Privacy Policy

01The short version

This summary is for convenience. The full policy below controls.

• What we collect: the details you send through our contact form (name, email, company, service of interest, and your message) and basic technical data about your visit.
• Why: to answer your inquiry, deliver our services, keep the Site secure, and understand how the Site is used.
• Who we share it with: only service providers that help us run the Site and our business (such as hosting, email delivery, and bot protection), professional advisors, and authorities when the law requires it.
• What we do not do: we do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use advertising cookies or tracking pixels on the Site.
• Your control: you can ask us to access, correct, or delete your information, or opt out of marketing emails, at any time by writing to info@legadocreativo.com.

02Personal information we collect

Information you provide to us

Personal information you may provide through the Site or otherwise includes:

• Contact data, such as your name, email address, and company name, and, if you choose to share them, your phone number, job title, and mailing address.
• Communications data, such as the service you are interested in, the content of your message (for example, project goals, timelines, and budget), and our correspondence with you by form, email, phone, or social media.
• Client engagement data, if you become a client or collaborator: billing and mailing addresses, project briefs, brand assets and files you share with us, approvals and feedback, and invoicing and transaction records. Payment card and bank details are collected by our payment providers, not through the Site.
• Marketing data, such as your preferences for receiving communications from us.

Our contact form asks only for your name, email address, company (optional), the service you are interested in, and your message. Please do not include sensitive information in the form or in your emails to us, such as Social Security or other government ID numbers, financial account or payment card numbers, health information, or passwords. We do not need it to respond to your inquiry.

Information collected automatically

When you visit the Site, we and our service providers automatically log certain information about your device and your interaction with the Site, such as:

• Device data, such as your IP address, browser type and version, operating system, device type, screen size, language setting, and approximate location (city, region, or country) inferred from your IP address.
• Online activity data, such as the pages you view, the website that referred you, and the date and time of your visit.
• Security data, such as request logs and signals used to tell real visitors from bots (including by Cloudflare Turnstile) and to limit abusive traffic.

Information from other sources

We may receive information about you from social media platforms (for example, if you message or interact with us on Instagram or Facebook), from public sources such as your company's website or professional profiles, from referrals, and from service providers that support our business. We may combine it with the information you give us.

Information we do not collect

The Site has no user accounts or passwords, does not process payments, and does not request your precise geolocation. We do not knowingly collect information from children (see "Children's privacy").

03How we use your personal information

We use personal information for the following purposes, or as otherwise described when we collect it:

• Respond to you and deliver our services: to read and answer your inquiries, send an automatic confirmation that we received your message, prepare proposals, contracts, and invoices, and carry out client projects.
• Operate and secure the Site: to host and maintain the Site, protect it with spam filtering, bot detection, and rate limiting, fix errors, and prevent fraud, abuse, and cyberattacks.
• Improve the Site and our services: to understand which pages are visited, how visitors reach the Site, and how it performs, so we can improve content, design, and speed. We use Vercel Web Analytics for this, which measures aggregated traffic without cookies.
• Communicate with you: to send service-related messages and, where permitted by law (and with your consent where required), occasional updates about our work. You can opt out of marketing messages at any time.
• Comply with the law and protect rights: to meet legal obligations, respond to lawful requests, enforce our Terms of Service, and establish, exercise, or defend legal claims.
• Create aggregated or de-identified data: data that no longer identifies you, which we may use for lawful business purposes. We will not try to re-identify it.
• Further uses: for other purposes disclosed at the time of collection or compatible with the original purpose. If a new purpose is not compatible, we will ask for your consent first.

We do not sell your personal information, and we do not use it for automated decisions that produce legal or similarly significant effects.

04Cookies and similar technologies

Cookies are small files placed on your device. Similar technologies include browser local storage and pixel tags. This section is our Cookie Notice for the Site.

The Site uses only a minimal set of these technologies. We do not use advertising or cross-site tracking cookies, social media tracking pixels, or session-replay tools.

Emails. We do not use tracking pixels in our emails to measure opens or clicks. Our email provider may record technical delivery events, such as whether a message was delivered or bounced.

Your choices

• Browser controls. Most browsers let you block or delete cookies and local storage in their settings. If you do, parts of the Site, such as the language memory and the contact form's security check, may not work as intended.
• Global Privacy Control and Do Not Track. The Site does not track you across other websites or use your data for targeted advertising, so there is nothing for these signals to switch off. We treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal information.
• Blocking images. You can configure your browser or device to prevent images from loading.

If we add analytics, advertising, or other tracking technologies in the future, we will update this section and, where the law requires, ask for your consent first.

05How we share your personal information

We do not sell your personal information. We share it only as described below, or as otherwise disclosed to you at the time of collection:

• Service providers. Companies that process personal information on our behalf to help run the Site and our business, under terms that limit how they may use it. The providers we currently use for the Site are listed below.
• Professional advisors, such as lawyers, accountants, and insurers, in the course of the services they provide to us.
• Authorities and others, when we believe in good faith that disclosure is required by law, subpoena, or legal process, or is necessary to protect our rights, property, or safety or those of others, or to detect and prevent fraud and security issues.
• Business transferees, in connection with an actual or prospective merger, acquisition, financing, or sale of all or part of our business or assets.
• Third parties you direct us to, or with your consent.

If you become a client, we may also use invoicing, payment, file-sharing, and project-management tools. Their providers process information under their own privacy policies and our agreements with them.

06Retention

We keep personal information for as long as needed to fulfill the purposes described in this policy, including answering inquiries, performing client work, and meeting legal, tax, accounting, and reporting requirements, resolving disputes, and enforcing our agreements. To decide how long, we consider the amount, nature, and sensitivity of the information, the risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve them another way, and applicable legal requirements.

When we no longer need personal information, we delete or anonymize it. If that is not possible right away (for example, because it sits in a backup), we securely store it and isolate it from further use until deletion is possible.

07Your choices and rights

Everyone can do the following, wherever they live:

• Access, correct, or delete. Ask us what personal information we hold about you, ask us to correct it, or ask us to delete it.
• Opt out of marketing. Use the unsubscribe instructions in any marketing email, or contact us. You may still receive service-related messages, such as replies to your inquiry or project communications.
• Withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect processing that happened before you withdrew it.
• Decline to provide information. You can choose not to give us information, but we may then be unable to respond to your inquiry or provide a service. Our contact form needs your name, email address, service of interest, and message to work.
• Cookies and tracking. See "Cookies and similar technologies" above.

To exercise any of these choices, write to info@legadocreativo.com. We may need to verify your identity before acting on a request. Residents of certain states and countries have additional rights, described below.

08State privacy rights (United States)

This section applies to residents of U.S. states whose comprehensive privacy laws apply to us, such as California, Colorado, Connecticut, Virginia, Texas, and Oregon (together, the "State Privacy Laws"). You may submit a request regardless of where you live in the United States, and we will handle it as required by the law that applies to you. Not every right is available in every state, and we may decline a request where the law permits.

Your rights

• Know and access: the categories of personal information we collected, the sources, our purposes, the categories of third parties we disclosed it to, and a copy of the personal information we hold about you.
• Correct inaccurate personal information.
• Delete the personal information we collected from you.
• Portability: receive your personal information in a portable format where the law provides.
• Opt out of the sale or sharing of personal information, targeted advertising, and profiling. See below: we do not engage in these activities.
• Limit the use of sensitive personal information. See below: we do not intentionally collect it.
• Appeal our decision on a request.
• Non-discrimination: we will not deny you services, charge different prices, or provide a different quality of service for exercising these rights.

Our practices

• No sale or sharing. In the 12 months before the date of this policy, we have not sold personal information or shared it for cross-context behavioral advertising. We have no actual knowledge that we sell or share the personal information of anyone under 16.
• No targeted advertising or profiling. We do not process personal information for targeted advertising, or for profiling that produces legal or similarly significant effects.
• Sensitive personal information. We do not intentionally collect it and do not use it to infer characteristics about you.
• De-identified data. We do not attempt to re-identify de-identified information.

How to submit a request

Email info@legadocreativo.com or call +1 (617) 515-5000. Use the subject "Privacy request," and tell us your state of residence and which right you want to exercise. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we may extend that period once by up to 45 more days and will tell you why.

To protect you, we verify requests by matching the information you give us (for example, the email address and details of your inquiry) against what we hold. We will not ask for government ID unless the law allows it and it is necessary. You may use an authorized agent to submit a request for you. We may ask for your signed written permission and to verify your identity directly.

If we deny your request, you may appeal by replying to our response with the subject "Appeal." We will respond in writing within the period the law requires (generally 45 to 60 days). If you are not satisfied with the result, you may contact your state attorney general.

Personal information we collect, use, and disclose

This chart covers the 12 months before the date of this policy and uses the categories in the California Consumer Privacy Act (Cal. Civ. Code § 1798.140). Information you type into free-form fields may contain other categories that you choose to share.

California

Shine the Light. Under California Civil Code § 1798.83, California residents who have an established business relationship with us may ask for the names of third parties to which we disclosed certain personal information for their direct marketing purposes during the previous calendar year. We do not disclose personal information to third parties for their direct marketing purposes. To make a request, email info@legadocreativo.com with "Shine the Light Request" in the subject line.

Nevada

Nevada residents may opt out of the sale of certain covered information. We do not sell covered information as defined by Nevada law. To submit a request, email info@legadocreativo.com.

09Notice to visitors outside the United States

Legado Creativo is based in the United States and operates the Site from the United States. We work with clients and collaborators internationally. If you contact us from the European Economic Area (EEA), the United Kingdom, or another country with data protection laws, this section adds to the rest of this policy. References to "personal information" include "personal data" as defined in those laws.

Controller

Legado Creativo is the controller of the personal data described in this policy. You can reach us using the details in "Contact us."

Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases:

Your rights

Depending on your location, you may have the right to:

• Access your personal data and receive a copy of it.
• Correct inaccurate or incomplete data.
• Delete your data where there is no good reason for us to keep processing it.
• Restrict our processing, for example while we verify its accuracy.
• Receive your data in a portable format or have it sent to another controller.
• Object to processing based on our legitimate interests, and to direct marketing.
• Withdraw consent at any time, where processing is based on consent.

To exercise these rights, email info@legadocreativo.com. We may ask for information to confirm your identity. If you are not satisfied with our response, you can lodge a complaint with your local data protection authority. In the EEA, find yours through the European Data Protection Board. In the United Kingdom, contact the Information Commissioner's Office.

Transfers outside Europe

Because we are based in the United States, your personal data will be accessed and processed in the United States, which is not covered by a general European adequacy decision. Where the law requires, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses (or the UK equivalent) or the EU-U.S. Data Privacy Framework for recipients certified under it. In limited cases we rely on an exception, such as your explicit consent or the need to transfer data to perform a contract at your request. Contact us if you would like more information about the safeguards that apply.

Other countries

If you live in another country, including in Latin America, your local law may give you additional rights. Tell us where you live and what you would like to do, and we will honor those rights as the law requires.

10Third-party websites and content

The Site contains links to websites and services operated by others, including our Instagram and Facebook pages, and may display content from them, such as our Instagram posts. When media loads from Meta's servers, Meta may receive your IP address and device information. Links and embedded content are not an endorsement, and we do not control and are not responsible for the privacy practices of third parties. We encourage you to read their privacy policies.

11Security

We use administrative, technical, and physical safeguards appropriate to the nature of the personal information we hold, including encrypted connections (HTTPS), access controls, and bot and abuse protection. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of your information. If a data breach affects your personal information, we will notify you and regulators as required by law, including Massachusetts General Laws Chapter 93H.

12Children's privacy

The Site and our services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe a child has given us personal information, please contact us. If we learn we have collected personal information from a child without the consent the law requires, we will delete it.

13Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If the changes are material, we will also post a prominent notice on the Site or notify you by email where the law requires. Changes take effect when posted, unless we say otherwise. Your continued use of the Site after that means you acknowledge the updated policy.

14Contact us

If you have questions about this policy or our privacy practices, or want to exercise a privacy right, contact us:

• Email: info@legadocreativo.com
• Phone: +1 (617) 515-5000
• Mail: Legado Creativo, Boston, Massachusetts, United States