Quiénes somos
Privacy Policy of [YOUR COMPANY NAME]
Effective Date: 08/11/2026
Malapata Studio (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://malapatastudio.com/booknook/ (the “Site”) or use our services.
Please read this policy carefully. If you do not agree with the terms of this policy, please do not access the Site or use our services. This policy should be read alongside our [Cookie Policy]().
1. Data Controller
For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the data controller responsible for your personal data is:
- Company Name: Malapata Studio
- Email: contact@malapatastudio.com
- Postal Address:
2. What personal data do we collect?
We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped as follows:
- Identity Data: Includes first name, last name, username or similar identifier, title, and date of birth.
- Contact Data: Includes billing address, delivery address, email address, and telephone numbers.
- Financial Data: Includes payment card details, bank account information, and transaction history. (Note: We do not store full payment card details. They are processed by our secure payment processors.)
- Transaction Data: Includes details about products or services you have purchased from us.
- Technical Data: Includes IP address, browser type and version, time zone setting, browser plug-in types, operating system and platform, and device information.
- Profile Data: Includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
- Usage Data: Includes information about how you use our Site, products, and services.
- Marketing and Communications Data: Includes your preferences in receiving marketing from us and your communication preferences.
We also collect, use, and share Aggregated Data (such as statistical or demographic data) for any purpose. Aggregated Data is not considered personal data in law, as it does not directly or indirectly reveal your identity.
3. How do we collect your personal data?
We use different methods to collect data from and about you, including through:
- Direct interactions: You may give us your Identity, Contact, and Financial Data by filling in forms, corresponding with us by post, phone, email, or otherwise. This includes personal data you provide when you:
- Create an account on our Site.
- Subscribe to our publications or newsletters.
- Request marketing materials to be sent to you.
- Enter a competition, promotion, or survey.
- Give us feedback or contact us.
- Automated technologies or interactions: As you interact with our Site, we automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. Please see our Cookie Policy for further details.
- Third parties or publicly available sources: We may receive personal data about you from various third parties, such as:
- Analytics providers (e.g., Google Analytics).
- Advertising networks.
- Search information providers.
- Payment and delivery service providers.
4. How do we use your personal data? (Lawful bases)
Under the GDPR, we are required to identify the lawful basis for processing your data. We will only use your personal data when the law allows us to. Most commonly, we will rely on one of the following legal bases:
- Consent: You have given us explicit consent to process your personal data for a specific purpose (e.g., for direct marketing).
- Contractual Necessity: Processing is necessary for the performance of a contract with you (e.g., to provide you with goods or services you have requested).
- Legal Obligation: We are required to process your personal data to comply with a legal or regulatory obligation (e.g., tax and accounting records).
- Legitimate Interests: Processing is necessary for our legitimate business interests, provided your fundamental rights do not override those interests (e.g., to improve our Site, prevent fraud, or send you relevant business communications).
Below is a summary of how we use your personal data:
| Purpose/Activity | Type of Data | Lawful Basis |
|---|---|---|
| To register you as a new customer | Identity, Contact | Performance of a contract with you |
| To process and deliver your order | Identity, Contact, Financial, Transaction, Marketing/Communications | Performance of a contract with you, Legal obligation |
| To manage our relationship with you | Identity, Contact, Profile, Marketing/Communications | Performance of a contract, Legal obligation, Legitimate interests |
| To administer and protect our business (troubleshooting, data analysis, system maintenance) | Identity, Contact, Technical | Legitimate interests, Legal obligation |
| To deliver relevant website content and advertisements | Identity, Contact, Profile, Usage, Marketing/Communications, Technical | Consent, Legitimate interests |
| To use data analytics to improve our Site, products, and customer relationships | Technical, Usage | Legitimate interests (to define types of customers and keep our Site updated) |
| To make suggestions and recommendations about goods or services that may interest you | Identity, Contact, Technical, Usage, Profile, Marketing/Communications | Consent, Legitimate interests |
5. Marketing and Opt-Out
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You will receive marketing communications from us only if you have requested such information, purchased goods/services from us, or provided us with your details and, in each case, you have not opted out of receiving that marketing.
You can ask us to stop sending you marketing messages at any time by:
- Following the “unsubscribe” link included in every marketing email.
- Contacting us directly at contact@malapatastudio.com.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, or other transactions.
6. Disclosures of your personal data
We may share your personal data with the following categories of third parties for the purposes set out in Section 4:
- Service providers: Who provide IT and system administration services, hosting, email delivery, analytics, and customer relationship management.
- Professional advisers: Including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
- Payment processors: To securely process your transactions (we do not store your full payment details).
- Regulators and authorities: Where we are required to do so by law or to enforce our legal rights.
- Third parties in a business transfer: If we sell, merge, or restructure our business, we may transfer your data to the new owner, subject to confidentiality agreements.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
7. International transfers
We may transfer, store, and process your personal data outside of the [European Economic Area (EEA) / UK]. In such cases, we will ensure that an adequate level of protection is provided for your data by implementing at least one of the following safeguards:
- Transferring data to countries that have been deemed to provide an adequate level of protection by the European Commission.
- Using specific contracts approved by the European Commission (Standard Contractual Clauses) which give personal data the same protection it has in Europe.
If you would like further information on the specific mechanism used by us when transferring your personal data out of the EEA, please contact us.
8. Data security
We have implemented appropriate technical and organizational security measures designed to protect your personal data from accidental loss, unauthorized access, use, alteration, or disclosure. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
9. Data retention
We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.
To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data, and whether we can achieve those purposes through other means.
In some circumstances, you can ask us to delete your data (see Section 10 below for further information). We may also anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
10. Your legal rights
Under the GDPR, you have the following rights regarding your personal data:
- Right to access: You have the right to request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Right to rectification: You have the right to request correction of any incomplete or inaccurate personal data we hold about you.
- Right to erasure (‘Right to be forgotten’): You have the right to request deletion of your personal data where there is no good reason for us continuing to process it.
- Right to restrict processing: You have the right to request the suspension of processing your personal data in certain scenarios (e.g., if you contest its accuracy).
- Right to data portability: You have the right to request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Right to object: You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or that of a third party), including for direct marketing purposes.
- Right to withdraw consent: If we are relying on consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.
- Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority (e.g., in Spain, the AEPD) if you believe we have not complied with applicable data protection laws.
To exercise any of these rights, please contact us at [YOUR CONTACT EMAIL]. You will not usually have to pay a fee to exercise these rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. We may also need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
11. Cookies and tracking technologies
Our Site uses cookies and similar tracking technologies to distinguish you from other users, improve your experience, and analyze how our Site is used. You can find more detailed information about the cookies we use and how to manage your preferences in our [Cookie Policy](Cookie Policy (UE) – Book Nook).
12. Children’s privacy
Our Site and services are not intended for children under [16 years of age]. We do not knowingly collect personal data from children under this age. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us, and we will take steps to remove that data.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the new policy on this page and updating the “Effective Date” at the top. We encourage you to review this policy periodically to stay informed about how we are protecting your information.
14. Contact us
If you have any questions, comments, or requests regarding this Privacy Policy or our data processing practices, please do not hesitate to contact us:
- Email: contact@malapatastudio.com
- Postal Address: