Privacy Information

Controller and contact

The controller is Dream Figures Group S.L. (B88146717), as confirmed by the operator. Registered office: Calle Platino 5, 2D, 28850 Torrejón de Ardoz, Madrid, España. The legal text must be validated before publication. Privacy enquiries and rights requests can be directed to info@dream-figures.com. No data protection officer appointment is asserted.

Email enquiries and business contacts

If you email us, your address, business contact details and the information you choose to include may be processed to assess and answer your enquiry and discuss a potential collaboration. Please avoid sending unnecessary sensitive information. Removing the website form does not remove the processing associated with email correspondence.

Technical requests and access records

Serving the site involves technical information such as IP address, requested URL, time and browser request data. Hosting, proxy or security systems may record this information. The actual log fields, purposes, access controls and retention criteria must be confirmed for the deployed environment; production infrastructure has not been audited here.

Legal bases — validation required

The operator must validate the basis for each actual processing activity. Possible bases for enquiries include pre-contractual steps requested by the individual or a documented legitimate interest for relevant business communications, depending on the circumstances. Any legal obligations and security purposes must be separately assessed. These are proposals for validation, not a claim that consent is obtained merely by browsing.

Providers and retention policy — implementation pending

The operator has identified Clouding.io for hosting, Cloudflare as the fronting CDN/security provider, and Microsoft email through GoDaddy. Processing agreements, contractual roles, subprocessors, processing locations and any international transfers or safeguards still require validation.

The starting policy selected for this project is to delete enquiries that do not lead to a contractual relationship 24 months after the last meaningful exchange. Active business contacts are reviewed annually; unnecessary contact data should be removed no later than 24 months after the relationship ends, unless a documented legal obligation or claim requires preservation.

Ordinary access/security logs under the operator’s control have a target retention of 30 days. Provider-specific retention must be separately documented. Evidence needed for an incident or legal responsibility must be isolated, access-restricted and reviewed until its justified preservation ends. Contract, tax and accounting records require their own applicable legal retention rules. These are project policy choices, not universal statutory periods. Actual deletion, backup cycles and provider settings must be implemented and verified before claiming compliance.

Cookies, browser storage and clipboard

The application code does not introduce analytics, advertising pixels, remote fonts, embedded video or cookie-based tracking. The language is encoded in the URL and gallery state is held in memory. Copy Email writes the displayed address to the clipboard only after you activate it; it does not read your clipboard. Any cookies or identifiers added by a production CDN/security provider must be checked again before release. A consent banner is not added for tools that are not present.

Your rights

Where applicable, you may request access, rectification, erasure, restriction, portability or object to processing, and withdraw consent where it is the relevant basis. Contact info@dream-figures.com, describing your request; identity may need to be verified proportionately. You may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority. The operator must validate the rights-handling procedure before release. Requests must be addressed under the applicable legal deadlines, normally within one month; extensions require legal justification.