Privacy policy

Controller

The data controller is Imad El Malki Jaddi, trading as nineproject. You can contact me at contacto@nineproject.es.

Data and purposes

The form processes the email address, subject and message you enter, for the sole purpose of answering your enquiry or preparing the work you request.

To prevent abuse, the IP address is transformed with an HMAC before requests are counted: what is stored cannot be turned back into the original address. This site uses no cookies and no third-party storage.

The site runs first-party analytics that record only the kind of event (a page viewed, a message sent or a link to the portfolio) and, for a page view, its path. No IP address, user agent or session identifier is stored, and nothing that could recognise the same person twice. No third party is involved either: the counters are written by the same service that serves the page.

Legal basis

Answering an enquiry about a possible engagement relies on taking pre-contractual steps at your request. Other enquiries and service security rely on the legitimate interests of replying, keeping the site available and preventing abuse. There is no consent checkbox because the requested submission does not rely on consent.

Providers and recipients

Cloudflare provides the infrastructure, rate limiting and technical email delivery. The mailbox provider stores the received conversation. They act as processors or necessary categories of recipient for each feature; data is not sold and is not used for profiling.

International transfers

The database that counts request frequency is created in Cloudflare's European jurisdiction. Received mail stays in the mailbox provider's systems, which may process data outside the European Economic Area relying on an adequacy decision or standard contractual clauses. You can ask the controller for information about the safeguards that apply.

Retention

Enquiries and related correspondence are kept only as long as needed to reply and for no longer than 12 months, unless a legal obligation or subsequent relationship justifies another period. HMAC rate-limit counters stop having any effect once their window expires, which lasts 10 minutes, and the row itself is deleted on the first request after that expiry.

Your rights

You can request access, correction, erasure, objection, restriction or portability where applicable by writing to contacto@nineproject.es. You may also withdraw consent if a future operation ever relies on it, without affecting earlier processing.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (www.aepd.es).