Privacy Policy

1. Data Controller

Controller: Música, Arte, Innovación y Kreatividad, S.L. (operating as maik. studio).

Tax ID (NIF): B75939629.

Registered office: Paseo de la Florida 6, 5th floor (Left), 33012 Oviedo, Asturias, Spain.

Registered at the Asturias Mercantile Registry. Incorporation date: 3 April 2025.

Operations: Barcelona, Spain.

Contact: team@wearemaik.com.

2. Data we collect

We process the following categories of personal data:

• Identification and contact data submitted via our contact form: name, email address, optional event type, and the message you write.
• Email address submitted via our newsletter form.
• Connection data automatically logged for security and operations: IP address, browser, operating system, and timestamp.
• Technical error data (browser, operating system, page and error trace) when something on the Site fails.
• Browsing and usage data (pages visited, clicks, scrolling, device and approximate location), only if you accept analytics cookies.
• Cookies and similar technologies, only those strictly necessary or those for which you have given consent (see section 6).

3. Purposes and legal basis

• Replying to enquiries you send us. Legal basis: pre-contractual measures and your request (Art. 6.1.b GDPR).
• Sending newsletter emails about events and experiences. Legal basis: your explicit consent (Art. 6.1.a GDPR), revocable at any time.
• Operating the website and protecting it from abuse (rate limiting, spam filtering). Legal basis: our legitimate interest (Art. 6.1.f GDPR).
• Detecting and fixing technical errors (Sentry) and measuring visits in aggregate without cookies (Cloudflare Web Analytics). Legal basis: our legitimate interest (Art. 6.1.f GDPR). The session replay attached to an error is only enabled with your consent.
• Measuring and improving how the Site is used: visit statistics with Google Analytics 4, and heatmaps and session recordings with Microsoft Clarity. Legal basis: your consent (Art. 6.1.a GDPR), which you can withdraw at any time.
• Complying with legal obligations. Legal basis: Art. 6.1.c GDPR.

4. Data retention

Contact form submissions: kept for the time strictly necessary to respond and, where applicable, for the legal terms relating to civil and commercial liability (up to 5 years).

Newsletter subscribers: kept until you unsubscribe.

Server logs: kept for a maximum of 90 days unless required for security investigation.

5. Data recipients and processors

We rely on the following processors who process data on our behalf under written contracts compliant with Art. 28 GDPR:

• Hostinger International Ltd.: VPS hosting (servers in the EU).
• Cloudflare, Inc.: CDN, DNS and security layer, plus Cloudflare Web Analytics, an aggregate visit count that uses no cookies (data may transit through global infrastructure under EU SCCs and DPF where applicable).
• Resend Inc.: delivery of contact form emails and the newsletter (EU region used by default).
• Functional Software, Inc. (Sentry): error monitoring and, only with your consent, a replay of the session in which an error occurs, with all text masked and media blocked (EU region).
• Google Ireland Limited (Google Analytics 4): web analytics, only if you accept analytics cookies (Google LLC may access data from the United States, under EU SCCs and DPF).
• Microsoft Ireland Operations Limited (Microsoft Clarity): heatmaps and session recordings to understand how the Site is used, only if you accept analytics cookies, with form fields and sensitive content masked (Microsoft Corporation may process data in the United States, under EU SCCs and DPF).

6. Cookies

Without your consent we only store what the Site needs to work: your cookie choice (maik-cookie-consent, kept in your browser's local storage) and your language (NEXT_LOCALE cookie). Cloudflare Web Analytics counts visits without cookies.

You can change or withdraw your consent at any time from the "Cookies" link in the footer, which reopens the banner. If you withdraw it, these tools stop loading from the next page load; you can delete cookies already set from your browser settings.

If you accept analytics cookies, the following are set:

• Google Analytics 4: _ga and _ga_* (tell visitors and sessions apart; up to 2 years).
• Microsoft Clarity: _clck (identifies the visitor; 1 year), _clsk (groups the pages of one session; 1 day) and CLID (identifies a browser's first visit; 1 year).

7. International transfers

Some processors are based in the United States or belong to groups headquartered there (Google, Microsoft). Where data is transferred outside the EEA, we rely on EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, as published by the providers.

8. Your rights

Under GDPR and LOPDGDD you have the right to:

• Access, rectify, erase, port, restrict or object to the processing of your personal data.
• Withdraw your consent at any time, without affecting prior lawful processing.
• Lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es if you believe your rights have been infringed.

9. How to exercise your rights

You can exercise any of these rights free of charge by emailing team@wearemaik.com with proof of identity. We will respond within one month.

10. Security

We apply appropriate technical and organisational measures: HTTPS-only connections, encrypted disk storage, restricted access, strong authentication, and regular security updates.

11. Changes

We may update this policy to reflect changes in our practices or applicable law. The "Last updated" date at the top will be revised accordingly. Material changes will be communicated via the website.

12. Contact

For any privacy-related question, write to team@wearemaik.com.