Provisional template. Review with legal counsel and complete the company details before publishing.
Data controller
[COMPANY NAME], with tax ID [TAX ID], address at [ADDRESS]. Privacy email: [PRIVACY EMAIL]. Data protection officer: [DPO OR CONTROLLER].
What data we process
- Data you provide in forms: name, email, company, phone if you choose to provide it, service, budget, message and website URL.
- Technical data needed for security: IP address, date and time, browser and language.
- Consent record: policy version, date, IP and the page from which you submit the form.
- Campaign parameters (UTM) if you arrive through a link containing them.
We do not collect special categories of data. We do not ask for information we do not need to reply.
Purposes and legal bases
- Responding to contact, audit and quote requests: consent and pre-contractual measures.
- Managing the contractual relationship: performance of the contract.
- Complying with legal obligations: legal obligation.
- Keeping the site secure and preventing abuse: legitimate interest.
- Sending commercial communications: only with express, revocable consent.
Retention
We keep contact data for as long as needed to handle the request and, if you become a client, for the contractual relationship and applicable legal periods. Consent records are kept for as long as needed to demonstrate compliance.
Recipients
Data may be processed by hosting, email, security and maintenance providers acting as data processors. We do not sell data to third parties.
If a provider processes data outside the European Economic Area, the safeguards required by the GDPR apply.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [PRIVACY EMAIL]. You can also lodge a complaint with the Spanish Data Protection Agency.
AI and providers
We may use AI tools to speed up production, research and content review. We do not train models on client data. Decisions and final review are human. AI providers must comply with the GDPR and applicable contractual terms.
Security
We apply technical and organisational measures proportionate to the risk: access control, HTTPS, backups, updates, form validation and data minimisation.
Minors
The site is not aimed at minors. If we detect minors’ data without a legal basis, we will delete it.
Changes
We may update this policy. The last update date appears at the top.