Privacy Policy

Data controller

In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), we inform you that the controller of your personal data is:

• Owner: Sebastián Oliva Pujol, NIF 40327433S, operating as DesatranquesWeb
• Trading name: Desatranques WEB
• Tax ID (NIF): 40327433S
• Contact email: contacto@desatranquesweb.es

Purpose of data processing

The personal data you provide will be processed for the following purposes:

Legal basis for processing

The legal basis for processing your personal data is:

• The consent of the data subject when submitting the contact form and accepting this privacy policy (Article 6.1.a of the GDPR).
• The consent of the data subject for Google Analytics analytics cookies and for noting in the chat conversation whether you then click a link to the video call or to contact, given by clicking “Accept” in the cookie notice and which can be withdrawn at any time with “Cookie settings” (Article 6.1.a of the GDPR and Article 22.2 of the Spanish LSSI).
• The consent of the data subject for Google Ads advertising cookies and conversion measurement, given by clicking “Accept” or by ticking “Advertising” under “Settings”, and which can be withdrawn at any time with “Cookie settings” (Article 6.1.a of the GDPR and Article 22.2 of the Spanish LSSI).
• The performance of a contract to which you are party, or steps taken at your request before entering into a contract, for the purchase and payment of our services, the calls you ask for with “Call me back” and the video calls you book (Article 6.1.b of the GDPR).
• Compliance with a legal obligation to issue and keep invoices (Article 6.1.c of the GDPR).
• The legitimate interest of the controller in responding to queries and information requests, including those made in the chat; in keeping chat conversations, because we need to know what people interested in our services ask, to be able to prepare the contact if they then write to us or book a video call, and to correct the assistant’s answers when it gets something wrong; in running the checks you ask for in the WordPress checker and in protecting the website from spam and abuse (Article 6.1.f of the GDPR). Conversations are kept without your IP address or any browser data and are deleted automatically after 90 days. You can object to this processing at any time, as explained in “How to exercise your rights”.

Fields marked with an asterisk (*) in the contact form are mandatory. Failure to provide such data will prevent DesatranquesWeb from processing your request.

Recipients

To provide these services we rely on the following providers, which process your data on our behalf as processors (Article 28 of the GDPR), unless stated otherwise:

• Cloudflare, Inc. (United States), website hosting: it hosts the website and the server that processes the forms and the chat, so it processes your IP address, the technical data of each visit and whatever you send through the website. Chat conversations are kept in a Cloudflare database located in the European Union. It also provides the anti-spam verification on the contact and “Call me back” forms (Turnstile), which analyses signals from your browser such as the IP address and the user agent: Cloudflare processes them on our behalf to protect the forms and, as a controller, to improve its bot detection. Cloudflare participates in the EU-U.S. Data Privacy Framework and, as a fallback, applies the standard contractual clauses. More information in Cloudflare’s privacy policy and the Turnstile privacy notice.
• Plus Five Five, Inc. (Resend, United States), email delivery: it sends the contact form and “Call me back” messages that reach us, the purchase confirmation you receive and our internal sales notifications. It stores the data in the United States; the transfer relies on the EU-U.S. Data Privacy Framework and on the standard contractual clauses. More information in Resend’s privacy policy.
• Stripe Payments Europe, Limited (Ireland), payments: it collects payments and subscriptions and runs the customer portal. On its payment page it collects your email, your name, your billing address, your card details and, if you provide them, your company name and tax ID; card details never pass through our website. Stripe processes this data on our behalf to process payments and, as a controller, for its own purposes, such as preventing fraud and meeting its legal obligations. It transfers data to Stripe, LLC (United States), which participates in the EU-U.S. Data Privacy Framework; as a fallback, it applies the standard contractual clauses. More information in Stripe’s privacy policy.
• Conductiva Online Services, S.L. (FacturaDirecta, Spain), invoicing: it issues the invoices and sends them to you by email. It receives your name or your company’s name, your tax ID, your email and your billing address, and hosts the data in data centres in the European Union. More information in FacturaDirecta’s privacy policy (in Spanish).
• Anthropic Ireland, Limited (Ireland), website chat: it generates the chat’s answers. It receives only the text of the conversation, without your IP address or any other data that identifies you. It does not use the messages to train its models and deletes them within 30 days, unless its systems flag them for breaching its usage policy (in which case it keeps them for up to two years) or the law requires it to keep them. Transfers outside the European Economic Area rely on the standard contractual clauses in its data processing agreement. More information in Anthropic’s privacy center.
• Cal.com, Inc. (United States), video call booking: if you book a video call through our link, it collects your name, your email and the meeting details on our behalf. It processes the data in the United States; according to its privacy policy, the transfer relies on standard contractual clauses or an adequacy mechanism such as the EU-U.S. Data Privacy Framework. More information in Cal.com’s privacy policy.
• Google Ireland Limited (processor for Google Analytics), only if you accept analytics cookies: to statistically measure how the website is used. On the thank-you page after paying, with analytics accepted, only the amount excluding VAT, the product and an anonymous transaction code are sent to Google Analytics; never your name, your email or your payment details. Google may process the data in the United States; that transfer is covered by the EU-U.S. Data Privacy Framework, under which Google LLC is certified (Google's data transfers).
• Google Ireland Limited (Google Ads), only if you accept advertising cookies: Google Analytics is linked to the Desatranques WEB Google Ads account to import as conversions the purchases and the contact or video call requests of people who accept advertising, so we know which ads work. For Google Ads, Google acts as a data controller, not on our behalf, under its controller-to-controller data protection terms (Google's advertising services). We do not share with Google Ads any data you type on the website. Transfers to the United States are covered by the same EU-U.S. Data Privacy Framework.
• Apart from these cases, we will not share your personal data with third parties except where required by law or court order.

When a provider processes data outside the European Economic Area, the transfer relies on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Article 45 of the GDPR) or on the standard contractual clauses adopted by the Commission (Article 46.2.c of the GDPR).

Retention periods

Personal data provided through the forms will be retained for the time necessary to process your request and, subsequently, during the applicable legal limitation periods.

As a general rule, data from the contact form, from “Call me back” and from video call bookings will be retained for a maximum of 12 months from the last communication, unless a subsequent contractual relationship justifies a different retention period.

Purchase and invoice data will be retained for as long as the contractual relationship lasts and, afterwards, for the period required by tax law: the Spanish Invoicing Regulation (Article 19 of Royal Decree 1619/2012) requires invoices to be kept for the limitation period of Law 58/2003, General Tax Law, which is four years (Article 66).

Chat conversations are kept for 90 days from the last message and are then deleted automatically. We keep the text of the questions and answers, the date and time, the language and the page of the website you wrote from; we do not keep your IP address or any data about your browser or device. If you accepted analytics cookies, we also note whether you then clicked a link to the video call or to contact. Your browser also keeps the conversation while the tab is open, so the chat stays with you when you change page. The request-limit counters, linked to your IP address, are deleted when their window ends: one minute in the chat and one hour in “Call me back” and in the WordPress checker. The address you enter in the checker and its result are kept for 24 hours, only to avoid repeating the same check, and are then deleted.

Google Analytics data is kept for 14 months. If you accept advertising, the Google Ads cookies last as stated in the cookie policy.

Data subject rights

In relation to the processing of your personal data, you have the right to:

• Access: request confirmation of whether your data is being processed and, if so, access it.
• Rectification: request the correction of inaccurate data or the completion of incomplete data.
• Erasure: request the deletion of your data when, among other reasons, it is no longer necessary for the purpose for which it was collected (right to be forgotten).
• Restriction of processing: request the restriction of processing of your data in certain circumstances provided for in the GDPR.
• Data portability: receive your personal data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Objection: object to the processing of your personal data in certain circumstances.

You may also withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

How to exercise your rights

To exercise any of the mentioned rights, you may send your request by email to contacto@desatranquesweb.es, indicating "Data Protection" in the subject line and attaching a copy of your ID or equivalent identification document.

Chat conversations are not linked to your name or email. If you want to access a conversation or have it deleted, tell us the approximate date and the text of one of your questions so we can find it.

DesatranquesWeb will respond to your request within a maximum period of one month from receipt. This period may be extended by a further two months if necessary, taking into account the complexity and number of requests, in accordance with Article 12.3 of the GDPR.

Right to lodge a complaint with the supervisory authority

If you consider that the processing of your personal data does not comply with current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001 Madrid, Spain.

However, we invite you to contact us first to try to resolve any issue related to the processing of your data.

Cookies and similar technologies

This website uses its own technical browser storage (localStorage and sessionStorage) and only uses Google Analytics analytics cookies and Google Ads advertising cookies if you accept them in the cookie notice. On the pages with a form and when you open “Call me back”, the Cloudflare Turnstile anti-spam service stores a technical security entry in your browser. For detailed information about the technologies used and how to change your choice, please see our cookie policy.