Privacy Policy · Onetouch

This Privacy Policy explains how Onetouch Studio S.L. (“Onetouch”, “we”, “us”) processes personal data in connection with the website at https://onetouch.hn, the contact form, and any related communications. It is written to comply with the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”), the Spanish LOPDGDD (LO 3/2018), Brazil's LGPD (Lei 13.709/2018), the US CAN-SPAM Act, Canada's CASL, the UK GDPR + Data Protection Act 2018, and the ePrivacy Directive (2002/58/EC, as amended).

1. Data controller

Controller: Onetouch Studio S.L. — Tax ID B-XXXXXXXX — registered office Madrid, 28000, Spain. Registry: Registro Mercantil de Madrid, Tomo X, Folio X, Hoja M-XXXXXX.

Privacy contact: privacy@onetouch.hn. A Data Protection Officer can be reached at the same address.

2. Data we collect

We process the following categories of personal data:

Identification and contact data you provide voluntarily through the contact form: full name, email address, company name, telephone number (optional), project description, optional file attachment.
Inquiry context derived from the same submission: requested service, indicative budget range, indicative deadline, channel through which you heard about us, terms-and-policies acceptance flag.
Technical metadata captured automatically when you submit the form: public IP address, approximate geolocation (country, region, city) derived from the IP, Internet Service Provider, browser user agent, device timezone and UTC offset, referrer URL, landing-page URL, submission timestamp, current page URL.
Communications history if you reply to our auto-acknowledgement or correspond with us by email.

We do not collect special categories of data (Art. 9 GDPR) and request that you do not include sensitive personal information in your project brief.

3. Purposes and legal bases

Handle your inquiry and engage in pre-contractual contact — legal basis: pre-contractual measures, GDPR Art. 6(1)(b); and your consent, Art. 6(1)(a) (terms-and-policies checkbox).
Send a transactional auto-acknowledgement confirming receipt — same legal bases.
Protect the form against abuse and ensure availability (rate limiting, honeypot, file content checks) — legitimate interests, GDPR Art. 6(1)(f), in operating a secure submission channel.
Comply with legal obligations (tax, accounting, response to lawful requests from competent authorities) — Art. 6(1)(c).

We do not use your data for profiling, behavioural advertising, or automated decision-making producing legal effects.

4. Recipients

We share personal data only with the following recipients, each acting as a processor under a written Data Processing Agreement:

Resend Inc. — transactional email delivery and inbound storage. United States, with EU/UK presence; transfers under EU Standard Contractual Clauses + UK IDTA.
Vercel Inc. — website hosting, edge runtime, server function execution, Web Analytics (privacy-friendly, cookieless). United States, with EU presence; transfers under EU Standard Contractual Clauses + UK IDTA.
ipapi.co — IP-to-location resolution (server-side, 2-second timeout, fail-soft). Operated from the EEA.
Sanity.io — content management for editorial content (no contact-form data). EU and US regions; transfers under SCCs.

We disclose data to public authorities only when compelled by a valid legal request and after assessing its lawfulness.

5. International transfers

Operational handling of inquiries may occur from our Honduran office. Honduras is not a country covered by an adequacy decision of the European Commission. Transfers from the EU/EEA, the United Kingdom or Switzerland to Honduras are protected by the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented by appropriate technical and organisational measures (encryption in transit, access controls, contractual confidentiality undertakings on all staff).

6. Retention

Contact-form submissions and related communications are retained for 12 months from the last contact, after which they are securely deleted. Where a contractual relationship arises, retention follows the tax and commercial law obligations applicable to Onetouch Studio S.L. (six years for accounting records under Spanish Commercial Code Art. 30).

Technical logs (IP, user agent, request timestamps) are kept for a maximum of 12 months for security and abuse-prevention purposes.

7. Your rights

You are entitled to exercise the following rights, free of charge, at any time:

Access the personal data we hold about you (GDPR Art. 15).
Rectify inaccurate or incomplete data (Art. 16).
Erase data when one of the grounds in Art. 17 applies.
Restrict processing in the cases listed in Art. 18.
Portability of data you provided to us, in a structured, machine-readable format (Art. 20).
Object to processing based on legitimate interests (Art. 21).
Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
Lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

To exercise any of these rights, write to privacy@onetouch.hn. We respond within one month (extendable by two further months for complex requests, with notice).

8. Security

We apply state-of-the-art technical and organisational measures appropriate to the risk: TLS 1.2+ in transit, encrypted storage at rest, least-privilege access controls, audit logging, regular dependency review, secure development practices, mandatory contractor confidentiality, and incident-response procedures. In the unlikely event of a breach affecting your rights, we will notify the supervisory authority within 72 hours where required and you directly when the risk is high.

9. Children

This website and our services are not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Policy from time to time. The “Last updated” date at the top of the page reflects the latest revision. Material changes will be communicated through the website and, where required by law, directly to affected individuals.

11. Contact

Privacy questions and rights requests: privacy@onetouch.hn. General enquiries: hello@onetouch.hn. Postal address: Madrid, 28000, Spain.