Privacy Policy, GDPR Notice and Cookie Policy — 3x3 Moments
1. Data Controller
- Operator: 3x3 Moments Barcelona
- Email: info@3x3moments.com
2. What Data We Process and How
| Data category | Source | When |
|---|---|---|
| Name, email, phone | Provided by you | Contact / booking |
| Booking and session details | Booking | Service delivery |
| Payment details | Via PayPal (and/or GetYourGuide/Airbnb) | Booking. We do not see or store your card/bank data. |
| Order/shipping details (Shop) | Provided by you | Product order |
| Images created during sessions | The session | Service delivery; promotion with consent |
| Technical/security data (IP, browser) | Cloudflare infrastructure | Site security |
| Analytics data (page views, device, approx. location) | Google Analytics 4 — only after your consent | Understanding site usage |
3. Purposes and Legal Bases (GDPR art. 6 / art. 9)
- Booking and service delivery — performance of a contract (art. 6(1)(b)).
- Responding to enquiries — pre-contractual steps / legitimate interest (art. 6(1)(b) or (f)).
- Payment and accounting — legal obligation (art. 6(1)(c)).
- Capturing images during the session and processing them in the gallery — performance of a contract (art. 6(1)(b)).
- Using images for portfolio/website/social-media promotion — explicit consent (art. 6(1)(a); also LO 1/1982). Withdrawable at any time.
- Site security (Cloudflare) — legitimate interest (art. 6(1)(f)).
- Web analytics (Google Analytics 4) — consent (art. 6(1)(a)). GA4 runs only if you accept in the cookie banner.
4. Retention Periods
- Contact/booking data: 1 year after the relationship ends.
- Invoicing/accounting: for the statutory period in Spain (6 years).
- Delivered gallery: 14 days access + 30 days backup, then deleted.
- Promotional images: until consent is withdrawn.
- Analytics data: auto-deleted after 14 months.
5. Recipients / Processors
Your data is not sold. It is shared only as necessary with:
- PayPal — payment processing.
- GetYourGuide / Airbnb — if you booked via those platforms.
- Cloudflare — hosting/CDN and security.
- Google LLC (Google Analytics 4) — web analytics (only if you consented).
- Online gallery/delivery provider — photo delivery (if used).
- Microsoft 365 (Exchange Online) — communications infrastructure.
- Public authorities where legally required.
6. International Transfers
Some providers (e.g. Google LLC, PayPal, Cloudflare) may use servers outside the EU (e.g. the US). Such transfers are made with GDPR safeguards: EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework (DPF).
7. Your Rights (GDPR art. 15–22)
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent (withdrawal does not affect the lawfulness of processing before it). Requests: info@3x3moments.com. Complaints: AEPD — Spanish Data Protection Agency, https://www.aepd.es.
8. Children's Data
The site and service are aimed at adults. Where a child is photographed/processed, parental/guardian consent is required.
9. Cookie Policy
We group cookies into two categories:
a) Strictly necessary (no consent required). Cloudflare's security/technical identifiers are required for the site to work securely and need no consent. Fonts and videos are served from our own domain (no external sources such as Google Fonts).
b) Analytics cookies — Google Analytics 4 (consent only). To understand how you use the site we use Google Analytics 4 (GA4), which sets analytics cookies. These load only if you click "Accept" in the cookie banner. The site runs Google Consent Mode v2: all consent signals start denied by default; advertising signals (ad_storage, ad_user_data, ad_personalization) stay denied (no advertising/profiling tracking). Only analytics (analytics_storage) is enabled if you consent.
You can change your choice at any time via the "Cookie settings" link in the footer to give or withdraw consent.
If Instagram embeds or external video are added, the relevant provider may set its own cookies; ideally such content does not load until you interact with it.
10. Security
Reasonable technical/organizational measures protect your data (HTTPS, access limitation). In case of a breach, the notifications required by GDPR are made.
11. Changes and Contact
This policy may be updated; the current version is on this page. Contact: info@3x3moments.com.
© 2026 3x3 Moments Barcelona.