How CARLO Design handles personal data, GDPR-compliant for our clients in the EU.
Last updated: 30 September 2026
The party responsible for the processing of personal data on this website (the "controller" under Art. 4 GDPR) is:
For visitors and clients in Germany, our Berlin office is also reachable at berlin@carlodesign.com.
This privacy policy applies to the website carlodesign.com and all related sub-pages. It does not apply to third-party websites that we link to.
When you visit our website, our hosting provider (Cloudflare, Inc.) automatically collects information that your browser transmits. This includes:
This data is necessary for the technical operation and security of the website. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in operating a stable, secure website). Logs are stored for a maximum of 30 days, then deleted.
If you use the contact form on our website, the data you submit (name, email address, phone number, project location, service of interest, message) is sent to us via Formspree, Inc. (251 Little Falls Drive, Wilmington, DE 19808, USA), the service we use to receive form submissions.
The data is used solely to respond to your enquiry. The legal basis is Art. 6 (1)(b) GDPR (steps prior to entering a contract) and Art. 6 (1)(a) GDPR (your consent, given by submitting the form). You may withdraw consent at any time by emailing us.
Transfer to the United States: Formspree is based in the USA. The data transfer is based on Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR. Formspree is also certified under the EU-U.S. Data Privacy Framework. More information: Formspree Privacy Policy.
The form also transmits which page and which source brought you to us. What is stored and when is described in section 5.5.
When you contact us by email, phone, or WhatsApp, the information you provide is stored to process your enquiry. The legal basis is Art. 6 (1)(b) GDPR.
If you apply for a position through our careers page or by email, we process the information you provide: the position and location you are interested in, your professional experience, the languages you speak, what you tell us about yourself, your possible start date, your salary expectations (optional), your name, email address and phone number, your CV and portfolio if you upload them (optional) and any documents you send us by email.
We use this data only to assess your application and, where appropriate, to arrange an interview and a trial day. Only the people at CARLO Design in Berlin and Palma who are involved in the selection have access to it. We do not pass your data on to third parties for any other purpose. Providing the data is voluntary, but without it we cannot consider your application. Please do not send us special categories of personal data, such as health information, unless they are relevant to the position.
The legal basis is Art. 6 (1)(b) GDPR (steps prior to entering into an employment relationship) and your consent under Art. 6 (1)(a) GDPR, which you give in the application form. After the selection process has ended, we keep your data for a limited time so that we can respond to possible legal claims, for example under the German General Equal Treatment Act (AGG). The legal basis for this is Art. 6 (1)(f) GDPR.
Retention: If we do not hire you, we delete your application data no later than six months after the end of the selection process. If we hire you, your data becomes part of your personnel file. If we would like to keep your application for future positions, we will ask for your separate consent.
How your application reaches us: Applications sent through the online form are transmitted via Formspree, Inc. (see section 3.2, including the information on the transfer to the United States). Formspree stores uploaded files until we delete them, at the latest after 6 months. Applications and documents that you send us by email, for example a portfolio PDF to team@carlodesign.com, are stored by our email hosting provider.
You can withdraw your consent at any time with effect for the future and exercise your rights under section 6 by writing to team@carlodesign.com.
We use Google Maps (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to display our office locations on the contact page. When the map is loaded, your IP address and information about your visit may be transmitted to Google servers in the United States.
The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in presenting our office locations clearly). The transfer to the USA is based on Standard Contractual Clauses. More information: Google Privacy Policy.
We use Google Fonts (Cormorant Garamond, Lora, Jost) to display typography consistently across browsers. Fonts are loaded from Google servers, which may transmit your IP address to Google.
The legal basis is Art. 6 (1)(f) GDPR (consistent visual presentation of our website). More information: Google Privacy Policy.
Our website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit our site, Cloudflare processes connection data including your IP address for security and stability purposes (DDoS protection, caching). More information: Cloudflare Privacy Policy.
On your first visit a banner asks whether we may use services for statistics and marketing. You can accept all, decline all or choose individually under “Settings”. Without your consent these services are not loaded. Your choice is valid for twelve months. You can change or withdraw it at any time, here (Open cookie settings) or via the “Cookie settings” link in the footer. The legal basis is your consent under Section 25 (1) TDDDG and Art. 6 (1)(a) GDPR. Withdrawal takes effect for the future.
We store your choice in your browser’s local storage (carlo_consent_v1) so that we do not ask again on every page. This storage is technically necessary (Section 25 (2) no. 2 TDDDG, Art. 6 (1)(f) GDPR).
If you consent to statistics, we use Google Analytics 4, loaded via Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records which pages you visit, how long you stay and which source brought you to us, and sets cookies for this (for example _ga). Data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. More information: Google privacy policy.
If you consent to marketing, we measure whether a visit through one of our ads on Google, Facebook, Instagram or in ChatGPT led to an enquiry.
If you consent to statistics or marketing, we store in your browser’s local storage (carlo_attr_v1, 90 days) which page and which source brought you to us, for example an ad identifier, a campaign or the referring website. When you send an enquiry, this information is sent with it so that we can see which channels lead to enquiries. Without consent we store nothing. If you send an enquiry on the same page you arrived on, the form only transmits the address of that page and the referring website.
Regardless of the banner, we use Cloudflare Web Analytics to measure page views and loading times. This service sets no cookies and stores nothing in your browser. The provider is Cloudflare, Inc. (address in section 4.3). The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in a fast, working website). More information: Cloudflare privacy policy.
Under the GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us at palma@carlodesign.com. We will respond within 30 days.
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our Mallorca office is the Spanish data protection agency Agencia Española de Protección de Datos (AEPD)aepd.es. For our Berlin office, the Berliner Beauftragte für Datenschutz und Informationsfreiheitdatenschutz-berlin.de.
This website uses SSL/TLS encryption (HTTPS) for all data transmission. We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, or manipulation.
We reserve the right to update this privacy policy as needed to reflect changes in our services or legal requirements. The current version is always available on this page. The "last updated" date at the top reflects the most recent revision.
