Privacy policy

1. Data controller

• Data controller: MUVO Cultura Digital S.L. (currently being incorporated)
• Tax ID (NIF/CIF): [pending assignment upon incorporation]
• Address: Calle de los Embajadores, 29, 2º F, 28012 Madrid, Spain
• Email: hola@muvo.es
• Data Protection Officer: appointing a DPO is not mandatory under article 37 of the GDPR given the current volume and nature of processing; any privacy-related query can be sent directly to hola@muvo.es

2. Principles we apply

We process personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability, as set out in article 5 of the GDPR. In practice, this means we only collect the data we need for each specific purpose and never use it for purposes other than those for which it was collected.

3. What data we process and why

Personal data processing through this website is organised around the following purposes:

• Handling contact and information requests: when you write to hola@muvo.es or use the website's contact form, we process your name, email, the institution you represent, and the content of your message, in order to respond to your request.
• Booking commercial demos: if you book a meeting through Calendly (calendly.com/muvo/30min), we process the data you provide during that process (name, email, institution, and time availability) to manage the appointment.
• Access to the content management panel: if you register or access cms.muvo.es as a client institution, the processing of data associated with your account is governed by the specific terms of the contracted service and by this same policy where applicable.
• Web analytics: we use Google Analytics to understand, in aggregate form, how the website is used (pages visited, time spent, traffic source) and to improve its functioning and content.
• Advertising and conversion measurement: we use Google Ads to measure the effectiveness of our institution-acquisition campaigns and show relevant commercial communications.
• Compliance with legal obligations: we retain certain information when required by applicable commercial, tax, or accounting regulations.

4. Legal basis for processing

The legal basis legitimising these processing activities is, depending on the case: your express consent (for example, when accepting analytics or advertising cookies, or when voluntarily sending us a contact form); the performance of pre-contractual steps at your request (for example, when booking a commercial demo); the performance of a contract where a service relationship exists with your institution; and MUVO's legitimate interest in maintaining and improving the website, provided such interest does not override your fundamental rights and freedoms.

5. Retention periods

We retain data from contact or demo booking requests for as long as necessary to handle your request and, afterwards, for as long as an active or potential commercial relationship exists with you or your institution. Data linked to the contractual relationship with client institutions is retained for the duration of the contract and, after its termination, for the periods required by applicable commercial, tax, and accounting regulations (generally up to six years under the Spanish Commercial Code, without prejudice to longer periods imposed by other regulations). Analytics data is retained according to Google Analytics' default periods, currently 14 months.

6. Recipients and data processors

To provide the service and operate the website, MUVO relies on certain providers acting as data processors, subject to the guarantees required under article 28 of the GDPR:

• Vercel Inc. — hosting and deployment infrastructure provider for this website.
• Google Ireland Limited / Google LLC — provider of the Google Analytics and Google Ads services used for analytics and advertising purposes.
• Calendly LLC — provider of the commercial appointment booking tool.
• MUVO does not sell or transfer personal data to third parties for purposes other than those described in this policy, except where legally required.

7. International transfers

Some of the providers mentioned above (including Vercel, Google, and Calendly) may process data outside the European Economic Area, mainly in the United States. In such cases, processing takes place under the safeguards set out in Chapter V of the GDPR, in particular through the European Commission's standard contractual clauses or other transfer mechanisms recognised as adequate under applicable law.

8. Your rights

At any time, you can exercise, free of charge, the following rights recognised under the GDPR by writing to hola@muvo.es and identifying yourself appropriately:

• Right of access: to know what personal data of yours we process.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data when it's no longer necessary for the purposes for which it was collected.
• Right to object: to object to the processing of your data in certain circumstances, including objecting to processing for direct marketing purposes.
• Right to restriction of processing: to request that the processing of your data be temporarily restricted in certain cases.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format, or to request its direct transmission to another controller.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
• If you believe your request has not been properly handled, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Minors

This website is aimed at professionals and representatives of cultural, heritage, religious, and educational institutions of legal age, with the capacity to represent their institution. We do not knowingly collect personal data from minors through this site's contact or booking forms.

10. Security measures

MUVO applies appropriate technical and organisational measures to ensure a level of security proportionate to the risk of processing, in accordance with article 32 of the GDPR, including the use of encrypted connections (HTTPS), restricted access to systems storing personal data, and the selection of providers offering adequate data protection guarantees.

11. Changes to this policy

This privacy policy may be updated to reflect legislative developments or changes in how we process your data. We will publish any relevant changes on this same page, indicating the date of the last update.