Legal Notice and Privacy Policy
Legal Notice and Privacy Policy
1. Identification of the website owner and data controller
In compliance with Article 10 of Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE) and Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), we inform you that the owner of this website and the controller of your personal data is:
– Owner / Company name: ATIPUS, S.L. (hereinafter, "Atipus")
–Tax ID (NIF): B62158381
– Registered office: Carrer de Pallars, 85, 1r 2a, 08018 Barcelona, Spain
– Registration details: Registered with the Barcelona Commercial Registry, Volume 32297, Folio 28, Sheet B-205829
– Contact email: hola@atipus.com
– Contact telephone: (+34) 934 851 395
– Data protection contact: privacy@atipus.com
– Business activity: Graphic design, corporate identity, packaging, editorial design and brand consultancy services.
– Website domain: https://www.atipus.com and its associated subdomains or environments.
– Hosting provider: Dinahosting, S.L. (Tax ID B15805419), Rúa das Salvadas 41, baixo, 15705 Santiago de Compostela, A Coruña, Spain — https://dinahosting.com
Atipus is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR and Article 34 of Spanish Organic Law 3/2018 (LOPDGDD). Privacy enquiries are therefore handled through privacy@atipus.com.
Part I. Legal Notice
2. Purpose and scope
Part I of this document (hereinafter, the "Legal Notice") governs access to, browsing and use of the Atipus website, as well as the liabilities arising from the use of its content ("content" meaning texts, photographs, graphic projects, images, creative work, videos, designs, logos, source code and any other works protected by applicable law).
Accessing or using this website in any way makes you a User and implies acceptance of the terms set out in this Legal Notice and in our Cookie Policy. The processing of your personal data does not depend on that acceptance: it is governed by the Privacy Policy set out in Part II of this document, which is provided for information purposes.
If you do not agree with these terms, please refrain from using the website.
3. Terms of access and use
3.1. Nature of access
Access to the general content of the website is free of charge and does not require prior registration. The cost of the internet connection is borne by the User.
3.2. Diligent and lawful use
The User undertakes to make appropriate, lawful and diligent use of the website, in accordance with applicable law, this Legal Notice, good faith and public order.
In particular, the User shall refrain from:
1. Unauthorised or fraudulent use: Using the website and its content for unlawful purposes or with unlawful effects, in a manner detrimental to the rights and interests of Atipus or third parties, or in any way that may damage, disable, overload or impair the normal operation of the website or associated systems.
2. Improper access: Attempting to access restricted areas, internal management systems, servers or databases linked to the website without express authorisation, or circumventing or tampering with technical protection measures.
3. Introduction of malicious code: Introducing or spreading viruses, trojans, worms, scripts or any other logical or physical systems capable of causing damage or alterations to the systems of Atipus, its providers or third parties.
4. Automated extraction (scraping) and data mining: Using robots, crawlers, text and data mining tools or any similar method to extract information, images, texts or projects from the website on a massive or systematic basis without the prior written authorisation of Atipus (see section 4.4).
5. Identity theft: Providing false information or impersonating third parties in contact forms, proposal requests or any communication channels made available.
4. Intellectual and industrial property
4.1. Ownership of content
This website, its source code, navigation architecture, databases, layout, texts, typefaces, interfaces, icons, photographs, audiovisual material, trademarks, logos, trade names and other works comprising it are the exclusive property of ATIPUS, S.L. or of third parties who have granted Atipus the corresponding licence or authorisation to use them.
All these elements are protected by Spanish Royal Legislative Decree 1/1996, of 12 April, approving the consolidated text of the Intellectual Property Law, Law 17/2001, of 7 December, on Trademarks, and applicable international treaties and European directives.
Access to the website does not grant the User any right or licence over such content.
4.2. Client projects and trademarks
The logos, trademarks, distinctive signs, visual identities, packaging, products and projects of third parties shown in the Atipus portfolio belong to their respective owners. They are displayed on this website for illustrative purposes only, to showcase the design, branding and consultancy work legitimately carried out by Atipus for its clients, and do not imply any affiliation, sponsorship or endorsement by those owners beyond the existing professional relationship.
If you hold rights over any of the published content and believe that its display is not lawful, please let us know at hola@atipus.com so that we can review it and, where appropriate, remove it.
4.3. Prohibition of reproduction and exploitation
The total or partial reproduction, distribution, public communication (including making available to the public), transformation, modification or decompilation of the content of this website, in any medium and by any means, is expressly prohibited without the prior, express and written authorisation of Atipus or of the legitimate rights holder.
The User is only authorised to view and obtain a temporary copy of the content for personal, private and non-commercial use, provided that all authorship and intellectual property notices are fully respected.
Any infringement of these rights shall entitle Atipus to bring any civil, commercial or criminal actions available to it.
4.4. Reservation of rights against text and data mining
Pursuant to Article 4(3) of Directive (EU) 2019/790 on copyright in the Digital Single Market and Article 67 of Spanish Royal Decree-Law 24/2021, of 2 November, which transposes it into Spanish law, Atipus expressly reserves the rights of reproduction and extraction of the content of this website for text and data mining purposes, including its use for training, fine-tuning or validating generative artificial intelligence systems.
This reservation is expressly stated in this Legal Notice and, additionally, through the machine-readable mechanisms implemented on the website (in particular, the robots.txt file). It is without prejudice to the exceptions provided by law for scientific research. Any use of this content for the purposes indicated shall require a prior written licence from Atipus.
5. Disclaimer and liability
Atipus does not guarantee the uninterrupted availability of the website or that it is entirely error-free. Within the limits permitted by law, Atipus excludes liability for any loss or damage that may arise from:
1. Technical interruptions or incidents: Unavailability, access failures, server outages, telecommunications interference or temporary suspensions of service required for the maintenance, updating or improvement of the website.
2. IT security: Unlawful intrusions or the presence of viruses or other harmful elements introduced by third parties beyond the reasonable control of the security measures implemented by Atipus.
3. Misuse by the User: Any unlawful, negligent or fraudulent use, or use contrary to this Legal Notice, that the User makes of the information and tools on the website.
4. Third-party content: Errors or omissions in information provided by clients or suppliers and in the content of linked websites that may be out of date or inaccurate.
The above exclusions shall not apply where the law imposes non-waivable liability, nor to damage caused by wilful misconduct or gross negligence on the part of Atipus, and they do not limit the rights granted by consumer protection law to those who qualify as consumers.
6. Links policy
6.1. Links to third-party websites
The website may include links or hyperlinks to platforms managed by third parties (corporate social media such as Instagram, LinkedIn or Behance, client websites, publications or collaborations). Atipus has no editorial or technical control over those sites and accepts no liability for their availability, accuracy, content, privacy policies or practices. The existence of such links does not imply any agency relationship, association or endorsement of their content by Atipus.
Should Atipus become actually aware that the activity or information to which a link leads is unlawful or infringes third-party property or rights, it will remove the link with all due diligence, in accordance with Article 17 of the LSSI-CE.
6.2. Links to the Atipus website
Anyone wishing to link from their own website to the Atipus website must comply with the following conditions:
– No frames or browsing environments shall be created that wrap around or distort the Atipus page.
– No false, misleading or disparaging statements shall be made about Atipus, its members or its services.
– It shall not be implied that Atipus endorses or sponsors the linking website, unless agreed in advance in writing.
– The linking page shall not contain unlawful content, content contrary to good faith or content that infringes third-party rights.
– The link shall point to the home page or to the specific URL linked, without reproducing Atipus content or distinctive signs beyond what is strictly necessary to identify the link's destination.
7. Data protection and cookies
The processing of personal data provided by the User while browsing or through the website's forms is governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the Privacy Policy set out in Part II of this document.
The use of cookies and similar technologies is governed by Article 22.2 of the LSSI-CE and by our Cookie Policy, where the User can review, configure and withdraw their consent at any time.
8. Commercial communications
Atipus does not send commercial communications by electronic means that have not been previously requested or expressly authorised by their recipients, except in the cases permitted by Article 21.2 of the LSSI-CE. Every communication will identify Atipus as the sender and offer a simple, free-of-charge procedure to opt out of receiving them.
9. Severability
If any clause of this Legal Notice is declared wholly or partially null or ineffective, such nullity shall affect only that provision or the part of it that is null, and the remainder of the Legal Notice shall continue in full force, with that provision being deemed not to have been included.
10. Amendments and term
Atipus reserves the right to make changes, deletions or updates to the presentation, configuration and content of its website, as well as to the terms set out in this document, at any time and without prior notice. Changes shall take effect from the time of their publication on the website.
Likewise, Atipus may suspend or terminate the service, in whole or in part, at any time and without prior notice.
11. Governing law and jurisdiction
The relationship between Atipus and the User arising from the use of this website shall be governed by and construed in accordance with Spanish law, including Law 34/2002 (LSSI-CE), civil and commercial law and intellectual and industrial property law.
Where the User is not a consumer, the parties expressly submit to the Courts and Tribunals of the city of Barcelona, waiving any other jurisdiction to which they may be entitled.
Where the User is a consumer, the competent jurisdiction shall be that determined by mandatory consumer protection law, which is generally the consumer's place of residence.
Part II. Privacy Policy
In compliance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you about the processing of personal data collected through this website, whose controller is Atipus, identified in section 1.
Atipus is committed to ensuring the confidentiality, integrity and availability of your personal data, applying appropriate technical and organisational measures to protect your privacy in line with the standards required by Spanish and European law.
12. Principles applicable to the processing of your data
When processing your personal data, Atipus applies the principles set out in Article 5 of the GDPR:
– Lawfulness, fairness and transparency: We always process your data on a valid legal basis, providing clear and understandable information about each processing activity.
– Purpose limitation: Data are collected only for specified, explicit and legitimate purposes and will not be processed in a manner incompatible with those purposes.
– Data minimisation: We collect only data that are relevant, adequate and limited to what is necessary for each purpose.
– Accuracy: We take every reasonable step to ensure that inaccurate data are erased or rectified without delay.
– Storage limitation: We keep data only for as long as strictly necessary for the purposes of the processing or to comply with legal obligations.
– Integrity and confidentiality: We ensure appropriate security of the data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
13. Source of the data
All personal data we process have been provided directly by you (through the website forms, by email, by telephone or via our social media profiles), except for the technical browsing data described in section 14.E, which are obtained automatically from your device under the terms of our Cookie Policy.
Atipus does not obtain personal data from publicly accessible sources or from third parties for marketing purposes.
14. What data do we process, for what purposes and on what legal basis?
A. Contact form and project proposal requests ("Starting something new?")
– Data processed: Name, company or organisation name, email address, project description and budget estimate.
– Purpose: To respond to your request, prepare tailored quotes, assess the project's feasibility and maintain the necessary professional or pre-contractual contact.
– Legal basis: Taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). Where the enquiry is not aimed at engaging our services, the legal basis will be our legitimate interest in responding to communications addressed to the studio (Article 6(1)(f) GDPR).
– Retention period: For as long as necessary to handle your request or while commercial discussions remain open. If the request does not lead to a contractual relationship, the data will be kept for a maximum of twelve (12) months and then erased. If it leads to a contract, the data will be kept for the duration of the relationship and subsequently blocked for the applicable statutory limitation periods (among others, six years under Article 30 of the Spanish Commercial Code and four years under the Spanish General Tax Law).
B. Direct contact by email, telephone or messaging
– Data processed: First name and surname, email address, telephone number and any other data you choose to include in your message.
– Purpose: To answer your enquiries, questions, collaboration requests or professional proposals.
– Legal basis: Our legitimate interest in properly responding to the communications we receive (Article 6(1)(f) GDPR), an interest we have balanced against your rights and freedoms and which matches the reasonable expectations of anyone who writes to us. Where the communication concerns engaging our services, the legal basis will be Article 6(1)(b) GDPR.
– Retention period: Until the enquiry has been resolved and, where applicable, for the applicable statutory limitation periods.
C. Job applications, CVs and portfolios (job applications & internships)
– Data processed: First name, surname, contact details, professional profile, links to portfolios or professional profiles (Behance, LinkedIn, etc.), CV and work samples.
– Purpose: To manage your participation in current or future recruitment processes for vacancies, freelance collaborations or internship agreements at Atipus.
– Legal basis: Taking pre-contractual steps at the request of the data subject (Article 6(1)(b) GDPR) when you apply for a specific vacancy, and your consent (Article 6(1)(a) GDPR) when you send an unsolicited application for future processes.
– Retention period: Atipus does not add applications to any database or talent pool: CVs and portfolios received remain only in the email inbox in which they are received, for as long as the recruitment process to which they relate remains open. In line with the criteria of the Spanish Data Protection Agency (AEPD), they will in no case be kept for more than one (1) year from receipt, after which they will be securely deleted, unless you update your application beforehand or request its earlier deletion.
– Please note: We ask that you do not include special categories of data (health, trade union membership, beliefs, ethnic origin, etc.) in your application, as they are not necessary for the recruitment process.
D. Newsletter, editorial content ("Thoughts") and news
– Data processed: Name and email address.
– Purpose: To send you newsletters, editorial articles (Thoughts), new case studies and studio news.
– Legal basis: Your express consent, given when you voluntarily subscribe (Article 6(1)(a) GDPR and Article 21.1 LSSI-CE). If you are an Atipus client, we may send you information about our own services similar to those you have contracted under the exception provided for in Article 21.2 LSSI-CE, giving you in every communication a simple, free-of-charge way to opt out.
– Retention period: Until you withdraw your consent or unsubscribe, using the link included in every communication or by writing to privacy@atipus.com. After you unsubscribe, we will keep the minimum data strictly necessary, blocked, to prove that your request has been honoured.
– Processor: Mailings are managed through the Elastic Email Inc. platform, which acts as a processor and, in addition to your email address, records technical delivery and engagement data (opens, clicks, bounces) for the sole purpose of managing and measuring mailings.
E. Website browsing, security and analytics
– Data processed: IP address, session identifiers, technical browser and device data, pages visited and time spent on them, collected through cookies and similar technologies. Where the tool allows it, the IP address is truncated or pseudonymised.
– Purpose: To ensure the technical operation and stability of the website, prevent abuse or attacks and obtain aggregated statistics on the website's performance.
– Legal basis: Our legitimate interest in ensuring the security and integrity of the website (Article 6(1)(f) GDPR) for technical or strictly necessary cookies, which are exempt from consent under Article 22.2 LSSI-CE; and your consent (Article 6(1)(a) GDPR) for analytics cookies, which you can give, refuse or withdraw at any time from the cookie settings panel.
– Retention period: As applicable to each cookie, detailed in our Cookie Policy.
F. Social media profiles
– Data processed: Username, public profile data and interactions (follows, comments, direct messages) on Atipus's corporate profiles.
– Purpose: To share our work and activity and to respond to communications received through those channels.
– Legal basis: Your consent, expressed by following or interacting with our profile (Article 6(1)(a) GDPR).
– Additional information: The processing of your data by each platform (Instagram, LinkedIn, Behance, etc.) is governed by its own privacy policy and terms of use, over which Atipus has no control. We recommend that you review them and configure your profile accordingly.
15. Mandatory or optional nature of the data
Fields marked as mandatory in the website forms are strictly necessary to process your request. Failure to provide them will prevent Atipus from responding to your message or assessing your project proposal.
The user guarantees that the data provided are true, accurate, complete and up to date, and is liable for any direct or indirect loss or damage caused to Atipus or third parties as a result of completing forms with false or inaccurate data or with data belonging to third parties without their authorisation.
16. Recipients and disclosure of data
Atipus does not sell, rent or transfer your personal data to third parties for commercial or advertising purposes. Your data may only be disclosed in the following cases:
Legal obligation: Where required by law or by a binding judicial or administrative order (law enforcement agencies, courts and tribunals, the Spanish Tax Agency or other competent public authorities).
Processors: Service providers necessary for Atipus's technical and administrative operations, who access the data on our behalf:
– DINAHOSTING, S.L. (Spain) — web hosting, domains and email.
– Google Ireland Limited (Ireland) — web analytics through Google Analytics 4, as described in our Cookie Policy.
– Elastic Email Inc. (Canada) — newsletter management and delivery platform.
Cloud storage and project management tool providers, and accounting, tax and employment advisers.
Data processing agreements have been signed with all of them in accordance with Article 28 of the GDPR, requiring them to process the data solely on our documented instructions and subject to strict security and confidentiality commitments. You can request an up-to-date list of our providers by writing to privacy@atipus.com.
17. International data transfers
As a priority, personal data are stored and processed on servers located within the European Economic Area (EEA).
Web hosting and email are contracted with a Spanish provider (DINAHOSTING, S.L.), with servers in Spain.
However, some of our technology providers may have processing centres or headquarters outside the EEA:
Google Analytics: the service is contracted with Google Ireland Limited, but may involve access to the data by Google LLC in the United States.
Elastic Email Inc.: headquartered in Canada, a country covered by a European Commission adequacy decision (Decision 2002/2/EC) for organisations subject to its federal data protection law (PIPEDA), and may process data in facilities located in the European Union, Canada or the United States.
In such cases, Atipus ensures that these transfers are subject to the safeguards required by Chapter V of the GDPR:
European Commission adequacy decisions (Article 45 GDPR), such as the one concerning Canada.
Providers certified under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023.
Standard Contractual Clauses (SCCs) approved by Commission Implementing Decision (EU) 2021/914, supplemented, where necessary following the relevant transfer impact assessment, by additional encryption and pseudonymisation measures.
You can request information about the safeguards applied and obtain a copy of them by writing to privacy@atipus.com.
18. Automated decision-making and profiling
Atipus does not make decisions based solely on automated processing of your data that produce legal effects concerning you or similarly significantly affect you, nor does it carry out profiling for that purpose.
19. Data subject rights
Data protection law grants you the following rights:
– Access: To find out whether we are processing personal data concerning you and, if so, to obtain detailed information about that processing and a copy of the data.
– Rectification: To request the correction of inaccurate data or the completion of incomplete data.
– Erasure ("right to be forgotten"): To request the deletion of your data where, among other reasons, they are no longer necessary for the purposes for which they were collected or you withdraw your consent.
– Objection: To object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. If you object to processing for direct marketing purposes, we will stop processing your data for that purpose unconditionally.
– Restriction of processing: To request that we temporarily suspend processing in the cases provided for in Article 18 of the GDPR.
– Portability: To receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit them to another controller, where the processing is based on your consent or on a contract and is carried out by automated means.
– Withdrawal of consent: For processing based on your consent, to withdraw it at any time as easily as you gave it, without affecting the lawfulness of processing carried out before its withdrawal.
How can you exercise your rights?
By contacting Atipus through either of the following channels:
– Email: privacy@atipus.com, stating "GDPR rights request" in the subject line.
– Post: ATIPUS, S.L. – Ref. "Data Protection" – Carrer de Pallars, 85, 1r 2a, 08018 Barcelona, Spain.
Your request should state your full name, the right you wish to exercise and the content of your request. Only where there are reasonable doubts about your identity may we ask you for additional information or a copy of an identity document to verify it.
Exercising these rights is free of charge, and requests will be answered within a maximum of one (1) month from receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons for it within the first month.
Right to lodge a complaint with the supervisory authority
If you believe that the processing of your data infringes the law or that we have not properly handled your request, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD):
– Postal address: C/ Jorge Juan, 6, 28001 Madrid, Spain
– Electronic office: https://sedeagpd.gob.es — Website: https://www.aepd.es
– Telephone: 900 293 183 (free of charge from Spain) / (+34) 912 663 517
If you reside in another EU Member State, you may also lodge a complaint with the supervisory authority of your place of residence or work.
20. Minors
This website and the services offered by Atipus are aimed at professionals, businesses and persons over the age of fourteen (14), in accordance with Article 7 of the LOPDGDD. Atipus does not knowingly collect data from children under 14 without the prior and verifiable consent of their parents, guardians or legal representatives.
If data from a child under 14 are found to have been inadvertently collected without proper authorisation, they will be immediately deleted from our records. If you are a parent or guardian and become aware of such a case, please let us know at privacy@atipus.com.
21. Technical and organisational security measures
Atipus adopts the technical and organisational measures necessary to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 of the GDPR. These include:
– Encrypted transmission using HTTPS / TLS protocols across the entire website, including contact forms.
– Hosting in data centres located in Spain, with the provider's own physical and logical security measures.
– Physical and logical access control to corporate equipment and information systems, with individual credentials.
– Regular backup policies ensuring the availability and recoverability of data.
– Confidentiality and non-disclosure agreements signed with the team, collaborators and providers.
– Regular review and assessment of the effectiveness of the security measures adopted.
In the event of a personal data breach that poses a risk to your rights and freedoms, Atipus will notify the AEPD and, where the risk is high, also the affected individuals, under the terms of Articles 33 and 34 of the GDPR.
22. Changes to this Policy
Atipus reserves the right to amend or update this Privacy Policy (Part II of this document) to reflect legislative or case-law developments, AEPD guidance or changes to the website's features.
Any substantial change will be published on this page, indicating the date of the last update, and, where required by law, will be communicated to the individuals concerned. We recommend that you review it periodically.
Please also see our Cookie Policy.