Privacy & Cookies - Ower Contreras

Contact enquiries

When you use the contact form, the website processes your first name, last name, email address and message so Ower can answer your enquiry and, where relevant, take steps towards a photography or film booking.

The legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR) and, where applicable, Ower’s legitimate interest in managing business correspondence (Article 6(1)(f) GDPR). Information needed for accounting or other legal duties may be kept under Article 6(1)(c) GDPR.

Web3Forms acts as a processor for delivery of the form. Its published privacy information says submissions may be retained for up to three years unless they are deleted earlier or a shorter plan limit applies. Its infrastructure may process information in several regions, including India; its data processing terms provide safeguards including the EU Standard Contractual Clauses for relevant international transfers. Ower should delete enquiries when they are no longer needed. Do not include sensitive personal information in the message field.

The contact form uses hCaptcha, provided by Intuition Machines, Inc., to distinguish genuine enquiries from automated spam. When the contact page is opened and the check is completed, hCaptcha may process technical and interaction data such as IP address, browser information, time on the page and pointer movements. The legal basis is Ower’s legitimate interest in protecting the form and website from spam and abuse (Article 6(1)(f) GDPR). hCaptcha acts as a processor, describes limited retention and data minimisation, and provides international-transfer safeguards including the EU-US Data Privacy Framework and Standard Contractual Clauses.

Hosting and technical logs

The website is hosted by Vercel, which acts as a processor under its data processing agreement. Vercel may process technical request information such as IP address, browser details, requested page, date and time to deliver, secure and diagnose the website.

This processing is based on Ower’s legitimate interest in providing a secure and reliable website (Article 6(1)(f) GDPR). Technical information is kept only as long as needed for operation, security and applicable legal duties. Vercel uses a global infrastructure and describes its international-transfer safeguards, including Standard Contractual Clauses, in its data processing agreement.

Cookieless statistics and performance

The website uses Vercel Web Analytics and Vercel Speed Insights, both provided by Vercel as part of the hosting. They count page views and measure how quickly pages load, so Ower can see which pages are visited and where the website can be improved. Results are only shown in aggregated form. Vercel Web Analytics also counts when a contact enquiry was delivered successfully; this count does not include your name, email address or message.

Both tools work without cookies and do not use identifiers that follow you across other websites. According to Vercel, visitors are distinguished only by a hash created from the incoming request, and this visitor session is discarded after 24 hours. Processed information includes the page visited, the referring website, browser, operating system, device type, approximate location (country, region and city) and, for Speed Insights, loading and responsiveness measurements.

Because these tools set no cookies and use no cross-site identifiers, this measurement does not ask for your consent. It is based on Ower’s legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR). Vercel acts as a processor under the data processing agreement linked above. Embedded versions of this website on other sites load neither tool.

PostHog website measurement

The website uses PostHog Inc., a US company, to understand visits, interactions and page performance. This project uses PostHog’s US cloud region, so measurement data is processed in the United States. IP anonymisation is enabled in the project and the website does not request storage of your IP address.

Before you choose and if you reject, PostHog counts visits and the interactions described below in cookieless mode. It stores no PostHog cookies or persistent visitor identifier on your device. PostHog uses a temporary server-generated hash to produce anonymous visit statistics. This limited measurement is based on Ower’s legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR). Session recordings, heatmaps and automatic click capture stay disabled in this mode.

Only if you select “Accept measurement”, the same choice enables Google measurement and PostHog’s persistent browser identifier, automatic interaction capture, heatmaps and session recordings. These help Ower see how visitors move through pages and where navigation causes difficulty. All inputs are masked in recordings, text is masked, and the entire contact form is blocked from recordings and automatic capture. Network request bodies, headers and console messages are not recorded. The legal basis for this additional measurement and device storage is your consent (Article 6(1)(a) GDPR and the applicable rules for storage or access on your device).

The website sends events such as starting the contact form, a successfully delivered enquiry, a form error (only its category and affected field names), contact and social link clicks, gallery and carousel use, video progress and opened FAQ questions. These events do not include your name, email address, phone number or message. Page query strings and fragments are removed from PostHog events; person profiles are disabled.

You can withdraw consent at any time through “Privacy settings”. This stops session recordings, heatmaps and persistent measurement, removes PostHog’s stored browser data and returns to anonymous cookieless counting. The choice also applies in other open tabs. The website remembers your shared measurement choice for up to 180 days and asks again when it expires or the policy changes. Embedded pages do not load PostHog.

PostHog provides a data processing agreement for its cloud service. Information about its processing and the available agreement is linked below. You can contact Ower using the details below to ask about measurement data, exercise your rights or object to processing based on legitimate interests.

Google Analytics

Only if you select “Accept measurement”, the website loads Google Analytics 4 to understand how the site is used: which pages are viewed, roughly which regions visitors come from and which sites or searches brought them here. The legal basis is your consent (Article 6(1)(a) GDPR and the applicable rules for storage or access on your device).

After your consent, Google Analytics also records a small set of interactions: a successfully delivered contact enquiry, a failed form submission (only the type of error and the names of the affected fields), clicks on email, phone, WhatsApp and social media links and on buttons leading to the contact page, opened gallery images, use of the retreat carousels, how much of a video is watched and which FAQ questions are opened. These events never contain your name, email address, phone number or message.

Google Ireland Limited processes this information for the website. Google states that Google Analytics 4 does not log or store individual IP addresses. Personalised advertising signals are disabled. You can withdraw your consent at any time via “Privacy settings”; measurement then stops and the related cookies are removed from your browser.

Google Ads conversion measurement

Only if you select “Accept measurement”, the website loads the Google tag to understand whether an advert led to a successfully delivered contact form. The legal basis is your consent (Article 6(1)(a) GDPR and the applicable rules for storage or access on your device). The conversion event does not include your name, email address or message. The site keeps ad personalisation disabled at all times; advertising and analytics storage are used only after your consent.

If you reject, the Google advertising tag is not loaded. You can change or withdraw your choice at any time through “Privacy settings” at the bottom of the screen. The choice, date and privacy-policy version are stored locally in your browser for up to 180 days so the website can remember it; the site asks again after that period or after a relevant policy update.

After consent, Google may use identifiers and first-party cookies such as names beginning with _gcl_ for conversion attribution. Google may process information outside the European Economic Area under the safeguards described in its own privacy documentation.

Videos

Lifestyle films play directly on this website from public video URLs hosted on Vercel Blob, provided by Vercel Inc. When your browser requests a video, Vercel receives technical information such as your IP address and browser details to deliver the file. Video cover images are served by this website.

Vercel privacy policy

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability of your personal information, or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Contact owercontreras4@gmail.com to exercise a right or ask a question. You may also lodge a complaint with Portugal’s data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

CNPD