VESTIGE
Privacy notice
Last updated: 14 October 2026
1. Controller
The data controller is Carlota Campos Irisarri, operating under the trading name Vestige.
Address: Calle Nápoles 5, 28224 Pozuelo de Alarcón, Madrid, Spain.
Contact and privacy email: carlota@vestigeloyalty.com.
2. Data and purposes
When you contact Vestige, we process the details you provide: your name, email address, organisation and enquiry. We use them to respond, understand your request and manage the related conversations.
If you book a call, we also process the date and time, the information needed to manage the booking and confirmations, and the meeting link. Booking records are held in the website infrastructure, and meetings are managed through Google Calendar and Google Meet.
Required fields allow us to identify you and respond or manage the booking. We cannot complete that request without them. Additional context is optional: please avoid including sensitive information or unnecessary personal details about your clients.
3. Legal bases
When you request information about our services or a meeting to discuss engaging us, we process the necessary data to take steps at your request before entering into a contract (GDPR Article 6(1)(b)). For professional enquiries on behalf of an organisation and other communications, we rely, where applicable, on our legitimate interest in responding to the request and maintaining that professional relationship (Article 6(1)(f)). You may object to processing based on legitimate interests on grounds relating to your particular situation.
Website protection and abuse prevention rely on our legitimate interest in maintaining a secure service. Processing required by law relies on Article 6(1)(c).
4. Retention
Enquiries that do not lead to a client relationship will be retained for 12 months from the last contact. After that period, they will be deleted, unless limited information needs to be retained to meet a legal obligation or address a claim; its use will then be restricted to that purpose for the applicable period.
Booking data is retained for as long as needed to manage the meeting, changes and related follow-up. If a client relationship begins, data needed to provide the service is retained during that relationship and subsequently for applicable legal or liability periods. The 12-month enquiry period does not replace those criteria.
Pending enquiry and booking details may be temporarily held in browser session storage to support retries. They are removed from that storage when the operation is confirmed; you can also remove them by clearing browsing data. Closing a tab does not automatically delete records held outside your browser.
5. Providers and recipients
We use technology providers to host and operate the website, send emails and arrange meetings: OpenAI Sites and its hosting infrastructure, including Cloudflare; Resend for sending enquiries and confirmations; and Google for calendar functions, invitations and Google Meet. These services may process the data needed to perform their functions. Data may also be disclosed to authorities where legally required.
We do not sell information submitted through our forms or use an enquiry or booking to subscribe you to marketing communications.
6. Newsletter
The newsletter is on a separate site hosted by Beehiiv. Sending an enquiry or booking a call on this website does not subscribe you to the newsletter. Subscription is voluntary and managed on that site; you can unsubscribe using the link in the emails. Please read the information accompanying the signup form and Beehiiv’s privacy policy.
7. International services
Some providers may process data outside the European Economic Area, including in the United States. Resend’s data processing agreement describes its use of standard contractual clauses for transfers that require them. Google publishes its transfer frameworks and safeguards. You can request information about the safeguards applicable to your data by contacting the privacy email address.
8. Browsing and external resources
The website loads fonts from Google Fonts and some images or logos from external providers, including Brandfetch. When requesting these resources, your browser shares technical information, such as your IP address and request details, with those providers. Hosting infrastructure may process technical logs to deliver and protect the service.
We have not added analytics tools or advertising pixels to this website’s code. Session storage supports the functions described above. Linked external services, such as Beehiiv or Google Meet, have their own terms and policies.
9. Your rights
You can request access, correction or deletion of your data, restriction of processing, objection and portability where applicable. Where processing relies on your consent, you can withdraw it without affecting the lawfulness of earlier processing.
Write to carlota@vestigeloyalty.com or the postal address above, explaining your request. If there are reasonable doubts about your identity, we may request the information needed to verify it. You can also complain to the Spanish Data Protection Agency (AEPD).
We do not use form data to make solely automated decisions that produce legal or similarly significant effects on you.
10. Changes
We will update this notice when the controller, providers or use of data changes. If the activity moves to a company, we will identify the new controller and communicate changes as required.