Privacy policy

Ninanii Productions – Anina Rehl, Carrer de s'Illot, 13, 07400 Alcúdia, Illes Balears, Spain. Email: info@ninanii-productions.com. Phone: +34 645 413 021.

The website is delivered by Vercel Inc., USA. Technically necessary connection data is processed to deliver the site securely and reliably. The legal basis is Article 6(1)(f) GDPR. Vercel documents appropriate safeguards for international transfers.

Vercel Web Analytics and Speed Insights are disabled by default and load only after your activation. The legal basis is your consent under Article 6(1)(a) GDPR and applicable ePrivacy law. You may change the preference for the future at any time.

When you submit the form, your name, email, date, location, requested service and optional message are sent through a validated server route to the dedicated Supabase project and stored to handle your enquiry. Processing supports pre-contractual measures under Article 6(1)(b) GDPR. You can also choose to contact us by email or WhatsApp.

The Calendly link takes you to an external page operated by Calendly, LLC in the United States only after your deliberate selection. Calendly may then process your IP address, device and browser data and the scheduling details you enter. For appointment scheduling, Calendly processes this data under a data processing arrangement. Calendly identifies the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as appropriate safeguards depending on the transfer; this is not a blanket assurance for every individual processing operation. You can contact us by email instead.

WhatsApp opens only after your conscious choice. WhatsApp Ireland Limited processes data under its own terms. Use email instead if you prefer not to use WhatsApp. Ninanii Productions processes your message under Article 6(1)(b) GDPR.

External video content loads only after explicit consent. The provider then receives data such as your IP address and device or usage information. The legal basis is your consent under Article 6(1)(a) GDPR and applicable ePrivacy law.

Technically required logs support troubleshooting, abuse prevention and operational security under Article 6(1)(f) GDPR. Short-lived HMAC values are stored to limit enquiry requests; raw IP addresses and form content are not written to application logs. The CMS, protected by a second authentication factor, processes necessary admin, revision, media, audit and inbox data.

Recipients are, only where necessary, Vercel; Supabase, Inc. for authentication, database, enquiry inbox and private media storage; and Resend for the transactional enquiry email. Resend receives the language, name, email address, preferred date, location, service, optional message, enquiry reference, protected admin link and configured recipient address. Your validated email address is used for a personal reply (Reply-To). Other recipients include your chosen email or communications services, WhatsApp when selected, Calendly, LLC after deliberate external navigation and the configured video provider after consent. Providers publish information about data processing and transfer safeguards; depending on the processing, relevant mechanisms include Data Privacy Frameworks or Standard Contractual Clauses. These notices are not a blanket compliance assurance. Enquiry data is not sold. For automatic translation in the protected CMS, only deliberately approved public marketing copy is sent to OpenAI as a processor (within the European Economic Area OpenAI Ireland Ltd.; outside it OpenAI OpCo, LLC). Booking, contact, email, telephone, legal and admin content is technically excluded. Processing supports consistent multilingual publishing on the basis of legitimate interests under Article 6(1)(f) GDPR. Under the provider's commercial terms, customer content submitted through the interface is not used for training the models. Translation calls do not store application state at OpenAI (store: false). This is not a Zero Data Retention commitment: the provider may retain content for a limited period for abuse and safety review. For transfers outside the EEA, the OpenAI DPA and the EU Standard Contractual Clauses it provides for apply. The feature remains disabled without a server-side API key.

Open enquiries are stored for no more than 180 days. After completion or marking as spam, the remaining retention period is no more than 30 days; the overall 180-day limit is never extended. Delivery status and outbox records are deleted with the enquiry. Statutory retention requirements for subsequent contract documents remain unaffected. Unneeded CMS accounts, private media and identifiers are deleted or anonymised.

Providing enquiry data is voluntary. Required fields are necessary to process your enquiry and reply personally. There is no solely automated decision under Article 22 GDPR and no profiling.

Subject to the GDPR, you may request access, correction, deletion, restriction, portability and object to processing. Consent can be withdrawn for the future at any time.

You may complain to a data protection authority. The Agencia Española de Protección de Datos (AEPD) is one relevant supervisory authority; you may also contact the authority at your habitual residence or workplace.

The website uses encrypted transmission. Data flows are limited to the stated purposes and external media load only after consent. The CMS is available only to invited administrators protected by a second factor.

Send privacy questions or rights requests to info@ninanii-productions.com, or by post to Ninanii Productions – Anina Rehl, Carrer de s'Illot, 13, 07400 Alcúdia, Illes Balears, Spain.

This policy is updated when functions, providers or legal requirements change. The German version is authoritative; English and Spanish versions are accessible translations.