Privacy Policy
Last updated: 9 September 2026
1. About this policy
CNM Architecture respects your privacy and is committed to handling personal data fairly, transparently and securely. This Privacy Policy explains what personal data we collect through this website and our professional communications, why we use it, whom we share it with, how long we retain it and the rights available to you.
This policy applies when you browse the CNM Architecture website, contact Celeste Navarro Mora by email or WhatsApp, schedule a meeting, request information about services, become a prospective or existing client, or otherwise communicate with us in connection with CNM Architecture.
2. Who is responsible for your data?
CNM Architecture is the professional brand and sales channel through which Celeste Navarro Mora markets architectural design, BIM and related professional support services. The data controller responsible for the processing described in this policy is:
CURRENT EXACT LEGAL NAME OF THE DELAWARE LLC
REGISTERED OR BUSINESS POSTAL ADDRESS
PRIVACY EMAIL ADDRESS
3. Personal data we collect
3.1. Website and server data
When you visit the website, the hosting and security systems may process technical data such as your IP address, browser and device information, operating system, referring page, pages requested, date and time of access, error information and security events. This information is used to deliver the website, maintain performance and diagnose or prevent misuse and cyber threats.
3.2. Enquiries and professional communications
If you contact us by email, WhatsApp or another communication channel, we may collect your name, contact details, organisation, job title, message history and any project information or files you choose to provide. Please avoid sending sensitive personal data unless it is necessary and has been requested.
3.3. Meeting bookings
When you schedule a meeting, we may collect your name, email address, organisation, time zone, meeting date and time, answers to brief booking questions and any information you voluntarily include. The booking provider may also process technical and scheduling data under its own privacy terms.
3.4. Prospective and existing client information
During project discovery and service delivery, we may process business contact details, project briefs, drawings, models, photographs, correspondence, contractual information, invoices, payment status and other information necessary to evaluate, quote, contract for and perform professional services. Payment providers and financial institutions process payment details under their own terms; we do not normally receive complete bank-card credentials.
3.5. Testimonials and project material
If a client agrees to provide a testimonial or permits project material to be displayed, we process and publish only the name, role, organisation, quotation, image, logo or project information covered by that permission. Publication is based on the agreed permission and may be withdrawn prospectively, subject to any other applicable legal basis or contractual rights.
3.6. Cookies and analytics
CNM Architecture uses cookies and similar technologies to operate the website, understand how visitors use it, measure the effectiveness of marketing and improve the user experience.
Strictly necessary technologies are used to provide core website functions, remember privacy choices, maintain security and support language settings. These technologies do not require consent where they are strictly necessary for the requested service.
4. Why we use personal data
| Purpose | Typical data | Legal basis under GDPR |
|---|---|---|
| Deliver, secure and maintain the website | Technical, log and security data | Legitimate interests in providing a secure and functional website (Art. 6(1)(f)). |
| Respond to enquiries and discuss possible work | Contact, organisation, message and project information | Steps requested before a contract (Art. 6(1)(b)) and/or legitimate interests in responding to professional enquiries (Art. 6(1)(f)). |
| Schedule and conduct meetings | Contact, scheduling and meeting information | Steps requested before a contract (Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f)). |
| Prepare proposals and deliver services | Client, project, contract and billing information | Contract performance (Art. 6(1)(b)) or legitimate interests where the client is an organisation and the contact is its representative (Art. 6(1)(f)). |
| Meet accounting, tax, legal and compliance duties | Contract, invoice, payment and correspondence records | Compliance with legal obligations (Art. 6(1)(c)) and legitimate interests in establishing or defending legal claims (Art. 6(1)(f)). |
| Publish approved testimonials or project information | Approved identity, quotation, image, logo and project details | Consent (Art. 6(1)(a)) or another documented basis agreed with the client, as applicable. |
| Use optional analytics or marketing technologies | Cookie identifiers, IP-derived and usage data | Consent where required (Art. 6(1)(a)). |
Where we rely on legitimate interests, those interests are identified above. We consider the necessity and proportionality of the processing and the potential impact on the individuals concerned.
5. How we obtain personal data
We usually obtain personal data directly from you. We may also receive professional contact or project information from your employer, client, project team, referral source, publicly available professional profiles or the service providers used to operate the website and communications. If you give us personal data about another person, you should ensure that you are authorised to do so and that the person has received appropriate privacy information.
6. Who receives personal data?
We disclose personal data only when reasonably necessary for the purposes described above. Recipients may include:
- Website hosting, content-delivery, security and technical-support providers.
- Email, cloud-storage, meeting, videoconferencing and calendar providers.
- WhatsApp/Meta when you choose to communicate through WhatsApp.
- Analytics or consent-management providers, if enabled according to your choices.
- Banks, payment providers, accountants, legal advisers and other professional advisers.
- Authorities or other parties when disclosure is legally required or necessary to protect rights, security or legal claims.
- Subcontractors or professional collaborators when necessary for a project and subject to appropriate confidentiality and data-protection arrangements.
We do not sell personal data.
7. International data transfers
CNM Architecture is operated by a company established in the United States, and the website is hosted on servers located in the United States. We also use service providers for website delivery and security, email communications, meeting bookings, cloud storage, analytics and advertising. These providers may process personal data in the United States and other countries outside the European Economic Area.
This may include technical website data, such as IP addresses and security logs, as well as information you provide when you contact us, book a meeting or work with us on a project.
Where the GDPR applies and personal data is processed outside the EEA, we use appropriate safeguards under our agreements with the relevant providers. Depending on the provider and processing activity, these safeguards may include an adequacy decision, participation in the EU-US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses. You may contact us using the details in section 2 for further information about the safeguards relevant to a particular provider.
8. How long we retain personal data
| Data category | Proposed retention rule |
|---|---|
| Server and security logs | For the period configured by the hosting/security provider and longer only when needed to investigate an incident or comply with law. |
| Enquiries that do not become engagements | Normally up to 24 months after the last substantive contact, unless an earlier deletion request applies or longer retention is justified. |
| Booking and meeting records | Normally up to 24 months after the meeting or last substantive contact, subject to provider settings and any resulting engagement. |
| Client, project, contract and financial records | For the engagement and thereafter for the periods required by applicable accounting, tax, professional and limitation laws, or to establish or defend legal claims. |
| Testimonials and approved project material | Until permission is withdrawn, the material is no longer relevant, or another agreed period ends, subject to legal and archival needs. |
| Consent and preference records | For as long as needed to demonstrate and honour the relevant choice. |
Retention periods may be shortened or extended where necessary because of legal duties, disputes, security incidents or documented business requirements. At the end of the applicable period, personal data is deleted, anonymised or securely archived with restricted access.
9. WhatsApp and external services
WhatsApp is offered as a convenient communication option. If you use it, WhatsApp and Meta may process information such as your phone number, profile information, message metadata and device data under their own terms. You may instead contact us by email if you prefer not to use WhatsApp. Links to third-party websites or platforms are governed by the privacy information of those third parties.
10. Marketing communications
CNM Architecture will not add an enquirer to a marketing list merely because they asked a question or booked a meeting. If a newsletter or other direct marketing is introduced, subscription will be voluntary, the applicable lawful basis will be documented, and every electronic message will provide an appropriate way to unsubscribe. Service-related communications about an enquiry, meeting or engagement are not marketing communications.
11. Your data-protection rights
Depending on the law that applies to you and the circumstances, you may have the right to:
- Request access to your personal data and information about its use.
- Request correction of inaccurate or incomplete data.
- Request deletion of personal data in applicable circumstances.
- Request restriction of processing in applicable circumstances.
- Object to processing based on legitimate interests or to direct marketing.
- Receive personal data you provided in a structured, commonly used and machine-readable format where the portability right applies.
- Withdraw consent at any time, without affecting processing already carried out lawfully before withdrawal.
- Lodge a complaint with a competent data-protection authority.
These rights are not absolute and may be subject to legal conditions or exceptions. To make a request, contact the privacy address in section 2. We may need to verify your identity before acting on a request.
12. Complaints
If you have concerns, please contact us first so that we can try to resolve them. If GDPR applies, you may also lodge a complaint with the supervisory authority in the EU or EEA country of your habitual residence, place of work or place of the alleged infringement. The European Data Protection Board publishes contact details for national supervisory authorities.
13. Automated decision-making
We do not use personal data collected through this website to make solely automated decisions that produce legal or similarly significant effects.
14. Children
The website and professional services are intended for business and professional audiences, not children. We do not knowingly collect personal data from children through the website. If you believe a child has provided personal data, please contact us so that we can review and, where appropriate, delete it.
15. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. No online transmission or storage system can be guaranteed to be completely secure.
16. Changes to this policy
We may update this policy to reflect changes in the website, providers, business practices or legal requirements. The current version will be published on this page with its last-updated date. Material changes may also be communicated through an appropriate additional notice.
17. Contact
Questions, concerns and rights requests may be sent to:
