Privacy and Personal Data Protection Policy
Last updated: 16 September 2026
At Code Studios we treat personal data the way we treat our clients’ code: carefully, traceably, and without collecting anything we do not need. This document explains, in concrete and verifiable terms, what data we collect through code-studios.com, for what purpose, on what legal basis, how long we keep it, who we share it with, and how you can exercise your rights over it.
This policy is governed by Ecuador’s Organic Law on the Protection of Personal Data (LOPDP) and its General Regulation. Where the data subject is located in the European Economic Area, we additionally apply the standards of the European Union’s General Data Protection Regulation (GDPR).
1. Data controller
The controller of the personal data collected through this website is Code Studios S.A.S., a company incorporated under the laws of the Republic of Ecuador, with its registered office in Quito, Ecuador.
For any matter relating to personal data protection, including the exercise of the rights described in section 8, you can write to us at info@code-studios.com.
- Legal name: Code Studios S.A.S.
- Registered office: Quito, Ecuador
- Data protection contact address: info@code-studios.com
- Website: https://code-studios.com
2. Personal data we process
We collect only the data you give us voluntarily and deliberately through the contact form, together with a minimal set of technical data needed to operate the site securely. We do not buy databases, we do not obtain data from third parties, and we do not carry out profiling.
| Data | Source | Required | Purpose |
|---|---|---|---|
| First and last name | Contact form | Yes | To address you correctly when we reply |
| Work email address | Contact form | Yes | To answer your enquiry |
| Company | Contact form | Yes | To understand the context of your enquiry |
| Phone number | Contact form | No | To reach you this way if you prefer it |
| Message content | Contact form | Yes | To address the specific question you put to us |
| Interface language | Contact form | Automatic | To reply in the language you wrote to us in |
| UTM parameters and referring page | URL | Automatic | To know which channel originated the enquiry |
| IP address | HTTP request | Automatic | To limit abuse and automated form submissions |
| Consent timestamp | Contact form | Automatic | To evidence when and for what purpose consent was given |
| Technical signals from the browser and page interaction (reCAPTCHA) | Browser, when using the form | Automatic | To verify that the submission is made by a person and not an automated program; the resulting score is stored with your enquiry |
3. Purposes and legal bases for processing
All processing of personal data requires a legal basis. In our case those bases are as follows:
- Consent of the data subject (LOPDP art. 7(a)): this is the basis on which we process the data you enter into the contact form. You give consent by expressly ticking the corresponding box, which is never pre-ticked, and we record the date and time you did so.
- Consent of the data subject: this is also the basis on which we use analytics cookies. Until you give it, no measurement tool is loaded in your browser.
- Legitimate interest (LOPDP art. 7(f)): we process your IP address, the submission timestamp and the technical signals collected by reCAPTCHA Enterprise for the sole purpose of preventing spam and automated abuse of the form. This is a proportionate, time-limited legitimate interest that does not override your fundamental rights.
- Compliance with a legal obligation (LOPDP art. 7(c)): where we are required to retain or disclose information in order to comply with a legal duty or a request from a competent authority.
4. Retention periods
We do not keep personal data indefinitely. The periods are as follows:
- Contact form data: twenty-four (24) months from our last contact with you, after which it is deleted, unless the enquiry led to a contractual relationship, in which case the applicable commercial and tax retention periods apply.
- IP address and anti-abuse technical data: held in memory for a maximum of thirty (30) minutes, never stored persistently and never associated with the stored enquiry.
- reCAPTCHA verification score: kept with the enquiry record for the same period. The technical data Google collects to calculate it is governed by the reCAPTCHA Enterprise terms, under which it is used to provide and improve the security service and not for personalised advertising.
- Consent record: retained for as long as the processing continues and for the applicable limitation periods, in order to evidence that consent was obtained.
- Analytics data: fourteen (14) months, which is the retention period configured in the measurement tool.
5. Recipients and processors
We do not sell, rent or transfer personal data to third parties for commercial purposes. We do rely on technology providers acting as processors, strictly on our instructions and under a contract obliging them to guarantee a level of protection equivalent to that required by the LOPDP.
| Provider | Service provided | Data accessed | Location |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Site hosting and the database where enquiries are stored | All contact form data | United States |
| Google Analytics (Google LLC) | Statistical measurement of site usage | Cookie identifiers and browsing data, only with your consent | United States |
| Google reCAPTCHA Enterprise (Google LLC) | Protecting the contact form against spam and automated submissions | IP address, browser and device data and page interaction, only when you use the form | United States |
6. International data transfers
The infrastructure hosting this site, the database storing enquiries and the form’s anti-spam verification service are located in the United States, which means personal data is transferred internationally outside Ecuador.
This transfer relies on the adequate safeguards provided for in article 60 of the LOPDP. Specifically, our infrastructure provider has entered into Standard Contractual Clauses and applies supplementary technical and organisational measures, including encryption of data in transit and at rest.
You may request further information about the safeguards applied by writing to info@code-studios.com.
7. Security measures
Code Studios holds ISO/IEC 27001:2022 certification for its software development process, which entails an externally audited information security management system subject to continuous improvement.
Applied to this website, the concrete measures include:
- Encryption in transit using TLS across the entire site, without exception.
- Encryption at rest of the database where enquiries are stored.
- Data access restricted to a service identity holding the minimum indispensable permissions, with no long-lived keys.
- Validation and sanitisation of all user input, both in the browser and on the server.
- reCAPTCHA Enterprise verification, honeypot fields and rate limits against spam and automated form submission.
- No personal data is ever transmitted in the URL or recorded in server access logs.
8. Your rights as a data subject
The LOPDP grants you the following rights over your personal data, which you may exercise at any time and free of charge:
- Right of access: to know what personal data of yours we process, for what purpose, and where it came from.
- Right to rectification and updating: to correct inaccurate or incomplete data.
- Right to erasure: to request deletion of your data when it is no longer necessary, when you withdraw consent, or when the processing is improper.
- Right to object: to object to a specific processing operation on grounds relating to your particular situation.
- Right to data portability: to receive your data in a structured, commonly used and machine-readable format.
- Right to suspension of processing while the merits of a request are being verified.
- Right not to be subject to automated decisions producing legal effects. The only automated assessment on this site is the form’s anti-spam check, which produces no legal effects: if it blocks your submission by mistake, write to us at info@code-studios.com and we will handle your enquiry all the same.
- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
9. How to exercise your rights
To exercise any of the rights above, send a request to info@code-studios.com stating which right you wish to exercise and enclosing a copy of your identity document, solely so that we can verify you are the data subject. We will not use that document for any other purpose and will delete it once the request has been handled.
We will respond to your request within a maximum of fifteen (15) business days from receipt, in accordance with article 33 of the LOPDP. Should a request prove particularly complex, we will inform you of the extension and its grounds within that same period.
If you consider that we have not handled your request properly, or that the processing of your data breaches the applicable rules, you have the right to lodge a complaint with Ecuador’s Superintendency for the Protection of Personal Data.
10. Minors
This website is aimed at professionals and companies. It is not intended for minors, and we do not knowingly collect personal data from people under eighteen (18) years of age.
If you become aware that a minor has provided us with personal data, write to info@code-studios.com and we will delete it immediately.
11. Cookies and similar technologies
This site uses a very small number of cookies and local storage technologies. Full details, including the purpose and duration of each, are set out in our Cookie Policy.
12. Changes to this policy
We may update this policy to reflect changes in our processing activities, in the infrastructure we use, or in applicable law. The date of the last update appears at the top of the document.
Where a change is substantial and affects processing based on your consent, we will notify you and, where appropriate, obtain fresh consent.