Privacy Policy

Last updated: 24 October 2026 · Versión en español

At PL Scale Studio we respect your privacy. This policy explains what personal data we process when you visit plscalestudio.com or our landing pages, or when you contact us. It also covers why we use it, who we share it with and how you can exercise your rights.

It is written to comply with the laws of the countries where we work: Peru (Personal Data Protection Law No. 29733 and its Regulation, Supreme Decree No. 016-2024-JUS), the European Union (General Data Protection Regulation 2016/679 — GDPR — and the ePrivacy Directive 2002/58/EC), the United States (California Consumer Privacy Act as amended by the CPRA, the other state privacy laws, CAN-SPAM and COPPA), Canada (PIPEDA, Quebec Law 25 and CASL), Australia (Privacy Act 1988 and the Australian Privacy Principles, Spam Act 2003) and New Zealand (Privacy Act 2020, Unsolicited Electronic Messages Act 2007).

1. Data controller
2. Data we process
3. Purposes and legal bases
4. Analytics and advertising
5. Who we share data with
6. International transfers
7. How long we keep data
8. Your rights
9. Country-specific information
10. How to exercise your rights
11. Marketing communications
12. Security
13. Children
14. Changes to this policy

1. Data controller

The owner is also the person responsible for personal data protection and the privacy contact (including the “person in charge of the protection of personal information” under Quebec Law 25). Your data is held in the client and prospect personal data bank owned by the controller.

2. Data we process

Data you give us

• Contact form and requests: name, company or project, email address and any information you choose to share about your business.
• Emails and messages: what you write to us and your contact details.
• Clients: billing and contract details (name or company name, tax ID, address, payment details).

Data collected while you browse (only with your consent, except strictly necessary data)

• Technical data: IP address (which the tools truncate or use to estimate your approximate location), device type, operating system, browser, language and screen resolution.
• Usage data: pages visited, time on page, referring page, clicks, scrolling, mouse movements and events such as a form submission.
• Session recordings and heatmaps (Microsoft Clarity), with form fields and sensitive text masked.
• Online identifiers: cookies and identifiers from the Meta and TikTok pixels, which may be linked to your account on those platforms.

We do not ask for, and do not want to receive, sensitive data (health, ethnic origin, political opinions, religious beliefs, biometric data, etc.). Please do not include it in your messages.

3. Purposes and legal bases

If you do not give us the required form fields, we cannot answer your request. You can withdraw your consent at any time; this does not affect processing carried out before the withdrawal.

Automated decisions: we do not make decisions based solely on automated processing that have legal effects on you. Advertising platforms (Meta, TikTok) do build profiles to decide which ads to show you, but only if you accept marketing cookies.

4. Analytics and advertising

These tools do not load until you accept their category in the cookie banner. If your browser sends a Global Privacy Control (GPC) signal, we automatically switch off marketing tools.

For the Meta and TikTok pixels, PL Scale Studio and each platform are joint controllers (GDPR art. 26) for collecting and transmitting data through the pixel. Each platform's further processing is governed by its own policy. Cookie-by-cookie details are in the Cookie Policy.

The site also loads fonts from Google Fonts. It sets no cookies, but your browser connects to Google servers, which receive your IP address.

5. Who we share data with

• Service providers (processors): web hosting, email, cloud storage, client management and invoicing tools, and the analytics tools listed above. They only process data on our instructions and under confidentiality and data protection agreements.
• Advertising platforms (Meta and TikTok), only if you accept marketing cookies.
• Authorities (for example tax authorities, data protection authorities or courts), when the law requires it.

We do not sell your personal information for money. However, some US laws treat the use of advertising pixels as a “sale” or “sharing”. You can therefore opt out via Do Not Sell or Share My Personal Information (see section 9).

6. International transfers

Some providers process data outside your country, mainly in the United States and, for TikTok, also in other countries where its group operates (such as Singapore or Malaysia). When we send data outside Peru, the European Economic Area, Canada, Australia or New Zealand, we make sure it stays adequately protected through:

• the EU-US Data Privacy Framework, in which Google, Microsoft and Meta participate;
• Standard Contractual Clauses approved by the European Commission, or equivalent safeguards;
• the cross-border data flow rules of Law 29733 and its Regulation, Australian Privacy Principle 8 and New Zealand IPP 12.

Email us if you would like a copy of these safeguards.

7. How long we keep data

• Enquiries that do not lead to a contract: up to 2 years from the last contact.
• Clients: for the duration of the relationship, then for the periods required by law (for example tax and accounting rules).
• Marketing communications: until you withdraw your consent.
• Analytics: Google Analytics and Matomo, 14 months. Microsoft Clarity, up to 13 months (session recordings, 30 days).
• Advertising pixels: according to each platform's policy. Cookies last no longer than 13 months.
• Record of your cookie choice: 12 months. After that we ask you again.

When the period ends, the data is deleted or anonymised.

8. Your rights

Depending on where you live, you have the following rights, which we honour across the board:

• Information and access: to know whether we process your data and to get a copy.
• Rectification or update of inaccurate or incomplete data.
• Deletion of your data.
• Objection to processing, including advertising and profiling.
• Restriction of processing.
• Portability: to receive your data in a structured, commonly used format.
• Withdrawal of consent at any time, as easily as you gave it.
• Not to be subject to decisions based solely on automated processing.
• Non-discrimination for exercising your rights.
• Complaint to the competent data protection authority (see section 9).

9. Country-specific information

Peru

You can exercise your ARCO rights (access, rectification, cancellation and objection) and the other rights granted by Law 29733 and its Regulation (Supreme Decree No. 016-2024-JUS). We will reply within the deadlines set by the Regulation. If you believe we have not handled your request properly, you can file a complaint with the National Authority for Personal Data Protection of the Ministry of Justice and Human Rights (gob.pe/anpd).

European Union and European Economic Area

You have all the rights in Articles 15 to 22 of the GDPR. We reply within one month, extendable by two further months for complex requests. You can lodge a complaint with the supervisory authority of the country where you live, where you work or where the alleged infringement took place (list of authorities). Non-essential cookies are only set with your prior consent (ePrivacy Directive art. 5(3)).

United States (California and other states)

This section serves as our notice at collection and privacy policy under the CCPA/CPRA and the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with similar laws. We extend these rights to all US residents, even where our size does not require it.

• Categories of personal information collected in the last 12 months: identifiers (name, email, IP address, online identifiers); commercial and professional information (company, services requested); internet activity (browsing and interaction with the site); approximate geolocation (derived from IP); and inferences for advertising (only with marketing cookies). We do not collect sensitive personal information.
• Sources: you directly, your browser or device, and our analytics and advertising tools.
• Purposes: those in section 3.
• Sale or sharing: we do not sell personal information for money. Online identifiers and internet activity may be “shared” with Meta and TikTok for cross-context behavioural advertising, or may count as a “sale” or “targeted advertising” in some states. We do not knowingly sell or share the personal information of anyone under 16.
• Your rights: to know and access, delete, correct, port, opt out of sale, sharing and targeted advertising, and not to be discriminated or retaliated against for exercising them.
• How to opt out: use the Do Not Sell or Share My Personal Information link or switch off “Marketing & advertising” in the cookie panel. We also honour the Global Privacy Control signal as a valid opt-out request.
• Verification and authorised agents: we verify your identity by matching the information you give us with what we already hold. You may use an authorised agent, who must provide your written permission.
• Timing and appeals: we reply within 45 days (extendable by another 45 days with notice). If we deny your request, you can appeal by emailing marketing@plscalestudio.com with the subject “Appeal”. If you disagree with the outcome, you may contact your state Attorney General.
• Shine the Light (California): we do not disclose personal information to third parties for their own direct marketing purposes.

Canada

We process your data under PIPEDA and, if you live in Quebec, Law 25 (Act respecting the protection of personal information in the private sector). You can access and correct your data and withdraw consent. In Quebec, you can also request portability and the de-indexing or cessation of dissemination of your data. The person in charge of the protection of personal information is Patricia Lozano Canello (marketing@plscalestudio.com). We reply within 30 days. You can complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec. Our commercial electronic messages comply with CASL (see section 11).

Australia

We comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988. Where practicable, you can deal with us anonymously or under a pseudonym, and you can request access to and correction of your data. We reply within a reasonable time, usually 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). Our marketing emails comply with the Spam Act 2003.

New Zealand

We comply with the Information Privacy Principles (IPPs) in the Privacy Act 2020. You can request access to and correction of your data (IPPs 6 and 7). We reply within 20 working days at most. You can complain to the Office of the Privacy Commissioner. Our commercial messages comply with the Unsolicited Electronic Messages Act 2007.

10. How to exercise your rights

Email marketing@plscalestudio.com with the subject “Data protection” and tell us which right you want to exercise. To protect your information, we will verify your identity. Writing from the email address you gave us is usually enough; if needed, we will ask for one more detail, never more than necessary. Exercising your rights is free.

You can manage cookies at any time here:

Cookie settings

11. Marketing communications

We only send marketing emails or newsletters if you give us your express consent (an unticked box) or, where the law allows, if you are already a client and the services are similar. Every message identifies PL Scale Studio, includes our contact details and a one-click unsubscribe link. We action unsubscribes immediately and within 10 business days at the latest. This complies with Law 29733, the GDPR and ePrivacy Directive, CAN-SPAM, CASL, the Spam Act 2003 and the UEMA 2007.

12. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), access control, strong passwords and two-step verification, providers with security guarantees, and data minimisation. If a security breach is likely to affect you, we will notify the competent authority and, where required, you, within the legal deadlines. Examples are 72 hours under the GDPR, the Australian Notifiable Data Breaches scheme, PIPEDA and the New Zealand Privacy Act 2020.

13. Children

Our services are aimed at businesses and professionals. We do not knowingly collect data from anyone under 18, and in particular not from children under 14 (Peru), 16 (EU) or 13 (COPPA, US). If you believe a minor has given us data, email us and we will delete it.

14. Changes to this policy

We may update this policy if the law, our services or our tools change. We will publish the new version with its date. If the change is significant, we will let you know and, where required, ask for your consent again.

This policy applies to plscalestudio.com and to every PL Scale Studio landing page that links to it.