Privacy Policy

Last updated: August 22, 2026

This policy explains how data related to visits to and use of yolandastudio.art is processed.

1. Data controller

Controller: Yolanda Gil
Website: yolandastudio.art
Privacy contact: [email protected]

You may use this email address for any questions concerning privacy or data protection.

2. Data processed

Depending on how the site is used, technical data may be processed, such as the IP address, date and time of the request, requested URL, response code, browser, operating system, device type, User-Agent, referring page, approximate country or region, network provider and security events.

The site has no forms, user registration or personal accounts. If you choose to contact us through Instagram, the processing carried out by that platform is governed by its own privacy policy.

3. Purposes and legal bases

Technical data is used to deliver the requested content, maintain site availability, troubleshoot errors, obtain aggregate statistics, and detect or mitigate abusive traffic, attacks, fraud and unauthorized access attempts.

The legal basis is the legitimate interest in providing, protecting, administering and improving the website, pursuant to Article 6(1)(f) of the General Data Protection Regulation. Where communication is necessary to respond to a request, processing may also be based on taking pre-contractual steps requested by the data subject.

4. Matomo Analytics

We use a self-hosted installation of Matomo Analytics, hosted at stats.yolandastudio.art, to statistically measure visits, pages viewed, traffic sources, approximate countries, and general device and browser types.

The tracking code is configured with analytics cookies disabled. We do not set a user identifier or use advertising tracking or tracking of the same person across websites operated by different controllers. Matomo data is neither sold nor used to create individual advertising profiles.

Although analytics cookies are not used, the server must initially receive the IP address to establish communication and may process other technical data included in the request. Geographic information is approximate.

5. Cloudflare

We use services provided by Cloudflare, Inc. for content delivery, reverse proxying, performance, availability, DDoS attack mitigation, application firewall, traffic management, and detection of automated or malicious activity.

We also use Cloudflare Web Analytics to obtain aggregate statistics on site use and performance. We do not use this information for behavioral advertising.

Traffic may pass through Cloudflare’s global infrastructure before reaching our servers. Cloudflare may process IP addresses, requests, device and browser data, security events and other technical information necessary to provide and protect its services. When acting on our behalf, it acts as a processor in accordance with its Data Processing Addendum.

6. International transfers

Cloudflare operates global infrastructure, so some data may be processed outside the European Economic Area. Cloudflare provides for mechanisms such as adequacy decisions, the EU-U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses, as applicable.

The Matomo installation is self-managed; use of the software does not in itself mean that analytics data is disclosed to Matomo or InnoCraft.

7. Cookies and technical storage

Matomo is configured to operate without analytics cookies. Cloudflare may use cookies or storage that are strictly necessary for security, bot protection, load balancing or technical operation. We do not use these mechanisms for behavioral advertising.

If non-essential technologies subject to consent are introduced in the future, they will not be activated before consent has been obtained where required by law.

8. Technical and security logs

Servers and security services may generate logs containing the IP address, date and time, requested resource, response code, User-Agent, errors and anomalous activity. They are used to maintain security, investigate incidents, resolve technical issues, prevent abuse and comply with legal obligations.

9. Retention

Data is retained only for as long as necessary for each purpose. Retention periods are reviewed in light of security, technical operation, Matomo and Cloudflare settings, and any applicable legal obligations.

Logs related to an incident, investigation, fraud, abuse or claim may be retained for longer while they remain necessary. Aggregate statistical reports may be retained once they no longer allow an individual to be reasonably identified.

10. Recipients

We do not sell personal data. It may be accessed by hosting and infrastructure providers, Cloudflare, technical providers that need to maintain the systems, and public authorities where there is a valid legal obligation.

11. Security

We implement measures such as HTTPS/TLS, access controls, updates, firewalls, DDoS mitigation, monitoring, backups and data minimization. No system connected to the Internet can guarantee absolute security.

12. Rights

Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected] . We may request the minimum information necessary to verify your identity and locate the relevant processing activity.

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We will cease processing the data unless there are compelling legitimate grounds or it is necessary for the establishment, exercise or defense of legal claims.

13. Complaints

You may lodge a complaint with the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency (AEPD) .

14. Automated decisions, children and third parties

We do not make decisions with legal effects based solely on automated profiling. Security systems may, however, temporarily block requests or IP addresses that appear malicious.

The site is not specifically directed at children and does not knowingly process their data for marketing purposes. External links, such as Instagram, are governed by the policies of their respective controllers.

15. Changes to this policy

This policy may be updated to reflect legal or technical changes or changes to the services used. The version published on this page will be the current version and will display the date on which it was last updated.