) | USA | DPF / SCCs |
| Stripe / PayPal | Payment processing (if applicable) | USA | SCCs / Binding Rules |
All processors are contractually obliged to process data only on bodioagency's instructions and to implement appropriate security measures.
Some of our service providers (such as Google) are located outside the European Economic Area (EEA). These transfers are carried out with appropriate safeguards:
You can request a copy of the applicable safeguards by contacting us at cb@bodioagency.com.
The GDPR grants you the following rights over your personal data:
Find out what data we hold about you and obtain a copy.
Correct inaccurate or incomplete data.
Request deletion of your data ("right to be forgotten").
Restrict processing of your data in certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing of your data, including direct marketing.
Not be subject to decisions based solely on automated processing.
Withdraw consent at any time, without retroactive effect.
How to exercise your rights:
Send your request to cb@bodioagency.com, including: your full name, a copy of your ID/passport, and the right you wish to exercise. We will respond within 1 month (extendable to 3 months for complex cases, with prior notice).
You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.
bodioagency has implemented the technical and organisational measures required to ensure the security of personal data and prevent its alteration, loss, unauthorised processing or access, in accordance with Art. 32 GDPR. Measures in place include:
In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you within 72 hours, in accordance with Art. 34 GDPR.
This Website is not directed at children under the age of 14 (the minimum digital consent age in Spain under LOPDGDD Art. 7). If you are under 14, please do not provide us with your personal data.
If we become aware that we have collected data from a minor without the consent of their legal guardian, we will delete it immediately.
bodioagency may update this Privacy Policy to reflect legislative changes, case law developments or industry practice. Material changes will be communicated to affected users where legally required.
The most recent version will always be available on this page. The date of the last update is shown at the top of this document.
For any questions about this Privacy Policy or to exercise your rights:
bodioagency – Claire Bicong
📧 cb@bodioagency.com
🌐 www.bodioagency.com
📍 Valencia, Spain
If you believe your data is not being processed in accordance with applicable law, you have the right to lodge a complaint with the supervisory authority:
Agencia Española de Protección de Datos (AEPD)
🌐 www.aepd.es
📞 901 100 099
📧 internacional@aepd.es