PRIVACY POLICY
PRIVACY POLICY
Last updated: January 2026
At CANVAS FOR YOU®, we handle personal data responsibly, proportionately, and transparently, in accordance with the General Data Protection Regulation (GDPR), Spain’s Organic Law on Personal Data Protection and the Guarantee of Digital Rights, the Law on Information Society Services and Electronic Commerce, and applicable regulations governing data protection and digital services.
This Privacy Policy explains what personal data we may process, why we process it, the legal basis for doing so, how long we retain it, with whom it may be shared, and how individuals may exercise their rights under applicable law.
1. Data controller information
Data controller: CANVAS FOR YOU®
Owner: Ezequiel Ponce
NIF/NIE: Y7090194K
Address: Calle de Amor Hermoso 76, 28026, Madrid, Spain
Contact email: hello@canvas-for-you.com
Website: https://canvas-for-you.com
2. Purposes for processing personal data
CANVAS FOR YOU® processes personal data collected through the website, forms, email, digital platforms, comments, private areas, purchases, contracted services, and other contact channels for the purposes described below.
2.1. Responding to questions and requests
We process the data needed to manage and respond to questions, requests for information, and messages sent through forms, email, WhatsApp, or other available channels.
This may include following up on a communication when necessary to address the request appropriately.
2.2. Managing contractual relationships and providing services
We process the data needed to manage accounts, registrations, purchases, access to products or services, programs, workshops, training, sessions, digital platforms, billing, payments, support, related communications, and administrative matters associated with the relationship.
2.3. Operational communications
We may send communications needed to manage the relationship with CANVAS FOR YOU®, including confirmations, reminders, technical notices, material changes to contracted services, incident updates, operational updates, and support communications.
2.4. Marketing communications
We may send information about CANVAS FOR YOU® products, services, programs, news, content, events, or activities when we have a valid legal basis to do so.
These communications may be based on consent or, where applicable, legitimate interest, particularly when there is a prior relationship and the communications relate to products or services similar to those previously purchased or requested.
Where applicable, each marketing communication will include a straightforward way to unsubscribe or withdraw consent.
2.5. Website comments
When someone leaves a comment on the website, we may collect the information shown in the comment form, as well as the person’s IP address and browser user-agent string.
We process this information to manage the comment, moderate the discussion, detect spam, prevent misuse, and protect website security.
An anonymized string created from the email address, also known as a hash, may be provided to the Gravatar service to check whether the person uses it.
Once a comment is approved, the profile picture associated with Gravatar, if any, may be publicly visible alongside the published comment.
Comments may also be reviewed by automated spam-detection services, such as Akismet, to protect the website from automated, malicious, or abusive posts.
2.6. Managing accounts, access, and private areas
If CANVAS FOR YOU® provides an account, private area, learning platform, or related digital space, we may process the data needed to create, maintain, authenticate, and manage the account.
This may include login credentials, internal identifiers, access logs, technical preferences, activity needed to provide the service, and information related to account security.
2.7. Security, fraud prevention, and website maintenance
We process technical and browsing data when needed to protect the website, prevent unauthorized access, detect misuse, prevent fraud, maintain system integrity, and ensure the secure operation of digital services.
2.8. Compliance with legal obligations
We process the data needed to meet tax, accounting, administrative, commercial, consumer protection, data protection, digital services, and other applicable legal obligations.
3. Categories of data we process
Depending on how the website is used, which forms are completed, and the nature of the relationship with CANVAS FOR YOU®, we may process the following categories of personal data.
3.1. Identifying and contact information
We may process first and last names, email address, phone number, country, city, company, job title, or similar information voluntarily provided.
3.2. Professional information
We may process information about an individual’s professional activity, organization, work area, training interests, requested program, or professional context shared during the relationship with CANVAS FOR YOU®.
3.3. Transaction, billing, and administrative information
We may process information needed to manage purchases, registrations, payments, billing, taxes, receipts, billing address, NIF/NIE/CIF, transaction details, and related administrative communications.
3.4. Account and access information
If a private area, learning platform, or digital access is provided, we may process login credentials, internal identifiers, registration date, access logs, activity needed to provide the service, and technical information associated with the account.
3.5. Technical and browsing information
We may process IP addresses, device or browser identifiers, user-agent strings, logs, security information, technical preferences, cookies, and similar technologies, in accordance with the applicable settings and Cookie Policy.
3.6. Comment-related information
When someone leaves a comment on the website, we may process their name, email address, website, IP address, user-agent string, comment content, technical metadata, and information needed for spam detection.
3.7. Information voluntarily provided in forms or communications
We may process information included in messages, forms, emails, open-ended responses, comments, WhatsApp messages, or requests sent to CANVAS FOR YOU®.
CANVAS FOR YOU® asks individuals not to send special-category personal data unless it is strictly necessary for a specific purpose that has been explained in advance. If such data is voluntarily received, we will process it only when there is a sufficient legal basis and apply additional safeguards.
4. Legal bases for processing
Depending on the purpose, the processing of personal data is based on one or more of the following legal grounds.
4.1. Performance of a contract or pre-contractual steps
This legal basis applies when someone requests information about services, purchases a product, registers for an activity, accesses a program, contracts for training, or enters into a service relationship with CANVAS FOR YOU®.
4.2. Compliance with legal obligations
This legal basis applies to processing needed to meet tax, accounting, administrative, commercial, consumer protection, data protection, digital services, and other applicable legal obligations.
4.3. Legitimate interest
This legal basis may apply to processing needed to respond to inquiries, manage communications related to an existing relationship, protect website security, prevent fraud, retain limited records of the relationship, manage claims, moderate comments, detect spam, and improve the quality, continuity, and operation of services.
When processing is based on legitimate interest, CANVAS FOR YOU® will assess its legitimate interests against the rights and freedoms of the individuals concerned.
4.4. Consent
This legal basis applies when an individual has given consent freely, specifically, with adequate information, and unambiguously.
Consent may be used, among other things, for certain marketing communications, newsletter subscriptions, nonessential cookies, specific forms, or any processing that requires consent under applicable law.
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.
5. Comments, Gravatar, and anti-spam services
When visitors leave comments on the website, CANVAS FOR YOU® may collect the information displayed in the comment form, the visitor’s IP address, and the browser user-agent string.
This information helps us detect spam, moderate comments, prevent misuse, and protect website security.
An anonymized string created from the email address, also known as a hash, may be provided to Gravatar to check whether the person uses the service.
If a comment is approved, the profile picture associated with Gravatar, if any, may be publicly visible alongside the comment.
Visitor comments may be reviewed by automated spam-detection services. If the website uses Akismet, the service may process information associated with the comment, such as the IP address, browser, referring site, website URL, name, username, email address, and comment content, depending on the settings in place.
This processing is intended to prevent spam, protect website security, and maintain the integrity of published communications.
6. Media and images uploaded to the website
If the website allows images to be uploaded, we recommend avoiding files that contain GPS location data or other EXIF metadata.
Visitors may be able to download published images and extract location data or other metadata from them if that information has not been removed from the file.
This section applies when visitors, clients, collaborators, registered users, or administrators can upload images or files to the website.
7. Cookies and similar technologies
The CANVAS FOR YOU® website may use cookies and similar technologies for technical, personalization, analytics, measurement, and, where applicable, marketing purposes.
Strictly necessary cookies may be used to operate the website, manage sessions, remember preferences, support comments, enable access to private areas, strengthen security, and provide requested services.
Analytics, advertising, or tracking cookies, if used, will be managed in accordance with applicable law and, where required, with the individual’s consent.
Detailed information about these technologies should be provided in the applicable Cookie Policy, including the types of cookies used, their purposes and duration, who sets them, and how to configure settings or withdraw consent.
7.1. Comment-related cookies
If someone leaves a comment on the website, they may choose to save their name, email address, and website in cookies.
This feature means they will not need to re-enter their information when leaving another comment.
These cookies may be retained for one year.
7.2. Login and session cookies
If the website provides user accounts and someone logs in, the website may set a temporary cookie to check whether the browser accepts cookies.
This cookie does not contain personal data and is deleted when the browser is closed.
When someone logs in, cookies may also be set to save login information and display preferences.
Login cookies may be retained for two days, and screen-option cookies for one year.
If the “Remember Me” option is selected, the login may remain active for two weeks.
When the user logs out, the login cookies are deleted.
7.3. Editing or publishing cookies
If someone with editing permissions updates or publishes an article, an additional cookie may be stored in their browser.
This cookie does not contain personal data; it only identifies the article that was edited.
It typically expires after one day.
7.4. Local storage associated with the WhatsApp button
The website may use a floating WhatsApp button to make it easier to contact CANVAS FOR YOU® directly.
The button may use local storage technologies to control when the chat window appears automatically.
In particular, the Joinchat plugin may store technical variables such as:
• joinchat_views
• joinchat_hashes
These technologies are used for technical purposes and do not, by themselves, contain personal data.
If someone chooses to start a WhatsApp conversation, the communication takes place outside the website, within WhatsApp.
In that case, information such as the phone number, profile name, message content, technical metadata, and any information voluntarily shared during the conversation may be processed.
CANVAS FOR YOU® will process information received through WhatsApp to respond to questions, requests, professional communications, or matters related to its services.
8. Content embedded from other websites
The website may include content embedded from other sites, such as videos, images, articles, maps, forms, calendars, players, booking tools, or similar content.
Embedded content from third parties behaves much as it would if the visitor accessed the originating website directly.
Those third parties may collect data, use cookies, add tracking technologies, and monitor interactions with the embedded content, particularly if the visitor has an active account and is logged in to that service.
When embedded content involves cookies, tracking, or data processing by third parties, this must be explained in the Cookie Policy and, where required, prior consent must be obtained.
9. WhatsApp button and messaging communications
The website may include a floating WhatsApp button or other messaging channels to make it easier to contact CANVAS FOR YOU® directly.
When someone uses these channels, CANVAS FOR YOU® may process personal data provided during the conversation, including the person’s name, phone number, message content, professional information shared, and any other information voluntarily provided.
This information is processed to respond to questions, manage requests, communicate professionally, provide support, or share information related to CANVAS FOR YOU® products, services, programs, or activities.
Using WhatsApp also involves data processing by the provider of that service, in accordance with its own terms and privacy policies.
10. Loco Translate
The website may use Loco Translate to manage translations or internal text in WordPress, themes, or plugins.
In general, this plugin does not collect personal data from visitors to the public-facing website.
For administrative, configuration, or translation operations, necessary technical data remains within the website environment unless additional external integrations have been specifically configured.
11. Recipients and data processors
In general, CANVAS FOR YOU® does not sell personal data or disclose it to third parties for their own purposes.
Data may be disclosed to public authorities, regulators, courts, or other competent bodies when required by law, in response to a valid request, or when necessary to address potential liabilities.
To operate the website, provide services, and manage its activities, CANVAS FOR YOU® may use service providers that process personal data on the controller’s behalf as data processors.
These providers may include:
• Web hosting, server, and technical maintenance services.
• Email platforms, operational messaging services, and communications automation tools.
• Billing, accounting, tax advisory, or administrative management services.
• Payment processors and financial institutions.
• Learning platforms, video conferencing tools, registration management systems, or digital environments for accessing content.
• Website analytics, measurement, or improvement tools, when used and in accordance with cookie settings.
• Security, anti-spam, backup, maintenance, and technical support services.
• Tools associated with WordPress, plugins, forms, comments, translation, communications, or other features needed to provide the service.
These providers operate under contracts or terms that include confidentiality, security, and data-processing obligations in accordance with CANVAS FOR YOU®’s instructions.
For payment processors, CANVAS FOR YOU® generally does not access complete card details because payment is processed in the secure environment of the relevant provider.
12. International data transfers
CANVAS FOR YOU® may use technology providers located inside or outside the European Economic Area, or providers whose technical infrastructure is located outside the EEA.
When using these providers involves international data transfers, those transfers will be carried out using the mechanisms provided for under the GDPR, including adequacy decisions, standard contractual clauses approved by the European Commission, additional safeguards, or other valid legal mechanisms.
This may apply, among other cases, when using technology providers, communications platforms, anti-spam services, analytics tools, messaging services, payment processors, learning platforms, video conferencing services, embedded content, or digital providers with international infrastructure.
13. Retention of personal data
CANVAS FOR YOU® will retain personal data for as long as necessary to fulfill the purposes for which it was collected and, afterward, for the periods required by applicable law or needed to address potential liabilities.
In general:
• Data related to inquiries will be retained for as long as needed to respond and, afterward, for a reasonable period to manage any follow-up or potential liabilities.
• Contractual, administrative, and billing data will be retained for the periods required under applicable tax, accounting, commercial, and consumer protection laws.
• Data associated with accounts, access, or platforms will be retained while the account remains active or for as long as necessary to provide the contracted service.
• Data processed on the basis of consent will be retained until consent is withdrawn or the data is no longer needed for the relevant purpose.
• Technical and security data will be retained for as long as needed to ensure the operation, traceability, and security of services and to respond to incidents or liabilities.
• Data related to marketing communications will be retained while there is a legal basis to send them or until the individual unsubscribes, withdraws consent, or exercises the right to object, as applicable.
After the relationship ends, data may be retained in restricted form for the limitation periods applicable to legal or administrative claims.
13.1. Retention of comments
If someone leaves a comment, the comment and its metadata may be retained indefinitely.
This allows us to recognize and automatically approve subsequent comments instead of holding them in a moderation queue.
13.2. Retention of registered-user information
If people register on the website, CANVAS FOR YOU® may store the personal information they provide in their profiles.
Registered users may view, edit, or delete their personal information at any time, except for information they cannot change through their profile, such as their username.
Website administrators may also view and edit this information when necessary to manage the account, provide the service, or maintain website security.
14. Password resets
If the website allows users to create accounts and someone requests a password reset, their IP address may be included in the recovery email or associated technical logs.
This processing is intended to strengthen the security of the account recovery process and prevent misuse.
15. Security measures
CANVAS FOR YOU® applies reasonable and proportionate technical and organizational measures to protect personal data against destruction, loss, alteration, disclosure, unauthorized access, or improper processing.
Depending on the circumstances, these measures may include:
• Access controls.
• Credential management.
• Confidentiality measures.
• Technology providers with appropriate safeguards.
• Technical maintenance.
• Backups.
• Permission reviews.
• Form security.
• Anti-spam tools.
• Practices designed to reduce processing-related risks.
The internet also requires responsible conduct from people using digital services. We recommend safeguarding login credentials, using strong passwords, avoiding shared access, and logging out on shared devices.
16. Individual rights
Individuals whose data is processed by CANVAS FOR YOU® may exercise the rights provided under applicable law, subject to the relevant legal requirements.
These rights include:
• The right to access personal data.
• The right to correct inaccurate or incomplete data.
• The right to erasure, where applicable.
• The right to restrict processing in certain circumstances.
• The right to object to processing based on legitimate interest.
• The right to data portability, where applicable.
• The right to withdraw consent at any time when processing is based on consent.
• The right not to be subject to automated individual decision-making, where applicable under the law.
To exercise these rights, send a request to:
Requests may also be sent by mail to:
CANVAS FOR YOU®
Calle de Amor 77
28026 Madrid, Spain
The request should specify which right the individual wishes to exercise and provide enough information to identify them.
If necessary to verify identity, CANVAS FOR YOU® may request additional information that is strictly necessary.
17. Rights concerning comments and account data
If someone has an account on the website or has left comments, they may request an export file containing the personal data CANVAS FOR YOU® holds about them, including any information they have provided.
They may also request the erasure of their personal data, as provided under applicable law.
This request does not affect data that must be retained for administrative, legal, tax, contractual, accounting, or security reasons, or to address potential liabilities.
18. Complaints to the supervisory authority
If someone believes that the processing of their personal data violates applicable law or that their rights have not been properly addressed, they may file a complaint with the Spanish Data Protection Agency (AEPD).
They may also contact CANVAS FOR YOU® using the email address provided above to try to resolve any concern about the processing of their personal data.
19. Children’s data
CANVAS FOR YOU® products, services, programs, and content are intended for adults and professionals.
CANVAS FOR YOU® does not knowingly request personal data from minors.
If we discover that we have received a minor’s personal data without the required authorization or legal basis, we will take the necessary steps to delete or properly address it.
Whenever the processing of a minor’s data requires consent, that consent must meet the requirements of applicable law.
20. Third-party links
The website may include links to third-party websites, platforms, services, or content.
CANVAS FOR YOU® does not control those third parties’ privacy policies, terms of use, cookies, security practices, or data processing.
We recommend reviewing the applicable policies of each external service before providing personal data or interacting with content, platforms, or tools operated by third parties.
21. Updates to this Privacy Policy
CANVAS FOR YOU® may update this Privacy Policy to reflect changes in laws or regulatory guidance, technical changes, updates to services, changes in providers, or changes to how data is processed.
The current version is the one published on the website at any given time, with the date of the latest update.
22. Privacy contact
For questions about this Privacy Policy or the processing of personal data, contact CANVAS FOR YOU® at:
CANVAS FOR YOU®
Calle de Amor 77
28026 Madrid, Spain