Effective Date: July 28, 2026
 
1. Introduction
Welcome to MirrorLab.

At MIRROR LABS & SHOWS SL ("MirrorLab", "we", "our", or "us"), we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you visit our website, contact us, apply for a job with us, or use our services.
We process your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.

This Privacy Policy describes our practices in detail. Please note that your use of non-essential cookies and similar tracking technologies is governed separately by the cookie consent choices you make through our cookie consent tool, as described in Section 7 below — simply browsing this website does not, by itself, constitute consent to non-essential cookies.

2. Data Controller
The controller responsible for processing your personal data is:
MIRROR LABS & SHOWS SL
CIF: B70953179
Registered Address: CL GOYA 103 28009 Madrid Spain
Email: sales@mirrorlab.net

For any questions regarding this Privacy Policy or your personal data, please contact us using the email address above.
 
3. Applicable Legal Framework
As a company established in Spain, we process personal data in accordance with:

• The General Data Protection Regulation (EU) 2016/679 ("GDPR");

• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"), which complements the GDPR at the Spanish national level, including provisions on the minimum age for a minor's valid consent (14 years under Spanish law);

• Directive 2002/58/EC (ePrivacy Directive) and its Spanish implementation (Ley 34/2002, LSSI-CE), governing the use of cookies and similar tracking technologies.

4. What Personal Data We Collect
Depending on how you interact with our website, we may collect the following categories of personal data:

a) Information you provide directly — general inquiries

When you submit an inquiry through our contact form, we may collect:
First Name Last Name Company Name Company Website (optional) Email Address Phone Number Message

Providing this information is voluntary; however, certain fields are required in order for us to respond to your request.

b) Information you provide directly — job applications

When you apply for a vacancy through our careers form, we may collect:
First Name Last Name Email Address Phone Number The vacancy you are applying for Your CV / resume (uploaded file) Any additional information you choose to provide

We ask that you avoid including in your CV or application any special category data (e.g., health information, racial or ethnic origin, religious beliefs, trade union membership) unless it is directly relevant and you wish to provide it voluntarily. Where you choose to include such data, we process it on the basis of your explicit consent (Article 9(2)(a) GDPR).

c) Information collected automatically

When you visit our website, certain technical information may be collected automatically, including:
IP address Browser type and version Device information Operating system Pages visited Date and time of your visit Referring website General location (country or city level) Cookie identifiers Website interaction data

This information helps us improve our website, understand visitor behavior, and ensure the security of our services.
 
5. How We Use Your Personal Data
We use your personal data only for legitimate business purposes, including:

Responding to inquiries submitted through our website. Communicating with prospective clients. Preparing quotations and project proposals. Providing our services. Managing job applications and evaluating candidates for advertised vacancies. Improving the functionality and performance of our website. Measuring the effectiveness of our marketing activities. Detecting and preventing fraud or unauthorized activity. Complying with legal obligations.

We do not sell your personal data to third parties.
 
6. Legal Basis for Processing
Under Article 6 of the GDPR, we process your personal data based on one or more of the following legal grounds:

Contractual necessity / pre-contractual steps (Article 6(1)(b) GDPR)

Processing is necessary to take steps at your request prior to entering into a contract — for example, when you request a quotation or project proposal — or, in the case of job applications, to take steps at your request prior to potentially entering into an employment contract.

Legitimate interests (Article 6(1)(f) GDPR)

We rely on our legitimate interest to respond to general inquiries that are not directly tied to a specific contract request, to improve our website, maintain security, understand how visitors use our website, and develop our business.

Consent

Where required by law, we process your personal data only after obtaining your consent, including for non-essential cookies and marketing technologies, for retaining your CV beyond the specific selection process, and for any special category data you choose to provide in a job application.

You may withdraw your consent at any time.

Legal obligations

We may process personal data where required by applicable law.

7. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to improve user experience, analyze website performance, and support marketing activities.

Essential cookies are used to operate the website. Non-essential cookies (analytics and marketing) are only activated after you give your consent through our cookie consent management tool ("cookie bot"), which lets you accept or reject cookies by category and change your preferences at any time.

A detailed list of the cookies used on this website, their providers, purposes, and retention periods will be available in our separate Cookie Policy.

8. Analytics and Advertising Technologies
To better understand how visitors interact with our website and to improve our marketing efforts, we may use the following services, subject to your consent where required:

Google Analytics 4 — analyzes website traffic and visitor behavior (pages visited, session duration, browser/device information, approximate location, content interaction). Activated only after consent where required.

Meta Pixel — measures the effectiveness of advertising campaigns on Meta platforms (Facebook and Instagram) and supports conversion measurement, remarketing, and audience creation.

Microsoft Clarity — provides aggregated behavioral analytics (clicks, scrolling, session recordings) to help us improve website usability.

Google Ads Conversion Tracking — measures the effectiveness of our advertising campaigns.
Each of these providers processes data in accordance with its own privacy policy.
 
9. Data Sharing
In addition to the analytics and advertising providers described in Section 8, we may share your personal data only when necessary with other trusted service providers, including:

Website hosting providers; Recruitment / applicant management tools, for processing job applications; Technical support providers; Legal or regulatory authorities where required by law.

All third-party providers are required to process your personal data in accordance with applicable data protection laws and appropriate confidentiality and security obligations.

We never sell your personal data.
 
10. International Data Transfers
Some of the providers referenced in Sections 8 and 9 (including Google, Meta, and Microsoft) are based in, or process data in, the United States.

Where this occurs, transfers are carried out under one of the following safeguards, depending on the provider and its current certification status:

• The European Commission's adequacy decisions, including the EU-U.S. Data Privacy Framework (DPF), for providers certified under it;

• Standard Contractual Clauses (SCCs) approved by the European Commission, where the recipient is not covered by an adequacy decision;

• Other lawful transfer mechanisms recognized under the GDPR.
   

We monitor the legal status of these transfer mechanisms and will update our safeguards if the applicable framework changes — for example, in light of ongoing judicial review of the EU-U.S. Data Privacy Framework before the Court of Justice of the European Union.
 
11. Data Retention
The periods below are maximum periods. We may — and often do — delete or anonymize personal data earlier than these limits once it is no longer necessary for the purpose it was collected for.
 

• General inquiries (contact form): up to 24 months from your last interaction with us, or earlier if the purpose is fulfilled sooner.

• Client and contract-related data (including invoicing): retained for as long as required by Spanish commercial and tax legislation (currently up to 6 years).

• Job applications — unsuccessful candidates: up to 12 months from the end of the relevant selection process, unless you have given specific consent for us to keep your CV for future vacancies, in which case up to 24 months.

• Analytics data: retained according to the settings configured in our analytics tools (e.g., Google Analytics 4's default retention period).

• Marketing/advertising data (Meta Pixel, Google Ads): governed by the retention settings of the respective third-party platform.
   

(Note: the specific retention periods above reflect common practice and should be reviewed and confirmed by MirrorLab, in particular the recruitment retention period.)
 
12. Children's Privacy
Our website and services are directed at businesses and professionals and are not intended for individuals under the age of 14 (the minimum age for a minor's valid consent under Spanish law) or under the relevant minimum age under the law of your country of residence. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete it.

13. Automated Decision-Making and Profiling
We do not use your personal data to make automated decisions that produce legal effects concerning you or similarly significantly affect you. Where we use analytics or advertising tools (such as Meta Pixel or Google Ads) to build audiences or personalize marketing content, this involves limited profiling based on your website interactions, and takes place only where you have provided consent through our cookie consent tool.
 
14. Your Rights
Under the GDPR, you have the right to:

access your personal data; request correction of inaccurate information; request deletion of your personal data; restrict processing; object to processing; withdraw consent at any time; request data portability; lodge a complaint with your local Data Protection Authority (for example, the Spanish Data Protection Agency, AEPD, or the supervisory authority of your country of residence).

To exercise any of these rights, please contact:
sales@mirrorlab.net

15. Data Protection Officer
Considering the nature, scale, and context of our data processing activities, MIRROR LABS & SHOWS SL is not required to appoint a Data Protection Officer under Article 37 of the GDPR. Any questions regarding data protection can be addressed to sales@mirrorlab.net.
 
16. Third-Party Websites
Our website may contain links to third-party websites, such as our social media profiles (e.g., Instagram). These third-party websites have their own privacy policies, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party website you visit.

This section does not apply to the third-party analytics and advertising technologies embedded directly on our website (such as Google Analytics 4, Meta Pixel, Microsoft Clarity, and Google Ads, described in Section 8), for which we remain responsible as described in this Privacy Policy.
 
17. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction.

While no method of transmission over the Internet can be guaranteed to be completely secure, we continuously work to protect the information entrusted to us.
 
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, legal requirements, or technologies.

The latest version will always be available on this page.
 
19. Contact Us
If you have any questions regarding this Privacy Policy or how we process your personal data, please contact:

MIRROR LABS & SHOWS SL
CL GOYA 103
28009 Madrid
Spain
📧 sales@mirrorlab.net