The Google tag is not downloaded and receives no data until you accept it.
AcidSpain / LegalPrivacy
Privacy
and control
A complete notice about collection, cookies, providers, and rights. You decide whether Analytics is enabled.
Effective and updated: September 2, 2026We do not sell personal information or share it for cross-context behavioral advertising.
We explain how to exercise GDPR and California rights, including through an authorized agent.
Who is responsible for your information
AcidSpain LLC (“AcidSpain,” “we,” “us”) is the controller or business responsible for the processing described in this notice. Address: 6303 Waterford District Dr STE 400, Miami, Florida 33126, United States. Email: info@acidspain.com. Phone: +1 (786) 505-5398.
This notice covers only the public website. A relationship with talent, clients, employees, or vendors may be governed by a specific notice that controls that processing.
We minimize collection, do not use this site for cross-context behavioral advertising, do not sell personal information, and do not make decisions with legal or similarly significant effects based solely on automated processing. No data protection officer has been designated for this limited website processing; questions are handled through the email above.
Information we may collect when you visit or contact us
This notice is provided at or before collection. We will not use a category for a materially different, incompatible purpose without giving a new notice and, where required, obtaining a new choice.
| Category and examples | Source | Purpose and basis | Retention |
|---|---|---|---|
| Technical request data. IP address, requested URL, date and time, browser, device, headers, errors, and security signals. | Your browser and hosting infrastructure. | Deliver, diagnose, and secure the site; prevent abuse. Legitimate interest in operating a safe, reliable service. | The period configured in the hosting platform and only while needed for delivery, diagnostics, security, or a legal hold. |
| Approximate location. Country, region, or city inferred from IP; never precise geolocation. | Hosting infrastructure and, only if accepted, Google Analytics. | Security, technical localization, and aggregate statistics. Legitimate interest for security; consent for Analytics. | As part of technical logs above; in Analytics, user and event data for 2 months. |
| Form inquiry. Name, email, subject, message, and optional phone number that you choose to send. | Directly from you when you select “Send message.” | Forward the inquiry to AcidSpain, reply, assess a service request, and maintain correspondence. Steps requested before a contract or legitimate interest in responding. | FormSubmit may retain the submission for up to 30 days. AcidSpain retains correspondence for up to 24 months after the last substantive contact; longer only where a contract, law, or legal claim requires it. |
| Form anti-spam protection. reCAPTCHA token, IP address, and technical browser, device, and interaction signals. | Your browser and Google reCAPTCHA when you use the contact page. | Confirm that a submission is legitimate, prevent abuse, and protect the form. Legitimate interest in service security. | AcidSpain uses the token once and does not retain it after verification. Google applies the retention described in its policy and reCAPTCHA configuration. |
| Preferences on your device. Language, notice version, Analytics choice, date, and GPC status. | Your choice or browser configuration. | Remember choices, honor opt-outs, and evidence the choice. Functional necessity and legitimate interest in respecting preferences. | Privacy choice: 180 days. Language: 12-month cookie and local storage until changed or browser data is cleared. |
| Optional Analytics. Pages and events, browser, device, traffic source, approximate area, and Analytics identifiers. | Your browser and Google Analytics, only after acceptance. | Measure aggregate visits and performance. Consent. | Cookies: up to 180 days. GA4 user and event data: 2 months; aggregate reports without an identifier may last longer. |
What you must provide
Browsing does not require contact information. In the form, name, email, subject, and message are needed to deliver and answer the inquiry; phone is optional. Fields are not transmitted until you select “Send message.” Do not send credentials, identity documents, highly sensitive information, or unnecessary third-party information.
Legal bases, rights, and safeguards
Legal bases and legitimate interests
- Delivery and security: legitimate interest in operating a secure, available site that resists abuse (GDPR Art. 6(1)(f)).
- Necessary preferences: legitimate interest in remembering and honoring choices and, where applicable, compliance with privacy obligations (Art. 6(1)(f) and 6(1)(c)).
- Analytics: your consent only (Art. 6(1)(a)). Withdrawal is as easy as acceptance.
- Inquiries: steps you request before a contract when asking about services (Art. 6(1)(b)), or legitimate interest in answering other communications (Art. 6(1)(f)).
- Abuse prevention: legitimate interest in protecting the form with reCAPTCHA and preventing spam or automated submissions (Art. 6(1)(f)).
- Obligations and claims: legal obligation or legitimate interest in establishing, exercising, or defending legal claims (Art. 6(1)(c) and 6(1)(f)).
When relying on legitimate interests, we assess necessity, impact, and reasonable expectations and apply minimization, limited retention, and objection rights. You may ask for information about that assessment.
Your rights
Where the GDPR applies, you may request access, correction, deletion, restriction, portability, and objection, and withdraw consent without affecting earlier lawful processing. We normally respond within one month; a complex request may be extended by up to two additional months with notice and reasons. You may also complain to the supervisory authority where you live, work, or where the alleged infringement occurred.
Information comes from you, your device, or the providers described here; we do not buy visitor data. There is no solely automated decision-making or profiling with legal or similarly significant effects on this site.
Notice for California residents
This section applies to the extent AcidSpain is a “business” subject to the CCPA. During the preceding 12 months, the public-site practices fall within these statutory categories:
| CCPA category | Examples and sources | Purpose | Disclosed to | Sold / shared |
|---|---|---|---|---|
| Identifiers and customer-record information | IP; name, email, optional phone, and inquiry content if you submit the form. Directly from you or your device. | Deliver and secure the site; forward and respond to inquiries. | Vercel; Google reCAPTCHA on contact; FormSubmit; the parties’ email providers; authorities where legally required. | No / No. |
| Internet or other electronic-network activity | URL, pages, date, browser, device, referrer, errors, anti-spam signals on contact, and consented Analytics events. From your device, Vercel, and Google. | Delivery, security, abuse prevention, diagnostics, and consented statistics. | Vercel; Google reCAPTCHA on contact; Google Analytics only after acceptance. | No / No. |
| Non-precise geolocation | Approximate area inferred from IP. From Vercel and, with consent, Google. | Security, technical localization, and aggregate measurement. | Vercel; Google only after Analytics acceptance. | No / No. |
We do not intentionally collect sensitive personal information through the site, use it to infer characteristics, or engage in a use subject to the right to limit. We offer no financial incentives. We do not sell or share personal information of consumers of any age and have no actual knowledge of doing so for anyone under 16.
Rights and how to exercise them
Where applicable, you may request the categories, sources, purposes, recipients, and specific pieces; access, correct, or delete information; opt out of sale or sharing; limit sensitive-information use; and receive no retaliation or discriminatory treatment. Because we do not sell, share, or use sensitive information in a limitable way, no separate “Do Not Sell or Share” or “Limit” link is needed. GPC is honored automatically.
Send a request to info@acidspain.com or call +1 (786) 505-5398. To verify, we may match the email, nature, and context of an interaction against our records; we request only proportionate information and do not require government ID unless reasonably necessary. An authorized agent must provide signed authorization or valid power of attorney, and we may confirm directly with you unless law prevents it. We normally respond within 45 days and give notice of any permitted extension.
Who processes information and where
| Recipient | Role and information | When |
|---|---|---|
| Vercel Inc. | Hosting, delivery, technical logs, diagnostics, and security. | Necessary when any page is requested. |
| Google LLC / Google Analytics | Page and event analytics, device, referrer, approximate area, and identifiers. | Only after Analytics acceptance. |
| Google LLC / reCAPTCHA | Token, IP address, and technical browser, device, and interaction signals used to detect abuse. | A necessary measure when the contact form is used; independent of Analytics. |
| FormSubmit | Receipt, spam filtering, and forwarding of name, email, optional phone, subject, message, and technical metadata to AcidSpain. | Only when “Send message” is selected; it may retain the submission for up to 30 days. |
| Email providers | Transport and storage of the inquiry forwarded to AcidSpain. | Only after the form is submitted. |
| Authorities or advisers | Information strictly necessary to comply with law or protect rights. | Only for a valid obligation or claim. |
AcidSpain operates from the United States. Where the GDPR, UK regime, or another law restricts an international transfer, we use the mechanism documented in the provider agreement, including adequacy decisions or Standard Contractual Clauses and UK addenda where applicable. You may request a copy or information about a safeguard at info@acidspain.com; commercial or security details may be redacted.
See the Vercel Data Processing Addendum, Google Analytics Data Processing Terms, Google Privacy Policy, and FormSubmit Privacy Policy. We apply access controls, minimization, encryption in transit, and reasonable updates, although no system eliminates every risk.
GPC, Do Not Track, and updates
We respond to GPC as explained above. Browsers may also send “Do Not Track” (DNT), but there is no uniform standard that tells sites how to interpret it; this site does not change behavior specifically for DNT. Analytics nevertheless remains blocked until consent and can be rejected or withdrawn at any time.
Without Analytics, we do not authorize measurement of activity over time and across different services. Google reCAPTCHA processes only the security signals needed when the contact page is used; if you accept Analytics, Google may also process the described activity for configured measurement. Advertising signals remain disabled.
Changes will be posted here with a revised date. For a material change, we will provide a prominent notice before it takes effect; if it changes a purpose or saved consent, we will request a new choice. Effective date: September 2, 2026.
How to contact privacy
AcidSpain LLC
6303 Waterford District Dr STE 400
Miami, Florida 33126
United States
Email: info@acidspain.com
Phone: +1 (786) 505-5398
Use “Privacy request,” identify the right and applicable jurisdiction, and provide enough information to locate the interaction. Do not send identity documents in the first message. If we deny all or part of a request, we will explain the reason and available appeal rights where law requires.