Privacy Policy
Last updated 14 June 2026
At Cambio Collective, S.L. we are committed to protecting your personal data and your right to privacy. This Privacy Policy explains what personal data we collect, why and how we use it, and the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
We have kept it short and plain, because we collect very little: the Website has no user accounts and takes no payments. We only hold personal data when you choose to contact us, or when you consent to analytics cookies.
1. Who is responsible for your data
The data controller is:
- Company name
- Cambio Collective, S.L.
- Tax ID (NIF)
- B-27670264
- Registered office
- Carrer Floridablanca 68, 08015 Barcelona, Spain
- Privacy contact
- privacy@cambiocollective.co
2. What personal data we collect
We only collect:
- Contact data: when you email us (for example at hello@cambiocollective.co or privacy@cambiocollective.co), we receive your name, your email address and any information you choose to include in your message.
- Analytics and usage data: if you consent, Google Analytics collects pseudonymised information about your visit — an approximate location derived from your IP address, your device and browser, the pages you view, interactions and the source that referred you. We also use cookieless analytics that produces only aggregate, anonymous statistics and does not identify you.
3. A note on sensitive data
We do not ask for, and do not need, special categories of data (such as data on health, beliefs or political opinions). Please do not include sensitive personal data in your messages unless it is genuinely necessary for your enquiry.
4. Why we use your data and our legal basis
- To respond to your enquiry and communicate with you about a possible or existing engagement — on the basis of taking steps at your request prior to a contract (Art. 6(1)(b) GDPR) and/or our legitimate interest in responding to messages we receive (Art. 6(1)(f) GDPR).
- To measure and improve the Website using analytics cookies — on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- To produce aggregate, anonymous traffic statistics using cookieless analytics — on the basis of our legitimate interest in understanding how the Website is used, with no measurable impact on your privacy (Art. 6(1)(f) GDPR).
- To comply with our legal obligations, for example in tax or accounting matters — Art. 6(1)(c) GDPR.
5. Who we share your data with
We never sell your personal data and we do not share it for advertising. We rely on a small number of trusted service providers (processors) who handle data on our behalf under contracts that require them to protect it:
- Google (Google Workspace / Gmail), which hosts the inbox and productivity tools we use to receive and manage your messages;
- Vercel Inc., which hosts the Website and provides its cookieless analytics;
- Google (Google Ireland Limited / Google LLC), which provides Google Analytics — only if you have given consent.
6. International data transfers
Some of our providers (such as Vercel and Google) are based in, or may process data in, the United States. Where your data is transferred outside the European Economic Area, we rely on appropriate safeguards recognised by the GDPR — such as the European Commission's Standard Contractual Clauses and/or the providers' certification under the EU–US Data Privacy Framework — so that your data continues to receive an adequate level of protection.
7. How long we keep your data
- Contact correspondence: for as long as needed to deal with your enquiry and our relationship, and afterwards only where necessary to comply with legal obligations or to defend against possible claims (generally up to the applicable limitation periods, for example up to six years for accounting and tax records).
- Analytics data: for the retention period configured in the analytics tools (in Google Analytics, up to 14 months), after which it is deleted or anonymised.
8. Your rights
Under the GDPR you have the right to access your personal data and to request its rectification or erasure; to restrict or object to its processing; to data portability; and to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, email us at privacy@cambiocollective.co. We will respond within one month. We may need to verify your identity before acting on a request.
If you believe we have not handled your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. (opens in a new tab)
9. Cookies
The Website uses cookies and similar technologies as described in our Cookie Policy, including how you can accept, decline or withdraw consent to analytics cookies.
10. Security
We apply appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, but we work to keep your data safe and to limit who can access it.
11. Children
The Website is intended for a professional audience and is not directed at children. We do not knowingly collect personal data from children under the age of 14 (the age of digital consent in Spain). If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The current version is the one published here, with its last-updated date shown above. Where changes are significant, we will take reasonable steps to make them clear.