Legal
Privacy Policy
Last updated: 2026-06-05
This policy explains what data we collect, why we collect it, how long we keep it, and what rights you have. r352 is operated from Mallorca, Spain, which means GDPR and the Spanish LOPDGDD apply to everything we do.
01
Who we are
r352 is a design-ops and delivery-systems studio operated by Przemysław Reszka, based in Santa Catalina, Mallorca (Baleares, Spain). We work remotely with multi-location brands and scaling operators across the EU and beyond.
For anything related to your personal data, you can reach us at hello@r352.com. We are the data controller for the information you submit through this site.
02
What data we collect
Analytics (only with your consent): aggregated usage data via Google Tag Manager and Google Analytics - pages visited, approximate location (country/city), device type, referrer. Tags only load if you accept on the consent banner.
Contact forms and briefs: the information you choose to submit - typically name, email, company, project context, budget range, timeline. We never collect more than you give us.
Strictly necessary storage: a small local entry that remembers your consent choice itself (key: r352-consent-v1). This cannot be disabled - without it, we'd ask you again on every page.
Server logs: standard request logs kept by our hosting provider (Vercel) for security and operations.
03
Why we collect it
Analytics: to understand which pages help, which fail, and where to invest. Legal basis: your consent (Art. 6(1)(a) GDPR).
Contact form data: to respond to your inquiry, qualify the fit, and - if we engage - deliver the project. Legal basis: pre-contractual steps at your request and our legitimate interest in running the business (Art. 6(1)(b) and 6(1)(f) GDPR).
Server logs: to keep the site available and to defend against abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
04
How long we keep it
Analytics events: up to 26 months in Google Analytics, then automatically purged.
Contact form and brief submissions: up to 5 years for tax and contractual compliance under Spanish law, then deleted unless an active engagement requires longer retention.
Consent state (r352-consent-v1): stored in your browser until you reset it on the Cookie preferences page or clear site data manually.
Server logs: rolling 30-day window unless an incident requires longer retention.
05
Who we share it with
Hosting and infrastructure: Vercel Inc. (United States) - site delivery and edge logs, under Standard Contractual Clauses.
Analytics: Google Ireland Ltd. / Google LLC, when (and only when) you have accepted analytics cookies.
Email: standard email providers we use to reply to your message (e.g. Google Workspace).
We do not sell your data. We do not share it with advertising networks. We do not run remarketing or programmatic ads.
06
Your rights
Under GDPR and the Spanish LOPDGDD you have the right to: access your data, correct it, delete it, restrict processing, object to processing, receive a portable copy, and withdraw consent at any time (without affecting the legality of processing before withdrawal).
To exercise any of these rights, email hello@r352.com from the address you used to contact us. We will respond within 30 days.
You also have the right to file a complaint with the Spanish supervisory authority, AEPD (Agencia Española de Protección de Datos) - www.aepd.es.
07
How to contact us
Email: hello@r352.com Location: Santa Catalina, Mallorca, Baleares, Spain (remote-first studio)
For data-specific requests, please use the subject line "r352 - privacy request" so we can route it correctly.
08
Changes to this policy
We may update this policy when our tools or processes change. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced on the site before they take effect.
Questions about this policy or your data?