Baroni Creative
Let's talk

Last updated: October 2026

Legal

These texts are published in English, Spanish and Swedish. If they differ in any way, the Spanish version prevails.

Privacy

Who the controller is

The controller of your data is Niclas Jon Bellotto, with tax ID (NIF) X0231272F and address at Plaza Rector Marroig, 6, 07110 Buñola, Islas Baleares, España. For any question about your data, write to [email protected].

What data is processed and why

This site has no forms or user accounts, and uses no analytics or advertising tools and no cookie other than the security one explained under “Cookies”. The fonts, the images and the code are served from the site itself. The only thing loaded from another domain is the video on the home page, which is served by Cloudinary. Your data is not used for profiling or for automated decisions. Data about you is processed in two cases only:

  • If you write by email or WhatsApp. The data you give in your messages, such as your name, your email address or phone number and what you say about your event, is used to reply to you and, if you ask for it, to prepare a proposal and a quote. You need not give more data than you wish, but without a way to reach you there can be no reply.
  • When you visit the site. Like any web server, the provider that hosts it, the network through which it is served and the provider that serves the home page video receive your IP address and the technical data of the request, such as the browser and the page requested. They need them to serve the pages and the video and keep them secure. The owner does not use them to identify you or to track your browsing.

On what legal basis

Your messages are processed to deal with what you ask for. Preparing a proposal is a pre-contractual step taken at your request, and carrying out a commission is the performance of a contract: both rest on Article 6(1)(b) of the General Data Protection Regulation. Replying to any other enquiry rests on the legitimate interest in answering whoever writes, under Article 6(1)(f) of the same Regulation. Keeping accounting and tax records afterwards is a legal obligation, under Article 6(1)(c).

The technical data of your visit is processed on the basis of the legitimate interest in keeping the site working and secure, under the same Article 6(1)(f).

How long it is kept

Messages are kept for as long as the conversation lasts. If no commission follows, they are deleted no later than one year after the last message. If one does, the data is kept for as long as the relationship lasts and, afterwards, for the periods during which the law requires accounting and tax records to be kept.

The technical data of visits is kept by the hosting provider, by the network that serves the site and by the video provider, for the time set by their own policies. The owner keeps no copy.

Who receives it

Your data is not sold. It is passed on to third parties only where that is needed for what you commission, such as coordinating a supplier for your event, or where a law requires it. It is also processed by these providers, on the owner's behalf or because you choose that channel:

  • DigitalOcean, LLC, which hosts the site and serves it through the content delivery network of Cloudflare, Inc. Both are United States companies and may process the technical data of your visit there. Both are certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission.
  • Cloudinary Ltd., which serves the video on the home page. When your browser loads it, Cloudinary receives the technical data of that request. It is a company based in Israel, a country covered by an adequacy decision of the European Commission, and it processes that data under its own privacy policy, which also explains its transfers to other countries.
  • Google, which provides the email service, if you write by email. It may process your data in the United States, under the same Data Privacy Framework.
  • WhatsApp Ireland Limited, if you write by WhatsApp. It processes your data under its own privacy policy, which also explains its transfers outside Europe.

Your rights

You can ask for access to your data, for it to be corrected or erased, object to its processing or ask for it to be restricted, and ask for its portability. Write to [email protected] and say which right you want to exercise. You will have a reply within one month.

If you believe your data has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), at www.aepd.es, or with the data protection authority of the country where you live.

Cookies

One cookie only, technical and for security

This site uses no analytics or advertising cookies. The only cookie your browser receives is called “__cf_bm”, and it is set by Cloudflare, the network through which DigitalOcean, the provider that hosts the site, serves its pages. It is used to tell people apart from automated programs and to protect the site from the latter. It expires 30 minutes after your last visit to a page and is not used to track your browsing from one site to another.

It is a technical cookie, needed to serve the site securely: the law does not require asking your permission to set it, which is why you will not see a cookie banner.

Apart from that cookie, the only thing the site keeps in your browser is the language you choose in the selector in the header. It is kept in the browser's local storage, under the name “baroni:locale”, so that the site opens in that language next time. It does not identify you and is not sent to any server. You can delete it whenever you like by clearing the site's data in your browser settings.

Cloudinary, which serves the home page video, sets no cookies. The links to WhatsApp, Instagram and the partners' websites open third-party sites, which have their own cookies and their own policies.

If the site ever uses other cookies, it will be explained here and, where the law requires it, you will be asked for permission first.