Privacy Policy
We collect the minimum amount of information needed to answer your enquiry and run our studio. We do not sell data, and we do not run advertising trackers on this website.
In one paragraph: when you submit our enquiry form we receive your name, email, phone number, chosen service and message. We use it only to reply to you and to manage the project. It reaches our inbox and a private log file on our server — nothing else. We never sell or rent your data, and you can ask us to delete it at any time by emailing info@crestovatech.com.
Contents
- 1. Who we are
- 2. Information we collect
- 3. How we use your information
- 4. Legal bases for processing
- 5. Cookies & local storage
- 6. Sharing & disclosure
- 7. International transfers
- 8. How long we keep data
- 9. How we protect data
- 10. Your privacy rights
- 11. Children's privacy
- 12. Third-party links
- 13. Do Not Track signals
- 14. Changes to this policy
- 15. Contact & complaints
1. Who we are
This website, crestovatech.com, is operated by Crestova Tech, a design and technology studio located at 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States. For the purposes of the EU/UK General Data Protection Regulation (GDPR), we are the data controller for personal information submitted through this site.
- Postal address: 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States
- Email: info@crestovatech.com
- Phone: +1 (972) 975-6498
2. Information we collect
2.1 Information you give us
When you submit the enquiry form (on the contact page or in the popup), we collect the fields you fill in:
- Your name
- Your email address
- Your phone number
- The service you are interested in, plus optional budget and timeline selections
- Any project details, questions or files you choose to send us
If you email or call us directly, we hold the contents of that correspondence. We do not collect payment card details through this website; invoices are paid through the payment method agreed in your proposal.
2.2 Technical information collected automatically
- IP address and approximate location derived from it
- Browser type and version, device type and operating system
- The page you visited and the time of your visit
- Referring website, where your browser sends one
This information is used for security (blocking spam and abuse) and basic troubleshooting. We do not build advertising profiles from it.
2.3 What we do not collect
- No advertising or cross-site tracking cookies
- No third-party analytics that profile you across websites
- No special category or sensitive personal data
- No data purchased from data brokers
3. How we use your information
- To reply to your enquiry, quote for work and answer questions
- To prepare proposals, contracts, invoices and project documentation
- To deliver, support and maintain the services you have engaged us for
- To protect the website against spam, abuse and unauthorised access
- To keep basic business and tax records as required by law
- To send occasional studio updates — only if you have asked for them
We do not use your information for automated decision-making or profiling, and we do not send marketing e-mails to people who have simply submitted an enquiry.
4. Legal bases for processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiry | Consent, and steps preparatory to a contract |
| Delivering an agreed project | Performance of a contract |
| Invoicing and record-keeping | Legal obligation and legitimate interests |
| Spam prevention and site security | Legitimate interests |
| Studio newsletter (optional) | Consent, withdrawable at any time |
5. Cookies & local storage
This website is deliberately light on tracking. We use:
-
A session cookie (
crestova_sid) — strictly necessary. It carries a security token that protects our contact form against cross-site request forgery, and it expires when you close your browser. - Browser session storage — remembers whether you have already dismissed the enquiry popup so it does not reappear during the same visit.
We do not use advertising, analytics or social-media cookies. If we ever add analytics, this policy will be updated and a consent banner will appear before any non-essential cookie is set. You can block or delete cookies in your browser settings at any time; the site will still work, though the contact form may need to be reloaded.
6. Sharing & disclosure
We never sell, rent or trade your personal information. We share it only with service providers who help us operate, and only to the extent they need it:
- Website hosting provider — stores the site and its log files
- E-mail service provider — delivers and stores your enquiry in our inbox
- Accountants and advisers — where invoicing or tax records require it
We may also disclose information where we are legally required to do so, to enforce our agreements, or to protect the rights, safety and property of our studio, our clients or the public. If our business is ever sold or merged, client records may transfer to the new owner under the same privacy commitments described here.
7. International transfers
We are based in the United States and our hosting and e-mail providers may store data on servers in the US or the EU. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred outside those regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism offered by the provider.
8. How long we keep data
| Data | Typical retention period |
|---|---|
| Enquiries that do not become projects | Up to 24 months, then deleted |
| Client project files and correspondence | Duration of the engagement plus 5 years |
| Invoices and financial records | As required by tax law (typically 7 years) |
| Server and security logs | Up to 12 months |
9. How we protect data
- HTTPS everywhere, with HTTP Strict Transport Security enabled
- Contact forms protected by CSRF tokens, a honeypot field, timing checks and flood control
- All form input is validated, length-capped and stripped of control characters
- Enquiry logs are stored outside the public web root and blocked from web access
- Security headers restrict framing, MIME sniffing and referrer leakage
- Access to studio accounts is limited to the people working on your project and protected by two-factor authentication
No method of transmission or storage is 100% secure. If we ever become aware of a breach affecting your personal information, we will notify you and the relevant authority without undue delay, as required by applicable law.
10. Your privacy rights
10.1 If you are in the EEA, UK or Switzerland
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — ask us to delete your data where no legal obligation requires us to keep it
- Restriction & objection — ask us to limit or stop certain processing
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent — at any time, without affecting processing already carried out
10.2 If you are a California resident
Under the CCPA/CPRA you may request to know what personal information we collect, request its deletion or correction, and opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined by California law, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising your rights.
10.3 How to exercise your rights
E-mail info@crestovatech.com with the subject line “Privacy request”. We will acknowledge your request within 7 days and respond within 30 days. We may ask you to verify your identity before acting, and we do not charge a fee unless a request is manifestly unfounded or repetitive.
11. Children's privacy
Our services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has submitted information to us, contact us and we will delete it promptly.
12. Third-party links
Our website may link to external sites — for example a mapping service or a client's website. We are not responsible for the privacy practices of those sites. We recommend reading their own privacy policies before submitting information to them.
13. Do Not Track signals
Because we do not track visitors across websites or across time for advertising purposes, there is no behavioural profile to disable. We honour browser privacy signals by simply not collecting that kind of data in the first place.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or in the law. The “Last updated” date at the top of this page always reflects the current version. Material changes affecting how we use your personal information will be communicated by e-mail to active clients where appropriate.
15. Contact & complaints
For any privacy question or request, contact us at:
- Email: info@crestovatech.com
- Phone: +1 (972) 975-6498
- Post: Crestova Tech, 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States
If you are in the EEA or the UK and believe we have not resolved your concern, you have the right to lodge a complaint with your national data protection authority or with the UK Information Commissioner's Office.