Data controller
Carlos Arturo Bacca Ahumada (Tax ID [NIF / documento de identidad]), [Domicilio a efectos de notificaciones]. Email for data protection matters: info@cbacca.com.
What data we process and why
- Contact form: name, email, subject and message, to handle your request (representation, press or other). Legal basis: your consent (art. 6(1)(a) GDPR). Kept while the request is being handled and afterwards for as long as needed to deal with possible liabilities.
- Website language: on your first visit your IP address is checked against a country geolocation service (api.country.is) to show the site in your language. The IP is not stored: only an irreversible encrypted digest (hash) and the country code are kept for 30 days. Legal basis: legitimate interest in serving the site in your language (art. 6(1)(f) GDPR). You can change the language at any time with the selector in the header.
- Analytics: only if you accept analytics cookies, Google Analytics 4 (Google LLC) collects aggregated browsing data (pages viewed, device, approximate country) to understand how the site is used. Legal basis: consent (art. 6(1)(a) GDPR and art. 22.2 LSSI).
- Third-party content: YouTube videos (cookie-free mode until you press play) and Instagram posts are loaded only when you request them; at that moment Google or Meta may process data under their own policies.
- Take a photo with Bacca: the photo you choose is processed entirely on your device (face detection runs in your browser with a library downloaded from the jsDelivr CDN). Neither the photo nor the result is sent to or stored on our servers.
- Server logs: the hosting provider keeps technical logs (IP, date, page requested) for security for a maximum of 12 months. Legal basis: legitimate interest (art. 6(1)(f) GDPR).
Recipients and international transfers
Data is not shared with third parties unless required by law. Processors acting on our behalf: the web hosting provider; Google LLC (Google Analytics and Google Tag Manager, only with your consent) and Meta Platforms Ireland Ltd. (Instagram, only if you load the posts), both certified under the EU-US Data Privacy Framework; jsDelivr (delivery of the face-detection library) and api.country.is (country of the IP), which only receive the technical data strictly needed to provide the service.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@cbacca.com, stating the right you wish to exercise and attaching a copy of your ID if needed to identify you. You may also withdraw your consent at any time (without affecting prior processing) and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Cookies
This site uses technical cookies (language and your cookie choice), which do not require consent, and Google Analytics analytics cookies, which are only set if you accept them in the banner. You can change your decision at any time from "Cookie settings" in the page footer, where you will also find the full list of cookies, their duration and purpose.
Security and minors
We apply appropriate technical and organisational measures (HTTPS encryption, two-factor restricted access to the management panel, submission limits) to protect data. The site is not aimed at children under 14; if you are a minor, please ask your parents or guardians to send the form on your behalf.
Updates
Last reviewed: 29 October 2026. Any significant change will be published on this page.
