Legal and privacy information
This policy explains in clear language which personal data we process, why we use it, how long we keep it and how you can exercise your rights.
Last updated: 28 August 2026
1. Data controller
- Controller
- System.group Bires, S.L.
- Tax ID
- B87495750
- Trading name
- Marabú Madrid
- Contact address
- Calle Carbonero y Sol, 15, 28006 Madrid, Spain
- Privacy email
- info@marabumadrid.com
- Website
- www.marabumadrid.com
2. Scope and adults only
This policy applies to website visitors, people who request information or bookings, people who contact us by phone, email or WhatsApp, candidates who submit the casting form, and anyone who interacts with Marabú Madrid through a website-related channel.
The website, its services and the casting form are intended exclusively for people aged 18 or over. We do not knowingly request or process children’s data. If we become aware that a minor has submitted data, we will delete it as soon as reasonably possible.
3. Personal data we may process
- Identity and contact data: name, email address, telephone number and equivalent details you provide.
- Communication data: subject, message, contact history, date, channel and information you choose to include.
- Booking and service data: preferences, requested date, service, availability and information required to manage your request.
- Candidate data: professional information, availability, experience, contact details, form answers and photographs submitted for selection.
- Technical data: IP address, technical identifiers, security logs, device and browser, pages visited, date and time, and cookie-consent records.
- Third-party data: information received when you use WhatsApp, Google Maps or another external service.
We do not use casting photographs for biometric identification. Please do not include health data, sexual orientation, sex-life information or other special-category data in free-text fields unless strictly necessary and you have provided the specific explicit consent requested in the form.
If you provide another person’s data, you confirm that you are authorised to do so and that you have informed them of the essential contents of this policy.
4. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Respond to enquiries, information requests and bookings. | Steps requested before entering into a contract and, where applicable, performance of the requested relationship. Consent for optional information. | For the handling period and up to 12 months after the last interaction, unless a contract, legal duty or claim requires longer retention. |
| Manage casting applications. | Pre-contractual steps requested by the candidate. Separate explicit consent for photographs or voluntarily supplied special-category data. | Up to 6 months after the process closes, unless a legal duty or claim requires longer retention. |
| Manage phone, email and WhatsApp communications. | Pre-contractual steps, performance of the request or consent, depending on context. | As long as required to respond, followed by relevant legal and limitation periods. |
| Protect the site, prevent fraud and investigate security incidents. | Legitimate interests in protecting users, data and systems, and compliance with security duties. | Normally up to 12 months, longer where an incident, investigation or legal requirement applies. |
| Comply with legal, tax, accounting and administrative requirements. | Compliance with legal obligations and the establishment, exercise or defence of claims. | For statutory retention and limitation periods. |
| Measure website use with Google Analytics 4. | Prior consent for analytics cookies. | Cookie periods are listed in the Cookie Policy. GA4 user and event retention should be configured to the minimum required, recommended: 14 months. |
| Store and prove cookie choices. | Legal compliance and legitimate interests in respecting and evidencing the user’s choice. | 12 months, unless consent is withdrawn earlier or a material change requires renewed consent. |
You may withdraw consent at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.
We do not make decisions producing legal or similarly significant effects based solely on automated processing, and we do not sell personal data.
5. Contact, bookings and casting
5.1 Contact and booking requests
Required fields are necessary to respond. Please do not send more data than needed in the message field.
5.2 Casting form
The casting form is for adults aged 18 or over. Photographs must belong to the candidate and be submitted voluntarily for application assessment. They must not be automatically published or added to the public media library.
The recommended technical setup validates file type, size and image content, stores files temporarily outside a public path, sends them through an authorised internal channel and deletes the temporary copy immediately after transmission. Access must be limited to authorised selection personnel.
Applications are not automatically reused for future opportunities. If that option is offered later, separate, optional and unticked consent will be requested before data is retained for the new purpose.
5.3 Marketing communications
We will not send electronic marketing without a valid legal basis. Where consent is requested, it will be optional, separate, unticked and withdrawable at any time via info@marabumadrid.com.
6. Recipients and processors
We do not disclose personal data unless needed to handle a request, provide the requested service, comply with law or protect legitimate rights.
Contracted providers may process data on our instructions for hosting, backups, email and SMTP, security, IT support, cookie-consent management, cookie-based analytics after consent, and professional legal, tax or accounting advice.
Data may also be disclosed to public authorities, courts, law-enforcement bodies or regulators where legally required.
7. International transfers
Technology providers such as Google or WhatsApp may process information outside the European Economic Area. Where an international transfer takes place, an accepted legal mechanism will be used, such as an adequacy decision, a valid recognised framework, standard contractual clauses and, where necessary, supplementary measures.
Google Analytics cookies and non-essential external content remain blocked until the relevant consent is provided. The measurement tag always loads with analytics storage denied for cookieless technical measurement and consent signalling; full cookie-based measurement is enabled only after acceptance. Opening a WhatsApp link or activating Google content takes you to a third-party service governed by that provider’s terms and policies.
8. Your rights
Where applicable, you may exercise rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent. You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects.
Send requests to info@marabumadrid.com, stating your name, the right concerned and a clear description of the request. Where reasonably necessary, we may request secure identity verification.
We normally respond within one month. This may be extended by up to two further months where the request is complex or numerous requests are received, in which case we will explain the extension.
You may lodge a complaint with the Spanish Data Protection Agency if you believe your data has been processed unlawfully.
9. Security and confidentiality
We apply technical and organisational measures proportionate to risk, including HTTPS encryption in transit, access controls, data minimisation, file validation, backups, system updates, security logs and supplier review where appropriate.
No system is completely infallible. Where a personal data breach may create a risk, we will assess, document, notify and communicate it as required by applicable law.
10. Third-party services
The website may include links or functions from Google Maps, WhatsApp, social networks or other providers. Those providers may receive technical data or information you choose to communicate. Please review their policies before using their services.
11. Changes to this policy
We may update this policy to reflect legal, technical or processing changes. The current version and update date will remain available on this page. Where a material change affects consent-based processing, renewed consent will be requested when required.