Privacy policy
Last updated: November 2026
1. Data controller
- Controller: Isdianys Alejandra Araujo Rodríguez, self-employed professional trading as MakeAttitude.
- Tax ID (NIF): 61607143X.
- Address: Calle de Alcalá 290, 28027 Madrid (Spain).
- Email: contacto@makeattitude.com.
- Phone: +34 662 005 417.
This policy applies in accordance with:
- the General Data Protection Regulation (EU) 2016/679 (GDPR);
- the Spanish Organic Law 3/2018 on data protection (LOPDGDD);
- for commercial communications by email, Spanish Law 34/2002 (LSSI-CE).
2. What data we process and why
2.1. Enquiries and service requests
When you write to us on WhatsApp, call us or email us to ask about availability, request information or ask for a quote, we process:
- your name and contact details;
- on WhatsApp, also your profile name and picture;
- the information you give us about the service, such as the type of service, date, place, number of people or reference images.
Purpose: to answer your enquiry, prepare the quote and, if you wish, make the booking.
Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
This data is not used to send you commercial communications.
2.2. Clients and students
If you book a make-up service or a MakeAttitude Education course, we process:
- your identification and contact details;
- the details of the service;
- where applicable, your billing details.
Purpose: to provide the service or training, manage payment, issue the invoice and comply with legal obligations.
Legal basis:
- performance of the contract (Art. 6(1)(b) GDPR);
- compliance with legal, tax and accounting obligations (Art. 6(1)(c) GDPR).
2.3. Information about your skin and health
To choose suitable products, you may tell us about allergies, skin sensitivities or other conditions affecting your skin. This is health data, which the law gives special protection.
We only process it if you provide it and give us your explicit consent (Art. 9(2)(a) GDPR). It is used only to provide the service safely and is not kept for longer than necessary for that purpose. You can withdraw your consent at any time.
2.4. MakeAttitude Education updates (Google form)
If you sign up to the interest list for upcoming courses through the Google form, we process:
- your first and last name;
- your email address;
- optionally, the city where you are.
Purpose: to manage your sign-up and send you information about upcoming courses, dates and news from MakeAttitude Education. These updates are sent by email only.
Legal basis: your consent, which you give by ticking the box in the form (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE).
Signing up does not reserve a place. One-to-one courses are arranged via WhatsApp, depending on availability.
If you gave us your phone number while the form asked for it, it is not used to send you updates.
Unsubscribing: you can withdraw your consent at any time by writing to contacto@makeattitude.com. Every update email will also explain how to unsubscribe.
2.5. Earlier sign-ups to the waiting list
Before the data protection information and the consent box were added, the form worked as a waiting list for the in-person self make-up course.
Sign-ups received at that time:
- are not treated as consent to receive updates and are not used automatically for new commercial communications;
- are kept separate from new sign-ups and are not added to the updates list;
- are kept only for as long as necessary for the purpose for which they were provided.
If you signed up to that waiting list, you can ask at any time for access to your data or for its deletion by writing to contacto@makeattitude.com.
2.6. Ebook purchases on Gumroad
The ebook "Tu Primer Kit de Maquillaje" is bought and downloaded on Gumroad. Gumroad processes payment and delivery data under its own privacy policy. MakeAttitude has no access to your card details.
MakeAttitude receives the purchase data that Gumroad makes available to sellers. It uses this data to manage the sale, deal with any issues and comply with its legal obligations (Art. 6(1)(b) and (c) GDPR).
Buying the ebook does not subscribe you to commercial communications.
2.7. Images of clients, students and models
MakeAttitude only publishes photos or videos in which a person can be identified with that person's express consent. This applies to the website, Instagram and any other channel.
- How consent is requested: in writing and separately from the contract, in accordance with Art. 6(1)(a) GDPR and Spanish Organic Law 1/1982 on the right to one's own image.
- Withdrawal: you can withdraw your consent at any time. From then on, the image will not be used again and will be removed from the channels MakeAttitude controls.
2.8. Instagram
If you message, comment on or tag MakeAttitude on Instagram, we process your username and the content of your message to reply to you and manage the profile.
Legal basis:
- our legitimate interest in replying to people who contact us (Art. 6(1)(f) GDPR);
- for service enquiries, taking pre-contractual steps (Art. 6(1)(b) GDPR).
Instagram is provided by Meta Platforms Ireland Limited under its own privacy policy.
2.9. Visits to the website
The website does not use cookies, analytics or advertising, and has no forms of its own.
Like any server, the hosting server records technical data for each visit:
- IP address;
- date and time;
- page requested;
- browser type.
This data is used to keep the website secure and working, based on legitimate interest (Art. 6(1)(f) GDPR).
More information in the Cookie policy.
3. Required data and accuracy
The form shows which fields are required. If you do not provide them, we cannot register your sign-up.
The data you give us must be true and up to date. If you give us data about other people, for example wedding guests, you must have informed them first.
4. How long we keep data
| Data | Retention criterion |
|---|---|
| Enquiries that do not lead to a booking | As long as needed to answer and follow them up; then deleted. |
| Clients and students | For the duration of the relationship and then for the periods required by tax and commercial law. |
| Skin and health information | Only as long as needed to provide the service. |
| Updates list | Until you unsubscribe or withdraw consent. |
| Earlier waiting-list sign-ups | Only as long as necessary for the purpose for which they were provided. Not used for commercial communications. |
| Ebook purchases | The periods required by tax and commercial law. |
| Images | Until you withdraw consent. |
| Server logs | The period set by the hosting provider for service security. |
At the end of each period, data is deleted or, where the law requires it, blocked for as long as liabilities may arise (Art. 32 LOPDGDD).
5. Recipients and providers
We do not sell your data. It is only disclosed to third parties where there is a legal obligation, for example to the tax authorities or the courts.
To provide our services we use the following providers, which access data only to the extent necessary:
- Webempresa: website hosting.
- Google:
- email;
- Google Forms and form responses;
- sending updates by email.
- WhatsApp Ireland Limited: messaging, when you write to us on WhatsApp.
- Gumroad: sale and delivery of the ebook.
- Meta Platforms Ireland Limited: Instagram.
6. International transfers
Some of these providers, or their subcontractors, may process data outside the European Economic Area, in particular in the United States. In those cases, transfers rely on the safeguards provided for in the GDPR:
- the European Commission's adequacy decision for entities participating in the EU-US Data Privacy Framework;
- or the standard contractual clauses approved by the European Commission.
7. Your rights
You can exercise the following rights at any time:
- access;
- rectification;
- erasure;
- objection;
- restriction of processing;
- portability.
Where processing is based on your consent, you can withdraw it at any time. This does not affect processing carried out before the withdrawal.
How to exercise them:
- Write to contacto@makeattitude.com stating which right you wish to exercise.
- We will only ask for more information if we have reasonable doubts about your identity.
- We will reply within one month. This period can be extended in the cases provided for in the GDPR.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
We do not make decisions based solely on automated processing, and we do not profile you using your data.
8. Minors
Under Spanish law, people under 14 may not give us their data without the consent of their parents or guardians (Art. 7 LOPDGDD).
For services aimed at minors, such as quinceañera make-up, the booking is made with their legal representatives. Any use of a minor's image also requires their authorisation.
9. Security
We apply technical and organisational measures appropriate to the risk to protect your data, including the website's encrypted connection (HTTPS).
10. Changes to this policy
We may update this policy to reflect legal changes or changes in how we work. The version in force is the one published at any given time, with its last-updated date.
The Spanish version of this text prevails over its translations.