LEGAL
Privacy Policy
Last updated: 28 October 2026
LEGAL
Privacy Policy
Last updated: 28 October 2026
LEGAL
Privacy Policy
Last updated: 28 October 2026
This Website is operated by CAVËN ATELIER, S.L. (hereinafter, the “Data Controller”). We are committed to protecting users' privacy and providing clear information on how their personal data is collected, used and protected.
– Personal data is not sold to third parties.
– Only personal data necessary to operate the Website, manage enquiries and provide the relevant services is collected.
– Users may contact the Data Controller at any time at info@cavenatelier.com
1. Data Controller
In compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (hereinafter, “GDPR”), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, “LOPDGDD”) and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (hereinafter “LSSI-CE”), users are hereby informed that the data controller responsible for the processing of personal data collected via the website www.cavenatelier.com (hereinafter the “Website”) is:
CAVËN ATELIER, S.L.
Tax Identification Number: B-93773034
Registered office: Avenida Calderón de la Barca s/n, local 91-1, Urbanización Magna Marbella, Marbella (29660) Málaga, Spain
Email: info@cavenatelier.com
Domain: www.cavenatelier.com
2. Personal Data Subject to Processing
The Data Controller may process the following categories of personal data, depending on the user’s interaction with the Website:
a) Identification and contact details: first name, surname, email address, telephone number and, where applicable, the company or organisation you represent.
b) Data relating to enquiries and commercial requests: information provided voluntarily by the user in relation to vehicles, restoration projects, customisation or modification, requests for quotations, bookings or other commercial enquiries.
c) Browsing data: IP address, technical identifiers, information about the browser, device used and other data derived from accessing or using the Website.
d) Data arising from pre-contractual or contractual relationships: information necessary to prepare quotations, manage orders or formalise commercial transactions, where applicable.
The Data Controller does not, as a general rule, request special categories of personal data via the Website. Users are asked to avoid providing information of this nature unless it is strictly necessary and has been expressly requested.
3. Purposes of Processing and Legal Bases
In accordance with Article 6.1 of the GDPR and Article 21 of the LSSI-CE, personal data may be processed for the following purposes:
a) Handling enquiries and requests for information: To manage requests received via forms, email or other contact methods provided on the Website, as well as to provide information on vehicles, services and restoration or modification projects.
b) Management of pre-contractual and contractual relationships: To prepare quotations, commercial proposals, booking documents, contracts and other documentation relating to the transactions requested by the data subject, as well as to manage, where applicable, their execution and follow-up.
c) Sending commercial communications: To send information on news, vehicles, projects, events, products or services offered by the Data Controller, where the user has provided their consent or another valid legal basis applies.
d) Website security and operation: To ensure the security of the Website, prevent unauthorised access, detect technical incidents and maintain its proper functioning.
e) Website statistics: To obtain aggregated statistics on Website visits and performance through Framer’s built-in analytics tools, without using tracking cookies or persistent identifiers.
f) Audiovisual content: To allow users to view audiovisual content hosted by Vimeo, which is loaded only at the user's express request.
g) Website analytics: To analyse Website traffic, usage patterns and visitor interactions through Google Analytics, with the aim of improving the Website’s content, performance and user experience. This processing is subject to the user’s prior consent.
h) Third-party functionality and security: To display interactive maps provided by Google Maps and to protect the Website's contact forms against spam, automated submissions and other abusive activities through Google reCAPTCHA. These services may involve the processing of technical information, including IP addresses and device or browser data.
The legal bases for the above processing activities are, as applicable: (i) taking steps at the request of the data subject prior to entering into a contract or performing a contract, pursuant to Article 6(1)(b) of the GDPR; (ii) compliance with legal obligations applicable to the Data Controller, pursuant to Article 6(1)(c) of the GDPR; (iii) the Data Controller's legitimate interests in ensuring the security, maintenance and proper operation of the Website, pursuant to Article 6(1)(f) of the GDPR; and (iv) the data subject's consent, pursuant to Article 6(1)(a) of the GDPR, where required for sending marketing communications or using technologies that are not strictly necessary for the operation of the Website.
The processing of technical data for Website operation, security and cookie-free statistics is based, where applicable, on the Data Controller's legitimate interests. The use of Google Analytics is based on the user's prior consent. Third-party audiovisual and mapping content is activated at the user's request and, where legally required, subject to prior consent. The processing of technical data through Google reCAPTCHA is based, where applicable, on the Data Controller's legitimate interests in preventing spam and automated submissions, without prejudice to any consent requirements applicable to cookies or similar technologies.
Marketing communications shall also comply with Article 21 of the LSSI-CE.
4. Source of the Data
Generally speaking, personal data will be obtained directly from the data subject via contact forms, electronic communications or other channels provided on the Website. Certain technical data may be obtained automatically whilst browsing.
Where personal data relating to third parties is provided, the person providing such data must have sufficient authorisation to do so and must provide them, where required, with the relevant information regarding the processing.
5. External Links and Third-Party Content
The Website contains a link to the Data Controller’s Instagram profile, operated by Meta Platforms Ireland Limited, with its registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
No Instagram content is embedded in the Website, and no personal data is transmitted to Meta merely by accessing the Website. Meta may process personal data when users follow the external link to Instagram, in accordance with its own privacy policy.
The Website may also display audiovisual content hosted by Vimeo. Such content is not loaded automatically and is only activated when the user chooses to play the video. Upon activation, the user’s browser may communicate with Vimeo, which may process certain technical information in accordance with its own privacy policy (https://vimeo.com/privacy).
The Website may also include interactive maps provided by Google Maps. When users activate such content, certain technical information, including their IP address and browser data, may be transmitted to Google. Further information on Google's processing of personal data is available at https://policies.google.com/privacy.
6. Mandatory or Optional Nature of Data
The forms on the Website will specify, where applicable, the data required to deal with users’ enquiries.
Failure to provide the data marked as mandatory may prevent the processing of the relevant enquiry or request.
All other data is optional, although it may subsequently be required to formalise or fulfil a contractual relationship.
7. Retention Periods
Personal data will be retained for the following periods:
a) Enquiries and requests for information: for as long as necessary to deal with the request and, subsequently, for the applicable limitation periods where necessary to address any potential liabilities.
b) Pre-contractual and contractual relationships: for the duration of the relevant relationship and, subsequently, for the applicable statutory retention and limitation periods.
c) Marketing communications: until the data subject withdraws their consent or exercises their right to object, without prejudice to retaining the minimum information necessary to prove such consent or to manage the opt-out from future mailings.
d) Technical data and security logs: for the period strictly necessary and proportionate to ensure the security and proper operation of the Website, in accordance with the retention periods applicable to the technological services used.
Where applicable, data may be retained in a duly restricted form for the periods required by law, prior to its permanent deletion.
8. Recipients of the Data
The Data Controller uses third-party technology providers to operate the Website and manage communications, including:
– Framer: Website hosting, technical operation, contact form processing and cookie-free website statistics.
– Make.com: Automated transmission of contact form enquiries to the Data Controller’s email system.
– Kufgem GmbH: Provision and management of the Data Controller’s email services, including the receipt, storage and processing of electronic communications and enquiries submitted through the Website.
– Vimeo: Hosting and playback of audiovisual content expressly requested by users of the Website.
– Google Ireland Limited (Google Analytics, Google Maps and Google reCAPTCHA): Provision of website traffic analysis, interactive mapping and security services designed to prevent spam and automated submissions. Depending on the service used, Google may process technical information, including IP addresses, device and browser data, online identifiers and information relating to users’ interactions with the Website. Further information is available at https://policies.google.com/privacy
These providers may process personal data to the extent necessary to provide their respective services, subject to applicable data protection obligations and contractual safeguards. Where a provider acts as a data processor on behalf of the Data Controller, the relevant data processing agreements and safeguards shall apply.
9. International Data Transfers
The Data Controller uses technology providers, including Framer, Make.com, Kufgem GmbH, Vimeo and Google Ireland Limited, for Website operation, communications, analytics, mapping and security services. Certain services provided by these entities or their subprocessors may involve the transfer of personal data to countries outside the European Economic Area (EEA), including the United States.
Where international transfers of personal data take place, they shall be subject to the safeguards required under Chapter V of the GDPR, including, as applicable, adequacy decisions of the European Commission, the EU-US Data Privacy Framework for eligible certified recipients, or the European Commission's Standard Contractual Clauses, together with any necessary supplementary measures. Users may request further information on the applicable international transfers and safeguards by contacting info@cavenatelier.com.
10. Rights of Data Subjects
Data subjects may exercise the following rights, in accordance with the terms set out in current legislation:
– Access: to find out whether their personal data is being processed and to obtain information about such processing.
– Rectification: to request the correction of inaccurate or incomplete data.
– Erasure: to request the deletion of their data where the legal requirements are met.
– Objection: to object to the processing of their data in the circumstances provided for by law.
– Restriction of processing: to request that processing be restricted in certain circumstances.
– Portability: to receive personal data in a structured, commonly used and machine-readable format and, where applicable, to transmit it to another data controller.
– Withdrawal of consent: to withdraw the consent given at any time, without this affecting the lawfulness of any processing carried out previously.
To exercise these rights, the data subject may submit a request by email to info@cavenatelier.com, or by post to the data controller’s registered office, specifying the right they wish to exercise.
The Data Controller may request additional information where necessary to reasonably verify the identity of the applicant.
Furthermore, data subjects may lodge a complaint with the Spanish Data Protection Agency, located at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es), if they consider that the processing of their personal data breaches the applicable regulations.
11. Security Measures
The Data Controller shall adopt appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data, in accordance with the provisions of Article 32 of the GDPR.
These measures will be aimed, amongst other purposes, at preserving the confidentiality, integrity and availability of the data and at preventing its loss, alteration, disclosure or unauthorised access.
12. Minors
The Website is not specifically aimed at minors.
Where the processing of personal data is based on the consent of a child, the legally established requirements shall be observed, including the involvement of their legal representatives where required.
13. Automated Decision-Making and Profiling
The Data Controller does not, within the scope of the processing operations described in this Policy, make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them, in accordance with Article 22 of the GDPR.
14. Cookie Policy
The Website uses cookies and similar technologies to ensure its proper operation, improve user experience, analyse Website traffic and provide certain third-party functionalities.
Cookies are small files stored on users' devices when visiting websites. Depending on their purpose, the Website may use the following technologies:
a) Strictly necessary cookies: These cookies are used to ensure the security, proper functioning and essential features of the Website. They may include security technologies used by service providers, such as Google reCAPTCHA, where strictly necessary to protect contact forms against spam and automated submissions. These cookies do not require prior consent where exempted under applicable law.
b) Website analytics: The Website uses Framer's built-in analytics tools, which provide aggregated visitor statistics without placing tracking cookies or persistent identifiers on users' devices. The Website may also use Google Analytics to analyse website traffic and user interactions. Google Analytics cookies will only be activated after obtaining the user's prior consent.
c) Third-party content: The Website may include audiovisual content hosted by Vimeo and interactive maps provided by Google Maps. These services may use cookies or similar technologies when their content is activated. Vimeo videos are loaded only when requested by the user, with the Do Not Track (DNT) setting enabled. Where legally required, third-party cookies will only be activated after obtaining the user's prior consent.
Where consent is required, users may accept, reject or manage non-essential cookies through the cookie preferences tool available on the Website. Users may withdraw or modify their consent at any time through the same tool.
Users may also manage or delete cookies through their browser settings. Disabling certain cookies may affect the availability or functionality of some Website features.
Further information on the cookies and data processing practices of the relevant providers is available through their respective policies:
– Framer: https://www.framer.com/legal/privacy-statement/
– Google: https://policies.google.com/technologies/cookies
– Vimeo: https://vimeo.com/legal/privacy/cookies
The Website does not use cookies for behavioural advertising or commercial profiling. Should additional cookies or tracking technologies be introduced, this Policy will be updated and the appropriate consent mechanisms will be implemented where required by applicable law.
15. Changes to the Privacy Policy
The Data Controller may amend this Privacy Policy to bring it into line with regulatory changes, the guidelines of supervisory authorities or changes to the processing of personal data carried out via the Website.
The current version will be available on the Website. Where amendments so require by law, data subjects will be specifically informed or new consent will be sought.
Date of last update: 28 October 2026.
This Website is operated by CAVËN ATELIER, S.L. (hereinafter, the “Data Controller”). We are committed to protecting users' privacy and providing clear information on how their personal data is collected, used and protected.
– Personal data is not sold to third parties.
– Only personal data necessary to operate the Website, manage enquiries and provide the relevant services is collected.
– Users may contact the Data Controller at any time at info@cavenatelier.com
1. Data Controller
In compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (hereinafter, “GDPR”), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, “LOPDGDD”) and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (hereinafter “LSSI-CE”), users are hereby informed that the data controller responsible for the processing of personal data collected via the website www.cavenatelier.com (hereinafter the “Website”) is:
CAVËN ATELIER, S.L.
Tax Identification Number: B-93773034
Registered office: Avenida Calderón de la Barca s/n, local 91-1, Urbanización Magna Marbella, Marbella (29660) Málaga, Spain
Email: info@cavenatelier.com
Domain: www.cavenatelier.com
2. Personal Data Subject to Processing
The Data Controller may process the following categories of personal data, depending on the user’s interaction with the Website:
a) Identification and contact details: first name, surname, email address, telephone number and, where applicable, the company or organisation you represent.
b) Data relating to enquiries and commercial requests: information provided voluntarily by the user in relation to vehicles, restoration projects, customisation or modification, requests for quotations, bookings or other commercial enquiries.
c) Browsing data: IP address, technical identifiers, information about the browser, device used and other data derived from accessing or using the Website.
d) Data arising from pre-contractual or contractual relationships: information necessary to prepare quotations, manage orders or formalise commercial transactions, where applicable.
The Data Controller does not, as a general rule, request special categories of personal data via the Website. Users are asked to avoid providing information of this nature unless it is strictly necessary and has been expressly requested.
3. Purposes of Processing and Legal Bases
In accordance with Article 6.1 of the GDPR and Article 21 of the LSSI-CE, personal data may be processed for the following purposes:
a) Handling enquiries and requests for information: To manage requests received via forms, email or other contact methods provided on the Website, as well as to provide information on vehicles, services and restoration or modification projects.
b) Management of pre-contractual and contractual relationships: To prepare quotations, commercial proposals, booking documents, contracts and other documentation relating to the transactions requested by the data subject, as well as to manage, where applicable, their execution and follow-up.
c) Sending commercial communications: To send information on news, vehicles, projects, events, products or services offered by the Data Controller, where the user has provided their consent or another valid legal basis applies.
d) Website security and operation: To ensure the security of the Website, prevent unauthorised access, detect technical incidents and maintain its proper functioning.
e) Website statistics: To obtain aggregated statistics on Website visits and performance through Framer’s built-in analytics tools, without using tracking cookies or persistent identifiers.
f) Audiovisual content: To allow users to view audiovisual content hosted by Vimeo, which is loaded only at the user's express request.
g) Website analytics: To analyse Website traffic, usage patterns and visitor interactions through Google Analytics, with the aim of improving the Website’s content, performance and user experience. This processing is subject to the user’s prior consent.
h) Third-party functionality and security: To display interactive maps provided by Google Maps and to protect the Website's contact forms against spam, automated submissions and other abusive activities through Google reCAPTCHA. These services may involve the processing of technical information, including IP addresses and device or browser data.
The legal bases for the above processing activities are, as applicable: (i) taking steps at the request of the data subject prior to entering into a contract or performing a contract, pursuant to Article 6(1)(b) of the GDPR; (ii) compliance with legal obligations applicable to the Data Controller, pursuant to Article 6(1)(c) of the GDPR; (iii) the Data Controller's legitimate interests in ensuring the security, maintenance and proper operation of the Website, pursuant to Article 6(1)(f) of the GDPR; and (iv) the data subject's consent, pursuant to Article 6(1)(a) of the GDPR, where required for sending marketing communications or using technologies that are not strictly necessary for the operation of the Website.
The processing of technical data for Website operation, security and cookie-free statistics is based, where applicable, on the Data Controller's legitimate interests. The use of Google Analytics is based on the user's prior consent. Third-party audiovisual and mapping content is activated at the user's request and, where legally required, subject to prior consent. The processing of technical data through Google reCAPTCHA is based, where applicable, on the Data Controller's legitimate interests in preventing spam and automated submissions, without prejudice to any consent requirements applicable to cookies or similar technologies.
Marketing communications shall also comply with Article 21 of the LSSI-CE.
4. Source of the Data
Generally speaking, personal data will be obtained directly from the data subject via contact forms, electronic communications or other channels provided on the Website. Certain technical data may be obtained automatically whilst browsing.
Where personal data relating to third parties is provided, the person providing such data must have sufficient authorisation to do so and must provide them, where required, with the relevant information regarding the processing.
5. External Links and Third-Party Content
The Website contains a link to the Data Controller’s Instagram profile, operated by Meta Platforms Ireland Limited, with its registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
No Instagram content is embedded in the Website, and no personal data is transmitted to Meta merely by accessing the Website. Meta may process personal data when users follow the external link to Instagram, in accordance with its own privacy policy.
The Website may also display audiovisual content hosted by Vimeo. Such content is not loaded automatically and is only activated when the user chooses to play the video. Upon activation, the user’s browser may communicate with Vimeo, which may process certain technical information in accordance with its own privacy policy (https://vimeo.com/privacy).
The Website may also include interactive maps provided by Google Maps. When users activate such content, certain technical information, including their IP address and browser data, may be transmitted to Google. Further information on Google's processing of personal data is available at https://policies.google.com/privacy.
6. Mandatory or Optional Nature of Data
The forms on the Website will specify, where applicable, the data required to deal with users’ enquiries.
Failure to provide the data marked as mandatory may prevent the processing of the relevant enquiry or request.
All other data is optional, although it may subsequently be required to formalise or fulfil a contractual relationship.
7. Retention Periods
Personal data will be retained for the following periods:
a) Enquiries and requests for information: for as long as necessary to deal with the request and, subsequently, for the applicable limitation periods where necessary to address any potential liabilities.
b) Pre-contractual and contractual relationships: for the duration of the relevant relationship and, subsequently, for the applicable statutory retention and limitation periods.
c) Marketing communications: until the data subject withdraws their consent or exercises their right to object, without prejudice to retaining the minimum information necessary to prove such consent or to manage the opt-out from future mailings.
d) Technical data and security logs: for the period strictly necessary and proportionate to ensure the security and proper operation of the Website, in accordance with the retention periods applicable to the technological services used.
Where applicable, data may be retained in a duly restricted form for the periods required by law, prior to its permanent deletion.
8. Recipients of the Data
The Data Controller uses third-party technology providers to operate the Website and manage communications, including:
– Framer: Website hosting, technical operation, contact form processing and cookie-free website statistics.
– Make.com: Automated transmission of contact form enquiries to the Data Controller’s email system.
– Kufgem GmbH: Provision and management of the Data Controller’s email services, including the receipt, storage and processing of electronic communications and enquiries submitted through the Website.
– Vimeo: Hosting and playback of audiovisual content expressly requested by users of the Website.
– Google Ireland Limited (Google Analytics, Google Maps and Google reCAPTCHA): Provision of website traffic analysis, interactive mapping and security services designed to prevent spam and automated submissions. Depending on the service used, Google may process technical information, including IP addresses, device and browser data, online identifiers and information relating to users’ interactions with the Website. Further information is available at https://policies.google.com/privacy
These providers may process personal data to the extent necessary to provide their respective services, subject to applicable data protection obligations and contractual safeguards. Where a provider acts as a data processor on behalf of the Data Controller, the relevant data processing agreements and safeguards shall apply.
9. International Data Transfers
The Data Controller uses technology providers, including Framer, Make.com, Kufgem GmbH, Vimeo and Google Ireland Limited, for Website operation, communications, analytics, mapping and security services. Certain services provided by these entities or their subprocessors may involve the transfer of personal data to countries outside the European Economic Area (EEA), including the United States.
Where international transfers of personal data take place, they shall be subject to the safeguards required under Chapter V of the GDPR, including, as applicable, adequacy decisions of the European Commission, the EU-US Data Privacy Framework for eligible certified recipients, or the European Commission's Standard Contractual Clauses, together with any necessary supplementary measures. Users may request further information on the applicable international transfers and safeguards by contacting info@cavenatelier.com.
10. Rights of Data Subjects
Data subjects may exercise the following rights, in accordance with the terms set out in current legislation:
– Access: to find out whether their personal data is being processed and to obtain information about such processing.
– Rectification: to request the correction of inaccurate or incomplete data.
– Erasure: to request the deletion of their data where the legal requirements are met.
– Objection: to object to the processing of their data in the circumstances provided for by law.
– Restriction of processing: to request that processing be restricted in certain circumstances.
– Portability: to receive personal data in a structured, commonly used and machine-readable format and, where applicable, to transmit it to another data controller.
– Withdrawal of consent: to withdraw the consent given at any time, without this affecting the lawfulness of any processing carried out previously.
To exercise these rights, the data subject may submit a request by email to info@cavenatelier.com, or by post to the data controller’s registered office, specifying the right they wish to exercise.
The Data Controller may request additional information where necessary to reasonably verify the identity of the applicant.
Furthermore, data subjects may lodge a complaint with the Spanish Data Protection Agency, located at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es), if they consider that the processing of their personal data breaches the applicable regulations.
11. Security Measures
The Data Controller shall adopt appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data, in accordance with the provisions of Article 32 of the GDPR.
These measures will be aimed, amongst other purposes, at preserving the confidentiality, integrity and availability of the data and at preventing its loss, alteration, disclosure or unauthorised access.
12. Minors
The Website is not specifically aimed at minors.
Where the processing of personal data is based on the consent of a child, the legally established requirements shall be observed, including the involvement of their legal representatives where required.
13. Automated Decision-Making and Profiling
The Data Controller does not, within the scope of the processing operations described in this Policy, make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them, in accordance with Article 22 of the GDPR.
14. Cookie Policy
The Website uses cookies and similar technologies to ensure its proper operation, improve user experience, analyse Website traffic and provide certain third-party functionalities.
Cookies are small files stored on users' devices when visiting websites. Depending on their purpose, the Website may use the following technologies:
a) Strictly necessary cookies: These cookies are used to ensure the security, proper functioning and essential features of the Website. They may include security technologies used by service providers, such as Google reCAPTCHA, where strictly necessary to protect contact forms against spam and automated submissions. These cookies do not require prior consent where exempted under applicable law.
b) Website analytics: The Website uses Framer's built-in analytics tools, which provide aggregated visitor statistics without placing tracking cookies or persistent identifiers on users' devices. The Website may also use Google Analytics to analyse website traffic and user interactions. Google Analytics cookies will only be activated after obtaining the user's prior consent.
c) Third-party content: The Website may include audiovisual content hosted by Vimeo and interactive maps provided by Google Maps. These services may use cookies or similar technologies when their content is activated. Vimeo videos are loaded only when requested by the user, with the Do Not Track (DNT) setting enabled. Where legally required, third-party cookies will only be activated after obtaining the user's prior consent.
Where consent is required, users may accept, reject or manage non-essential cookies through the cookie preferences tool available on the Website. Users may withdraw or modify their consent at any time through the same tool.
Users may also manage or delete cookies through their browser settings. Disabling certain cookies may affect the availability or functionality of some Website features.
Further information on the cookies and data processing practices of the relevant providers is available through their respective policies:
– Framer: https://www.framer.com/legal/privacy-statement/
– Google: https://policies.google.com/technologies/cookies
– Vimeo: https://vimeo.com/legal/privacy/cookies
The Website does not use cookies for behavioural advertising or commercial profiling. Should additional cookies or tracking technologies be introduced, this Policy will be updated and the appropriate consent mechanisms will be implemented where required by applicable law.
15. Changes to the Privacy Policy
The Data Controller may amend this Privacy Policy to bring it into line with regulatory changes, the guidelines of supervisory authorities or changes to the processing of personal data carried out via the Website.
The current version will be available on the Website. Where amendments so require by law, data subjects will be specifically informed or new consent will be sought.
Date of last update: 28 October 2026.
This Website is operated by CAVËN ATELIER, S.L. (hereinafter, the “Data Controller”). We are committed to protecting users' privacy and providing clear information on how their personal data is collected, used and protected.
– Personal data is not sold to third parties.
– Only personal data necessary to operate the Website, manage enquiries and provide the relevant services is collected.
– Users may contact the Data Controller at any time at info@cavenatelier.com
1. Data Controller
In compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (hereinafter, “GDPR”), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, “LOPDGDD”) and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (hereinafter “LSSI-CE”), users are hereby informed that the data controller responsible for the processing of personal data collected via the website www.cavenatelier.com (hereinafter the “Website”) is:
CAVËN ATELIER, S.L.
Tax Identification Number: B-93773034
Registered office: Avenida Calderón de la Barca s/n, local 91-1, Urbanización Magna Marbella, Marbella (29660) Málaga, Spain
Email: info@cavenatelier.com
Domain: www.cavenatelier.com
2. Personal Data Subject to Processing
The Data Controller may process the following categories of personal data, depending on the user’s interaction with the Website:
a) Identification and contact details: first name, surname, email address, telephone number and, where applicable, the company or organisation you represent.
b) Data relating to enquiries and commercial requests: information provided voluntarily by the user in relation to vehicles, restoration projects, customisation or modification, requests for quotations, bookings or other commercial enquiries.
c) Browsing data: IP address, technical identifiers, information about the browser, device used and other data derived from accessing or using the Website.
d) Data arising from pre-contractual or contractual relationships: information necessary to prepare quotations, manage orders or formalise commercial transactions, where applicable.
The Data Controller does not, as a general rule, request special categories of personal data via the Website. Users are asked to avoid providing information of this nature unless it is strictly necessary and has been expressly requested.
3. Purposes of Processing and Legal Bases
In accordance with Article 6.1 of the GDPR and Article 21 of the LSSI-CE, personal data may be processed for the following purposes:
a) Handling enquiries and requests for information: To manage requests received via forms, email or other contact methods provided on the Website, as well as to provide information on vehicles, services and restoration or modification projects.
b) Management of pre-contractual and contractual relationships: To prepare quotations, commercial proposals, booking documents, contracts and other documentation relating to the transactions requested by the data subject, as well as to manage, where applicable, their execution and follow-up.
c) Sending commercial communications: To send information on news, vehicles, projects, events, products or services offered by the Data Controller, where the user has provided their consent or another valid legal basis applies.
d) Website security and operation: To ensure the security of the Website, prevent unauthorised access, detect technical incidents and maintain its proper functioning.
e) Website statistics: To obtain aggregated statistics on Website visits and performance through Framer’s built-in analytics tools, without using tracking cookies or persistent identifiers.
f) Audiovisual content: To allow users to view audiovisual content hosted by Vimeo, which is loaded only at the user's express request.
g) Website analytics: To analyse Website traffic, usage patterns and visitor interactions through Google Analytics, with the aim of improving the Website’s content, performance and user experience. This processing is subject to the user’s prior consent.
h) Third-party functionality and security: To display interactive maps provided by Google Maps and to protect the Website's contact forms against spam, automated submissions and other abusive activities through Google reCAPTCHA. These services may involve the processing of technical information, including IP addresses and device or browser data.
The legal bases for the above processing activities are, as applicable: (i) taking steps at the request of the data subject prior to entering into a contract or performing a contract, pursuant to Article 6(1)(b) of the GDPR; (ii) compliance with legal obligations applicable to the Data Controller, pursuant to Article 6(1)(c) of the GDPR; (iii) the Data Controller's legitimate interests in ensuring the security, maintenance and proper operation of the Website, pursuant to Article 6(1)(f) of the GDPR; and (iv) the data subject's consent, pursuant to Article 6(1)(a) of the GDPR, where required for sending marketing communications or using technologies that are not strictly necessary for the operation of the Website.
The processing of technical data for Website operation, security and cookie-free statistics is based, where applicable, on the Data Controller's legitimate interests. The use of Google Analytics is based on the user's prior consent. Third-party audiovisual and mapping content is activated at the user's request and, where legally required, subject to prior consent. The processing of technical data through Google reCAPTCHA is based, where applicable, on the Data Controller's legitimate interests in preventing spam and automated submissions, without prejudice to any consent requirements applicable to cookies or similar technologies.
Marketing communications shall also comply with Article 21 of the LSSI-CE.
4. Source of the Data
Generally speaking, personal data will be obtained directly from the data subject via contact forms, electronic communications or other channels provided on the Website. Certain technical data may be obtained automatically whilst browsing.
Where personal data relating to third parties is provided, the person providing such data must have sufficient authorisation to do so and must provide them, where required, with the relevant information regarding the processing.
5. External Links and Third-Party Content
The Website contains a link to the Data Controller’s Instagram profile, operated by Meta Platforms Ireland Limited, with its registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
No Instagram content is embedded in the Website, and no personal data is transmitted to Meta merely by accessing the Website. Meta may process personal data when users follow the external link to Instagram, in accordance with its own privacy policy.
The Website may also display audiovisual content hosted by Vimeo. Such content is not loaded automatically and is only activated when the user chooses to play the video. Upon activation, the user’s browser may communicate with Vimeo, which may process certain technical information in accordance with its own privacy policy (https://vimeo.com/privacy).
The Website may also include interactive maps provided by Google Maps. When users activate such content, certain technical information, including their IP address and browser data, may be transmitted to Google. Further information on Google's processing of personal data is available at https://policies.google.com/privacy.
6. Mandatory or Optional Nature of Data
The forms on the Website will specify, where applicable, the data required to deal with users’ enquiries.
Failure to provide the data marked as mandatory may prevent the processing of the relevant enquiry or request.
All other data is optional, although it may subsequently be required to formalise or fulfil a contractual relationship.
7. Retention Periods
Personal data will be retained for the following periods:
a) Enquiries and requests for information: for as long as necessary to deal with the request and, subsequently, for the applicable limitation periods where necessary to address any potential liabilities.
b) Pre-contractual and contractual relationships: for the duration of the relevant relationship and, subsequently, for the applicable statutory retention and limitation periods.
c) Marketing communications: until the data subject withdraws their consent or exercises their right to object, without prejudice to retaining the minimum information necessary to prove such consent or to manage the opt-out from future mailings.
d) Technical data and security logs: for the period strictly necessary and proportionate to ensure the security and proper operation of the Website, in accordance with the retention periods applicable to the technological services used.
Where applicable, data may be retained in a duly restricted form for the periods required by law, prior to its permanent deletion.
8. Recipients of the Data
The Data Controller uses third-party technology providers to operate the Website and manage communications, including:
– Framer: Website hosting, technical operation, contact form processing and cookie-free website statistics.
– Make.com: Automated transmission of contact form enquiries to the Data Controller’s email system.
– Kufgem GmbH: Provision and management of the Data Controller’s email services, including the receipt, storage and processing of electronic communications and enquiries submitted through the Website.
– Vimeo: Hosting and playback of audiovisual content expressly requested by users of the Website.
– Google Ireland Limited (Google Analytics, Google Maps and Google reCAPTCHA): Provision of website traffic analysis, interactive mapping and security services designed to prevent spam and automated submissions. Depending on the service used, Google may process technical information, including IP addresses, device and browser data, online identifiers and information relating to users’ interactions with the Website. Further information is available at https://policies.google.com/privacy
These providers may process personal data to the extent necessary to provide their respective services, subject to applicable data protection obligations and contractual safeguards. Where a provider acts as a data processor on behalf of the Data Controller, the relevant data processing agreements and safeguards shall apply.
9. International Data Transfers
The Data Controller uses technology providers, including Framer, Make.com, Kufgem GmbH, Vimeo and Google Ireland Limited, for Website operation, communications, analytics, mapping and security services. Certain services provided by these entities or their subprocessors may involve the transfer of personal data to countries outside the European Economic Area (EEA), including the United States.
Where international transfers of personal data take place, they shall be subject to the safeguards required under Chapter V of the GDPR, including, as applicable, adequacy decisions of the European Commission, the EU-US Data Privacy Framework for eligible certified recipients, or the European Commission's Standard Contractual Clauses, together with any necessary supplementary measures. Users may request further information on the applicable international transfers and safeguards by contacting info@cavenatelier.com.
10. Rights of Data Subjects
Data subjects may exercise the following rights, in accordance with the terms set out in current legislation:
– Access: to find out whether their personal data is being processed and to obtain information about such processing.
– Rectification: to request the correction of inaccurate or incomplete data.
– Erasure: to request the deletion of their data where the legal requirements are met.
– Objection: to object to the processing of their data in the circumstances provided for by law.
– Restriction of processing: to request that processing be restricted in certain circumstances.
– Portability: to receive personal data in a structured, commonly used and machine-readable format and, where applicable, to transmit it to another data controller.
– Withdrawal of consent: to withdraw the consent given at any time, without this affecting the lawfulness of any processing carried out previously.
To exercise these rights, the data subject may submit a request by email to info@cavenatelier.com, or by post to the data controller’s registered office, specifying the right they wish to exercise.
The Data Controller may request additional information where necessary to reasonably verify the identity of the applicant.
Furthermore, data subjects may lodge a complaint with the Spanish Data Protection Agency, located at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es), if they consider that the processing of their personal data breaches the applicable regulations.
11. Security Measures
The Data Controller shall adopt appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data, in accordance with the provisions of Article 32 of the GDPR.
These measures will be aimed, amongst other purposes, at preserving the confidentiality, integrity and availability of the data and at preventing its loss, alteration, disclosure or unauthorised access.
12. Minors
The Website is not specifically aimed at minors.
Where the processing of personal data is based on the consent of a child, the legally established requirements shall be observed, including the involvement of their legal representatives where required.
13. Automated Decision-Making and Profiling
The Data Controller does not, within the scope of the processing operations described in this Policy, make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them, in accordance with Article 22 of the GDPR.
14. Cookie Policy
The Website uses cookies and similar technologies to ensure its proper operation, improve user experience, analyse Website traffic and provide certain third-party functionalities.
Cookies are small files stored on users' devices when visiting websites. Depending on their purpose, the Website may use the following technologies:
a) Strictly necessary cookies: These cookies are used to ensure the security, proper functioning and essential features of the Website. They may include security technologies used by service providers, such as Google reCAPTCHA, where strictly necessary to protect contact forms against spam and automated submissions. These cookies do not require prior consent where exempted under applicable law.
b) Website analytics: The Website uses Framer's built-in analytics tools, which provide aggregated visitor statistics without placing tracking cookies or persistent identifiers on users' devices. The Website may also use Google Analytics to analyse website traffic and user interactions. Google Analytics cookies will only be activated after obtaining the user's prior consent.
c) Third-party content: The Website may include audiovisual content hosted by Vimeo and interactive maps provided by Google Maps. These services may use cookies or similar technologies when their content is activated. Vimeo videos are loaded only when requested by the user, with the Do Not Track (DNT) setting enabled. Where legally required, third-party cookies will only be activated after obtaining the user's prior consent.
Where consent is required, users may accept, reject or manage non-essential cookies through the cookie preferences tool available on the Website. Users may withdraw or modify their consent at any time through the same tool.
Users may also manage or delete cookies through their browser settings. Disabling certain cookies may affect the availability or functionality of some Website features.
Further information on the cookies and data processing practices of the relevant providers is available through their respective policies:
– Framer: https://www.framer.com/legal/privacy-statement/
– Google: https://policies.google.com/technologies/cookies
– Vimeo: https://vimeo.com/legal/privacy/cookies
The Website does not use cookies for behavioural advertising or commercial profiling. Should additional cookies or tracking technologies be introduced, this Policy will be updated and the appropriate consent mechanisms will be implemented where required by applicable law.
15. Changes to the Privacy Policy
The Data Controller may amend this Privacy Policy to bring it into line with regulatory changes, the guidelines of supervisory authorities or changes to the processing of personal data carried out via the Website.
The current version will be available on the Website. Where amendments so require by law, data subjects will be specifically informed or new consent will be sought.
Date of last update: 28 October 2026.