Privacy Policy

Last updated: 22 September 2026

This policy explains how we process your personal data when you visit permanentcreation.es, contact us, apply for a job or sign up for our newsletter. It follows the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”) and Spanish Law 34/2002 on Information Society Services (“LSSI-CE”).

It does not cover third-party websites linked from ours, such as social networks. Their own policies apply.

1. Who is responsible for your data

• Controller: PS CLUSTER MEDIA AND EVENTS, S.L., trading as Permanent State of Creation (“PSC”, “we”, “us”)
• NIF: B-22512164
• Registered office: Calle de Francisco Silvela, 122, 28002 Madrid, Spain
• Studios: Calle de Lope de Vega, 47, 28014 Madrid, Spain · Calle de Atenas, 37, 07819 Ibiza, Spain
• Contact for privacy matters: production@permanentcreation.es

Data Protection Officer. We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR and Article 34 LOPDGDD. For any privacy question, use the contact address above.

2. At a glance

We do not sell your data. We do not use it for advertising or profiling, and we do not make decisions about you by automated means.

3. How we use your data

3.1 Enquiries: contact form and email

Data. When you use the contact form we collect:

• the type of enquiry (Start a Project, Careers, Partnerships or Press);
• your first and last name;
• your email address;
• your message and anything else you choose to tell us;
• the page the form was sent from and the page that referred you to it.

If you email us directly, we receive your email address, your name and the content of your message.

Entries sent before 2 September 2026 also recorded the sender’s IP address, browser user agent and a technical identifier. That data is kept only with those entries and is deleted with them.

Purposes. To answer your enquiry. If you ask about a project, to discuss your needs and prepare a proposal. To handle press and partnership requests, and to keep a record of our correspondence.

Legal basis.

• Enquiries made on behalf of a hotel, company or other organisation (the usual case): our legitimate interest in handling the enquiry and maintaining the business relationship with that organisation (Art. 6(1)(f) GDPR and Article 19 LOPDGDD). We use only your professional contact details and what you tell us.
• Project enquiries you make as an individual: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Other enquiries, such as press or partnership requests: our legitimate interest in replying to people who contact us (Art. 6(1)(f) GDPR). You wrote to us, so you can reasonably expect a reply, and we use your data only for that purpose.

Where we rely on legitimate interest, you can object (section 7).

How it is handled.

• Your submission is saved in the website’s database, which is hosted by Kinsta on servers in Madrid, Spain.
• An email notification containing your submission is sent to our mailbox, which is provided by Google (Google Workspace). It is sent through the Google Workspace email service of WSC, our web design and maintenance provider.
• The website keeps a delivery log with a copy of each notification email for 30 days.

Retention. See section 6.

If your enquiry is about a job, section 3.2 also applies.

3.2 Job applications (Careers page)

Data. Your first and last name, your email address, your message and your CV file, including everything in it (usually education, work experience, skills and contact details).

Please include only what is relevant to the job. We do not need, and ask you not to include:

• your photograph, identity or passport number, or date of birth;
• special categories of data, such as health or disability, ethnic origin, religious or political beliefs, trade union membership, sex life or sexual orientation;
• information about criminal convictions.

If you include any of this anyway, we will not take it into account and will delete it where we can.

Purposes. To assess your application for the vacancy you apply for or, if you send us an unsolicited application, for any vacancy that is open or that we open within 3 months of receiving it. To contact you about it, for example to arrange interviews or tests, and to manage the selection process.

Legal basis.

• Your application, whether for an advertised vacancy or unsolicited: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR), for the periods stated in section 6.
• Keeping your CV for other vacancies (optional): if you tick the box on the form, we keep your CV for 12 months from the date of your application so that we can consider you for other vacancies, on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw that consent at any time. This does not affect the lawfulness of anything we did before.

How it is handled. Your CV is stored on our web server (see section 3.4), in a folder and under a file name that include random codes. The notification email sent to our mailbox does not contain the file or its original name: it contains a link that only opens for authorised users logged in to the website.

Who sees it. Only the people at PSC involved in the selection process, plus the service providers listed in section 4.

Minimum age. You must be at least 16 years old, the minimum working age in Spain, to apply.

Retention. See section 6. If you are hired, your application becomes part of your employee file and the privacy notice for employees applies.

3.3 Newsletter

Data. Your name and email address, plus the date and time of your subscription and the record of your consent.

Purpose. To send you our newsletter by email, with news about the studio and our projects, articles and information about our services.

Legal basis. Your consent (Art. 6(1)(a) GDPR and Article 21 LSSI-CE). You can withdraw your consent and unsubscribe at any time, free of charge, by following the unsubscribe instructions in every newsletter (Article 22.1 LSSI-CE) or by writing to us. Withdrawing does not affect the lawfulness of anything we did before.

How it is handled. Your subscription is saved in the website’s database and sent to our mailbox. We send the newsletter from our own email account, provided by Google (Google Workspace), which acts as our processor. We send it so that recipients cannot see each other’s addresses.

We do not use tracking pixels or tracked links, so we do not know whether you open our newsletter or click on its links.

Retention. See section 6.

3.4 Website operation, security and technical logs

Data. When you visit the website, our servers and the security network in front of them receive:

• your IP address;
• the date and time;
• the page requested;
• your browser and operating system (user agent);
• the referring page;
• the technical response.

Our hosting provider’s security service sets the cookie __cf_bm to tell people apart from bots, and its network asks your browser to report errors when loading the website (see section 6 of the Cookie Policy). Our SEO tool records requests for pages that do not exist (404 errors) and redirections, including the URL, a shortened form of your IP address, the user agent and the referring page. Since 21 September 2026 the IP address is shortened before it is stored: for IPv4 addresses the last of its four numbers is replaced with zero, and for IPv6 addresses part of the address is masked.

The fonts and scripts the website needs are served from our own server. Unless you accept Analytics cookies (section 3.5), viewing the website does not connect your browser to any third-party service other than our hosting provider’s network.

Purposes.

• To deliver the website.
• To protect it against attacks, bots and abuse.
• To detect and fix errors and broken links.
• To keep backups so the website can be restored.

Legal basis. Our legitimate interest in the security and proper working of the website (Art. 6(1)(f) and Recital 49 GDPR).

Providers.

• Kinsta: hosting, on servers located in Madrid, Spain.
• Cloudflare: delivery and security network, integrated into Kinsta’s service.

Retention. See section 6. Data deleted from the website stays in backups until those backups expire.

3.5 Analytics cookies: Google Analytics (only with your consent)

If you accept Analytics cookies, we use Google Analytics 4, loaded through Google Tag Manager, to understand how the website is used, in aggregate. If you do not accept them, neither Google Tag Manager nor Google Analytics is loaded (section 3.6).

Data.

• A random identifier stored in the _ga cookie, plus a session identifier and session count.
• The pages you visit and their titles, the referring page, and the date and time.
• Your interactions: scrolling, clicks on external links, internal searches, video engagement, file downloads, and whether a form was started or submitted (never its contents).
• Your device, browser, operating system, screen resolution and language.
• Your approximate location (country, region and city), derived from your IP address. According to Google, Google Analytics 4 does not log or store IP addresses of users in the EU.

Settings.

• Google Signals is switched off.
• We do not use Analytics data for advertising or remarketing, and advertising storage always stays denied.
• Email addresses that appear in page URLs are automatically removed.

Legal basis. Your consent (Article 22.2 LSSI-CE and Art. 6(1)(a) GDPR). You can withdraw it at any time with the “Cookie settings” link at the bottom of every page, or on the Cookie Policy page.

Provider. Google Ireland Limited provides Google Analytics under Google’s data processing terms, as a subprocessor of WSC, our web design and maintenance provider, which manages the Analytics account on our behalf. Google Tag Manager, the tool that loads Google Analytics, is only loaded after you accept Analytics cookies, as part of the same processing. Data may be transferred to Google LLC in the United States (see section 5). Depending on the account’s data-sharing settings, Google may also use limited Analytics data to provide technical support, produce benchmarks and improve its services, as explained in Google’s help page on data sharing.

Retention. 14 months. For how long the cookies last, see the Cookie Policy.

3.6 Google Consent Mode

We use Google Consent Mode v2 in basic mode. Google Tag Manager and Google Analytics are only loaded if you accept Analytics cookies. Before you make a choice, and if you reject them, your browser makes no request to Google and Google receives no data from your visit: no cookieless signals are sent, and no identifiers are added to the links between our pages. When you accept, Consent Mode tells Google that analytics storage is allowed, while every advertising-related signal stays denied. If you withdraw your consent, Google Analytics stops at once and the analytics cookies on our domain are deleted.

3.7 Record of your cookie choices

When you make a choice in our cookie banner, our consent manager (WSC Consent) stores a record on our server. It contains:

• a random consent identifier, which is also stored in the wsc_consent cookie on your device;
• what you did (accept, reject, choose by category, change or withdraw) and your choice for each category;
• the date and time;
• the policy version;
• your browser language;
• your browser’s user agent;
• a pseudonymised code calculated from your IP address.

Instead of your IP address, we store a code calculated from it with a secret key (a keyed hash, HMAC-SHA-256; for IPv6 addresses, only the first half of the address is used). We do not store the address itself. This code is pseudonymised personal data, not anonymous data: whoever holds the key (we and our web maintenance provider) could work out which IP address it came from. We do not do so. The key is kept on our server with restricted access, and we use the code only to prove your choice and to protect this record against abuse, by limiting the number of requests from the same address.

Purpose. To be able to prove your choice: that you consented or, if you refused or withdrew consent, that we respected it.

Legal basis.

• Records of consent: compliance with our legal obligation to be able to demonstrate that you consented (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
• Records of a refusal or withdrawal: our legitimate interest in being able to demonstrate that we respected your choice and in defending ourselves against claims (Art. 6(1)(f) and Art. 5(2) GDPR). You can object to this processing (section 7).

Retention. 38 months, so that the record covers the 12-month validity of your choice and the period in which claims or inquiries about it can be brought. The record is then deleted automatically. Your choice is also saved in the wsc_consent cookie on your device for 12 months (360 days).

3.8 Social media and our Instagram feed

The links to our Instagram, LinkedIn and YouTube profiles are plain links. We do not embed plug-ins or scripts from those networks. If you click one, the platform processes your data as controller under its own privacy policy.

The Instagram feed on some pages shows copies of our own public Instagram posts. Our server downloads them from Instagram periodically and stores them locally, so your browser does not connect to Instagram or Meta when you view the feed.

If you contact us or interact with us on social media, we process your data to reply, based on our legitimate interest (Art. 6(1)(f) GDPR). The platform is also a controller of that data. The platforms also give us aggregated statistics about how people interact with our profiles, such as Instagram Insights and LinkedIn page analytics. For those statistics we are joint controllers with the platform, under the agreements it provides for this purpose (for Instagram, Meta’s Page Insights Controller Addendum), and the platform is primarily responsible for informing you and for handling your requests about them.

3.9 People appearing in our work

Our portfolio, films and news show images of people, such as models, hotel staff and guests, chefs and members of our team. We publish them on the basis of the authorisation each person has given us: their consent, or the agreement under which they took part in the project. If you appear in one of our images, you can exercise your rights as explained in section 7.

4. Who we share your data with

We do not sell your data or share it with third parties for their own marketing. We share it only with the following recipients.

Service providers acting on our behalf (processors). They process data only on our instructions and under data processing agreements (Art. 28 GDPR):

• WSC (Worth Sapiens Consultants, S.L., Spain): design, maintenance and administration of the website, including its hosting and Google Analytics accounts. WSC uses these subprocessors:
  • Kinsta Inc. (website hosting, database and backups, on servers in Madrid, Spain);
  • Cloudflare, Inc. (delivery and security network, integrated into Kinsta’s service);
  • Google Ireland Limited (sending the form notification emails from WSC’s Google Workspace account, and Google Analytics, loaded through Google Tag Manager, only if you accept Analytics cookies).
• Google Ireland Limited (Google Workspace): our mailbox, which receives the form notifications, and the sending of our newsletter.
• DinaHosting, S.L. (Spain): hosting of the mailbox that received the form notifications until 22 September 2026.

Independent controllers. The social networks, if you click a link to them (section 3.8).

Authorities and advisers. Courts, the Spanish Data Protection Agency, tax authorities and law enforcement, where the law requires it. Our lawyers and other professional advisers, under a duty of confidentiality, where needed to establish, exercise or defend legal claims.

5. International data transfers

Some of our processors are located, or have parent companies, outside the European Economic Area:

You can ask us for a copy of the safeguards using the contact address in section 1.

6. How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected for. Where we must keep some data after that, to comply with a legal obligation or to deal with possible claims, we keep only what is needed, blocked so that it is not used for anything else (Article 32 LOPDGDD), and delete it when the relevant period ends.

7. Your rights

Right to object. Where we process your data on the basis of our legitimate interest (sections 3.1, 3.4, 3.7 for refusals and withdrawals, and 3.8), you can object at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. You can also object at any time, without giving reasons, to receiving our newsletter or any other direct marketing.

You also have the right to:

• access your personal data (Art. 15 GDPR);
• rectify inaccurate or incomplete data (Art. 16);
• erase your data (Art. 17);
• restrict processing (Art. 18);
• data portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller (Art. 20);
• withdraw your consent at any time, without affecting the lawfulness of processing before you withdrew it (Art. 7(3));
• not be subject to decisions based solely on automated processing (Art. 22). We do not make such decisions.

How to exercise them. Email production@permanentcreation.es or write to PS CLUSTER MEDIA AND EVENTS, S.L., Calle de Francisco Silvela, 122, 28002 Madrid, Spain. Tell us which right you want to exercise and, if you can, which data or processing it relates to.

• Exercising your rights is free.
• We will reply within one month. For complex or numerous requests, this can be extended by two more months, and we will tell you if so.
• We will not ask for a copy of your ID unless we have reasonable doubts about your identity (Art. 12(6) GDPR). In that case we will ask only for what we need to confirm it.
• You may act through a representative, who must prove their authority.

To unsubscribe from the newsletter, follow the instructions in any issue or write to us. To change or withdraw your cookie choices, use the “Cookie settings” link at the bottom of any page, or go to the Cookie Policy page.

8. Complaints

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos):

• Post: Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9, 28046 Madrid, Spain
• Website: www.aepd.es
• E-office: sedeaepd.gob.es

You can also complain to the supervisory authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first, so please consider contacting us. This is not a requirement.

9. Children

The website is not aimed at children. If you are under 14, please do not send us personal data. Under Article 7 LOPDGDD, consent from anyone under 14 must be given by their parents or guardians. If we find out that we have received data from a child under 14 without that authorisation, we will delete it. Job applicants must be at least 16 (see section 3.2).

10. Required fields and accuracy

Fields marked with an asterisk (*) are required. Without them we cannot deal with your request, application or subscription. All other information is optional.

Please make sure the data you give us is accurate and up to date. If you give us data about other people, for example references in a CV, you must have informed them and be entitled to share it.

11. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, and we do not build profiles. Analytics is used only for aggregated statistics.

12. Security

We apply technical and organisational measures suited to the risk (Art. 32 GDPR), including:

• encrypted connections (HTTPS), which browsers are instructed to always use (HSTS);
• managed hosting behind a firewall and protection against bots and attacks;
• security headers that prevent other websites from displaying ours inside their pages, and that limit the information sent to other sites when you follow a link;
• daily backups;
• access to website administration restricted to authorised people.

No system is completely secure. If a personal data breach occurs, we will notify the Spanish Data Protection Agency where Article 33 GDPR requires it and, if the breach is likely to result in a high risk to your rights and freedoms, we will also tell you without undue delay (Article 34 GDPR).

13. Changes to this policy

We may update this policy to reflect changes in the law, in our services or in the tools we use. The date at the top shows the current version. If a change is significant, we will make it clear on the website. Where the law requires it, we will ask for your consent again.