Last updated: 13 October 2026
This policy explains what personal data we collect through glassyfilms.com, what we use it for and on what legal basis, how long we keep it, who receives it and how you can exercise your rights. We have tried to say it plainly.
The short version
- We only use the data you send us to answer you.
- The Make it Real newsletter belongs to Yago de la Sotilla: he, not Glassy Films, is responsible for its list of subscribers.
- We do not sell your data and we do not use it for advertising.
- We keep the messages from the contact form for 24 months and then delete them automatically.
- Analytics cookies are only used if you accept them, and you can change your mind at any time.
- You can access, correct or delete your data whenever you want by writing to info@glassyfilms.com.
Who is responsible for your data
The controller of your personal data is:
Company name: GLASSY FILMS, S.L.
Registered office: Calle Pau Claris 167, 1º 2ª A, 08037 Barcelona, Spain
Tax ID (NIF): B65514747
Registered in the Barcelona Commercial Registry, volume 42.475, folio 67, sheet B-409515
Email: info@glassyfilms.com
For anything related to your data, write to info@glassyfilms.com. We have not appointed a data protection officer because, given the kind and amount of data we handle, the law does not require it; your message will reach the people in charge directly.
When you fill in the contact form
The contact form appears on the Home page, the About page and the Contact page, also when you come from “Book this director”.
- What data: your name, your email address, your company or agency (optional), the type of project (optional), your message and, if you come from “Book this director”, the director you are asking about, together with the privacy box. We also receive the date and the page from which you sent it.
- What for: to answer your enquiry and, if you ask for it, to prepare a proposal or a budget. If we end up working together, to manage the project and invoice it.
- Legal basis: your own request, because we take the steps you ask for before a possible contract, and our legitimate interest in answering the professional enquiries we receive, for example when you write on behalf of a brand or an agency. If we work together, the performance of the contract and our accounting and tax obligations.
- Is it compulsory? Your name, your email address, your message and the privacy box are required: without them we cannot answer you through the form. The rest is optional. If you prefer, write to info@glassyfilms.com and tell us whatever you choose.
- How long we keep it: 24 months from the day it reaches us. After that, we delete it from the website and from our inbox. If we end up working together, we keep what the project needs for as long as the law requires (for example, six years for accounting and commercial records).
- Who receives it: the message is saved in the database of this website, hosted by IONOS, and we receive a copy by email at info@glassyfilms.com (Google Workspace). No one else, unless the law requires it.
To stop spam, the form has a hidden field that only robots fill in, it rejects messages sent in less than three seconds and it accepts no more than five messages an hour from the same connection. To count them, it keeps for one hour an identifier calculated from your IP address with a secret key, never the IP address itself. We do not use external anti-spam services.
If your message includes data about other people (for example, members of your team), make sure you can share it with us and tell them about this policy.
When you write to us by email or WhatsApp
- What data: your email address or your phone number and the name on your WhatsApp profile, and whatever you include in your message.
- What for and legal basis: the same as for the form: to answer you, because you have asked us to, and in our legitimate interest in replying to professional enquiries. If we work together, to manage the project.
- How long we keep it: for as long as we need it to deal with your enquiry and its follow-up and, if it leads to a project, for as long as the law requires.
- Who receives it: our email provider, Google (Google Workspace). The phone number on this website is for WhatsApp only: if you write to us there, your messages go through WhatsApp (WhatsApp Ireland Limited, part of Meta), which handles them as the provider of that service, under its own terms and privacy policy.
If you subscribe to the Make it Real newsletter
Make it Real is the newsletter of Yago de la Sotilla, founder of Glassy Films, who writes it and publishes it in his own name on Substack. The Subscribe button on the Newsletter page takes you to Substack, where you sign up.
- Who is responsible for your data: Yago de la Sotilla, not Glassy Films. Glassy Films does not receive or manage the list of subscribers.
- Who hosts it: Substack Inc. (United States), the platform that hosts the newsletter, sends it and keeps the list of subscribers, under its own privacy and cookie policies.
- How to unsubscribe and exercise your rights: with the unsubscribe link at the bottom of every issue, from your Substack account or by writing to Yago de la Sotilla, whose contact details are on the About page of the newsletter on Substack and at the bottom of every issue.
When you visit the Newsletter page
The Newsletter page of this website shows the latest posts of Make it Real, which our server reads from Substack. Their images load directly from Substack’s servers and from Amazon Web Services, where Substack stores them, so those companies receive your IP address and technical data about your browser, as with any image on the internet. They do not store cookies. The legal basis is our legitimate interest in showing our founder’s newsletter on our own website.
Statistics, only if you accept them
- What data: the pages you visit and for how long, how you got here (for example, from a search engine or a link), what you do on the page (such as playing a video, moving through a carousel, following a link to another website, clicking our email address or phone number, or sending the form, without its content), your approximate location (country and city), your language, the type of device and browser, and a random identifier stored in the Google Analytics cookies. According to Google, Google Analytics 4 does not store IP addresses: it uses them at the moment of your visit to estimate your location.
- What for: to know how many people visit the website and which projects and content are most useful to them, so we can improve it. We have switched off Google Signals and the advertising features: we do not use your visit to show you ads, we do not combine it with other data about you and we do not send Google what you write in the form.
- Legal basis: your consent, which you give by clicking Accept in the cookie banner. It is optional: if you click Reject, or do not choose, Google Analytics does not load.
- How to withdraw it: at any time, from “Cookies” at the bottom of every page or with the button in the Cookie policy. We stop measuring at once and delete the Google Analytics cookies from your browser. Withdrawing your consent does not affect the measurement made before.
- How long we keep it: Google Analytics keeps the data of each visit for 14 months. The cookies last up to two years in your browser, unless you delete them or withdraw your consent first.
- Who receives it: Google Ireland Limited, which provides Google Analytics as our processor. Google LLC may access the data from the United States (see International transfers).
Videos
Most of the videos on this website are delivered from Vimeo’s servers: the background videos, the previews of each project and the full videos. The background videos start on their own when a page loads, so Vimeo receives your IP address and technical data about your browser and device even if you do not play anything, and it stores a security cookie, __cf_bm, which lasts 30 minutes (see the Cookie policy). When a video needs the Vimeo player, it loads in “do not track” mode, which tells Vimeo not to track your session or collect statistics about your visit.
- What for and legal basis: to show our work, which is what this website is for: our legitimate interest.
- Who receives it: Vimeo.com, Inc. (United States) and the content delivery networks it uses, which handle these data under Vimeo’s privacy policy.
When you browse the website
This website is hosted by IONOS (IONOS SE, Germany). To deliver the pages and protect them, the server records technical data of each request, such as the date and time, the page requested and your browser, with the IP address shortened so that it does not identify you. The legal basis is our legitimate interest in keeping the website available and secure.
Who receives your data
We do not sell your data or give it to anyone for their own purposes. To run this website we rely on providers that process data on our behalf, only following our instructions and under contracts that oblige them to protect it:
- IONOS SE hosts this website and its database, where the messages from the form are saved, and sends us the email notice of each message.
- Google (Google Ireland Limited and Google LLC) provides our email (Google Workspace) and, only if you accept it, Google Analytics.
Other companies receive data as providers of their own services, under their own privacy policies: Vimeo, when the videos load; Substack and Amazon Web Services, for the images of the Newsletter page; and WhatsApp (Meta), if you write to us there.
Apart from them, we only share data when a law requires it, for example with the tax authorities or the courts.
International transfers
IONOS processes the data in the European Union. Google, Vimeo, Substack, Amazon Web Services and Meta are based in the United States or may access the data from there. These transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for the companies certified under it, or by the standard contractual clauses approved by the Commission, which these providers include in their data protection terms. You can ask us for more information about these safeguards at info@glassyfilms.com.
How long we keep your data, in one place
- Messages from the form and their email copy: 24 months.
- Emails and WhatsApp messages you send us directly: for as long as we need them to deal with your enquiry.
- Data of a project, if we work together: for as long as the law requires (for example, six years for accounting and commercial records).
- The anti-spam identifier: one hour.
- Statistics: 14 months in Google Analytics; its cookies, up to two years in your browser.
- Your choice in the cookie banner: 12 months in your browser.
Your rights
You can exercise these rights at any time, free of charge:
- Access: know whether we process data about you and get a copy.
- Rectification: correct data that is wrong or incomplete.
- Erasure: ask us to delete your data, for example when we no longer need it.
- Objection: object to processing based on our legitimate interest.
- Restriction: ask us to keep your data but not use it while we check a request or a claim.
- Portability: receive the data you gave us in a structured, commonly used format, or ask us to send it to someone else, when we process it based on your consent or a contract and by automated means.
- Withdraw your consent (for the statistics) at any time, without affecting the processing carried out before.
To exercise them, write to info@glassyfilms.com and tell us which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for information to confirm it. We will reply within one month; if your request is complex or we receive many, we may extend this by two more months, and we will tell you why.
If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). We would be grateful if you told us first, so we can try to fix it.
Automated decisions
We do not make decisions about you based solely on automated processing, and we do not build profiles of you.
Minors
This website is aimed at companies and professionals. If you are under 14, do not send us your data or accept analytics cookies: Spanish law requires the consent of your parents or guardians. If we find out that we have received data from a child under 14 without that consent, we will delete it.
How we protect your data
The website works over an encrypted connection (HTTPS). Only the people at Glassy Films who need your data can access it, and our providers apply the security measures set out in their contracts with us.
Changes to the privacy policy
If we change how we handle your data, we will update this page and the date at the top.