Privacy policy

Last updated: June 2026

At Marcasitios we take the privacy of you and the people in the photographs you entrust to us very seriously. This policy explains what data we process, for what purpose and what your rights are under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

• Owner: Iván Márquez
• Tax ID (NIF): 40594432F
• Address: Carrer Creu de la Mà 1, 17600 Figueres (Girona), España
• Email: hola@marcasitios.es

2. Data we process

• Account data: email and encrypted password (or social login) when you sign up.
• Order data: name, email, event date, order style and format, guest names.
• Payment data: handled directly by Stripe Payments Europe Ltd.; we never store full card details.
• Guest photographs: images you upload so we can illustrate each person.
• Communications: order chat messages and related emails.

3. Processing of photographs (important)

The photographs you upload are the most sensitive information we process. We undertake the following commitments:

• Sole purpose: photos are used exclusively to create the illustrations for your order. They are not used for marketing, social media, AI model training or any other purpose.
• No transfer to third parties: we do not share photographs with third parties unrelated to the service. The only possible accesses are providers strictly necessary for secure storage (EU hosting), acting as data processors under contract pursuant to art. 28 GDPR.
• Restricted access: only the Marcasitios team that produces the illustrations has access, using individual credentials and authentication.
• Deletion: photographs are deleted from our systems within a maximum of 30 calendar days from delivery of the digital file or from order cancellation. You may request early deletion by writing to hola@marcasitios.es.
• Third-party consent: by uploading photographs of other people, you declare that you have their informed consent for processing by Marcasitios for the stated purpose, in accordance with art. 6.1.a GDPR. You are responsible for obtaining such consent.
• Minors: if the photographs include children under 14, you must have the express consent of their parents or legal guardians.

4. Purposes and legal basis

• Order management and digital file delivery: performance of the contract (art. 6.1.b GDPR).
• Invoicing and tax obligations: legal obligation (art. 6.1.c GDPR).
• Processing of guest photographs: consent of the data subjects, obtained and guaranteed by the customer placing the order (art. 6.1.a GDPR).
• Customer support and order communications: legitimate interest (art. 6.1.f GDPR).
• Cookies and analytics: user consent (art. 6.1.a GDPR). See Cookie Policy.

5. Retention periods

• Guest photographs: up to 30 days after delivery of the digital file.
• Order and billing data: the period required by tax and commercial regulations (minimum 6 years — Spanish Commercial Code).
• User account: while the account remains active; you may request its deletion at any time.
• Communications: up to 1 year after order completion, unless a legal obligation applies.

6. Recipients and data processors

To provide the service we rely on the following data processors, with whom we have the corresponding contract:

• Hosting provider (EU): database and files.
• Stripe Payments Europe Ltd. (Ireland): payment processing.
• Transactional email provider: sending order notifications.

We do not carry out international transfers outside the European Economic Area. Should we do so, we will guarantee standard contractual clauses or an adequate level of protection.

7. Your rights

You may exercise the following rights at any time by emailing hola@marcasitios.es with your name and a copy of your ID or equivalent document:

• Access, rectification and erasure.
• Objection and restriction of processing.
• Data portability.
• Withdrawal of consent at any time, without retroactive effect.
• Lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your rights have not been respected.

8. Security

We apply appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), encrypted storage, role-based access control policies, backups and activity logs.