Legal
Privacy Policy
Last updated: 5 October 2026
Urban Crafts Club is a service operated by THE MOTHERTREES INNOVATION ECOSYSTEM SL. This policy explains what personal data we process, why, and the rights you have under the GDPR and Spain's data-protection law (LOPDGDD).
1. Who is responsible
- Controller: THE MOTHERTREES INNOVATION ECOSYSTEM SL
- NIF: B10757482
- Address: Estadi Olímpic Lluís Companys, Passeig Olímpic 15-17, 08038 Barcelona, Spain
- Contact for data protection: info@themothertrees.com
2. Summary of processing
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visits | IP address, browser data, technical logs | Operate and secure the website | Legitimate interest (Art. 6.1.f GDPR) |
| Studio accounts | Name, email, password (stored encrypted by our authentication provider), sign-in records, Terms acceptance | Provide and secure the account | Contract (Art. 6.1.b) |
| Studio management and verification | Link between account and studio, verification method and codes, claims, profile changes, invitations | Verify and allow authorised management of studio information | Contract (Art. 6.1.b) and legitimate interest in preventing unauthorised changes (Art. 6.1.f) |
| Contact form | Name, email, contact type, message, language, date | Respond to your enquiry | Legitimate interest in answering enquiries; pre-contractual steps you request (Art. 6.1.b/f) |
| Company enquiries | Name, work email, company, job title, company size, message | Respond to Corporate Wellbeing enquiries | Pre-contractual steps you request (Art. 6.1.b); legitimate interest (Art. 6.1.f) |
| Craft Communities waiting list | Name, email, city, interests, optional newsletter choice, mentor details | Manage the waiting list and, only if you opted in, send the newsletter | Your request (Art. 6.1.b); consent for the newsletter (Art. 6.1.a) |
| Corporate Wellbeing and Pro interest | Studio, account, interest indication, Pro offer views and interest clicks | Record non-binding interest and follow up | Legitimate interest (Art. 6.1.f) |
| Public studio directory | Professional studio information (see section 4) | Help people discover craft studios | Legitimate interest (Art. 6.1.f) |
3. Details by activity
Website visitors. Our hosting and database providers process technical data such as your IP address and request logs to deliver the site and protect it against abuse. We do not use analytics or advertising tools. See the Cookie Policy for browser storage.
User accounts. Accounts are intended for studio owners, managers and their authorised representatives, who must be adults. We store your email, name, authentication identifiers and security records. When you create an account, we record which version of the Terms of Use you accepted and when. We also record some account events (for example account created, studio dashboard viewed) to understand how the owner journey works.
Studio owners and managers. To prevent unauthorised changes, we record which account manages which studio, claim requests and their status, the verification method used, and the changes made to studio profiles. Verification codes are sent only to the studio's own email or a work email on the studio's website domain, and are stored in hashed form. Studio invitations record when they were created, opened and redeemed.
Contact form. We store your message before we read it, so that nothing gets lost. To prevent abuse we limit how many messages one email address can send in a short time.
Corporate Wellbeing interest. Registering interest is an expression of interest only. It does not create a contract, guaranteed bookings or guaranteed corporate participation.
Pro interest. Urban Crafts Club does not currently charge for Pro. Clicking to show interest in Pro is recorded as interest and is not a purchase or subscription.
Invitations and campaign history. Our internal tool records which studios are included in an outreach campaign, invitation status (created, opened, redeemed, expired), and — once real sending is enabled — which message was sent, when and its delivery status.
Automated decisions. We do not make decisions producing legal or similarly significant effects based solely on automated processing.
4. Studios and professional contacts not obtained from you
Some of the information in our studio directory was not provided by the studios themselves. It was collected from publicly accessible professional and business sources, including the studio's own website and public business listings such as Google Maps / Google Places. Some studio photos and coordinates are obtained through the Google Places service.
Categories of information: studio name, public business address and coordinates, public website and social profiles, public professional contact details (email or phone published by the studio), crafts and activities offered, opening and business information, public photos and ratings.
Where a studio is run by an individual (for example a sole trader), some of this information can be personal data. We process it based on our legitimate interest in providing a useful public directory of craft studios, limited to professional information.
We may also use this professional contact information to tell a studio about Urban Crafts Club and invite it to manage its profile. Any such message will identify us, link to this section and offer a simple way to object.
Your options at any time, free of charge:
- Update or correct your information by claiming and managing your studio (For Studios page).
- Report incorrect information or ask for removal through the Contact page.
- Object to the processing or exercise any other right by writing to info@themothertrees.com. If you object to receiving messages, we record this so that no further messages are sent.
5. Communications
We send service emails that are necessary for your account and studio management, such as sign-up confirmation, password reset and verification codes. We reply to contact enquiries by email.
We send the Craft Communities newsletter only to people who ticked the newsletter option. You can withdraw that consent at any time.
6. Recipients and service providers
We do not sell personal data. We use service providers that process data on our behalf and on our instructions:
| Provider | Service | Role |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage and server functions | Processor |
| Lovable (website hosting platform) | Hosting and delivery of the website and its server functions | Processor |
| Google (Google Maps Platform) | Maps shown in your browser; studio photos and locations from Google Places | Your browser connects to Google to show maps (Google receives your IP address) |
| Email delivery provider | Sending service emails, once enabled | Processor |
We may disclose data to public authorities when legally required.
7. International transfers
Some of our providers are based in the United States or may use infrastructure outside the European Economic Area. Any such transfer must be covered by a safeguard recognised by the GDPR. You can ask us which safeguard applies to each provider by writing to the address above.
8. How long we keep data
- Account data: while the account is active, and afterwards only for as long as needed to meet legal obligations or handle possible claims.
- Studio management records and verification history: while the studio is managed, and afterwards as long as needed to show who made changes and to handle disputes.
- Contact and company enquiries: as long as needed to resolve the enquiry and any related follow-up.
- Waiting list: until the community launches or you ask to leave; the newsletter until you unsubscribe.
- Corporate Wellbeing and Pro interest: while relevant to the offer, or until you withdraw it.
- Directory information: while relevant to the directory, subject to correction, removal and periodic review.
- Objections and opt-outs: as long as needed to respect them.
- Technical logs: for the limited period kept by our hosting and database providers.
9. Your rights
You have the right to access your personal data, rectify it, request its erasure, restrict or object to its processing, and receive it in a portable format where applicable. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.
To exercise your rights, write to info@themothertrees.com. We may ask for information to confirm your identity, proportionate to the request. We will reply within one month.
If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): https://www.aepd.es
10. Minors
Accounts and studio management are intended for adults and authorised representatives of studios. They are not directed at children.
11. Security
We apply technical and organisational measures appropriate to the risk, including encrypted connections, access controls that limit internal data to authorised administrators, and hashed verification codes.
12. Changes to this policy
We will update this policy when our processing changes and show the date of the latest version at the top.