Privacy policy

Who is the controller

Controller

Guillermo Julián Gallego González

Tax ID (NIF)

77236594H

Address

C. República Argentina, 5, Málaga-Este, 29016 Málaga

Email for data matters

hola@paseweb.com

Phone

613 47 39 96

Data protection officer

None: appointing one is not mandatory for this activity

The controller provides web design, development and maintenance services for businesses and small companies, with a speciality in hospitality. This policy covers the data of people who visit this website, write to us or ask for a demo, and that of businesses we contact first (see “If we contacted you first”). When we provide services to a client and process personal data on their behalf (for example, data in their email or website), we act as data processor under a separate contract.

What data we collect

Only what you type into the request form or send us when you contact us:

• your business name (if the business belongs to an individual, it can be personal data);
• the type of business and, if you choose “Other”, which one (optional);
• the link to your website, Instagram or Google Maps (optional);
• your city (optional);
• your phone or WhatsApp number;
• your email (optional);
• a record of your consent: date and time and the version of this policy.

The business name, the phone or WhatsApp number and ticking the policy box are mandatory: without them we cannot handle the request. Everything else is optional.

We do not ask for special categories of data or payment details. If you message us on WhatsApp or by email, or call us, we process your number or address and the content of your message to help you.

In addition, the server that hosts the website may log technical connection data, such as the IP address and the date and time of access, for security and operational reasons.

If you visit this website, we also measure, statistically, without identifying you and without cookies, how it is used: which pages are opened and when, which page or search engine you come from, your language, screen size, browser, operating system and type of device, and your approximate country. We do not collect what follows the “?” sign in addresses (for example, the business name you type on the home page). If you press a contact button (WhatsApp, phone or email) or submit the form, we only record that it happened and, for the form, the type of business chosen from the list, never the name or anything you type. Your IP address is used for a moment to work out the country and an anonymous identifier, and it is not stored. More details in “Cookies and similar technologies”.

What we use it for

• To handle your request and get in touch with you.
• To prepare your demo and, if you ask for it, a quote.
• To keep the website and our systems secure.
• If a job comes out of it: to meet our legal obligations (for example, tax) and defend ourselves against possible claims.

We do not use it to send you advertising you have not asked for, we do not build profiles, we do not make automated decisions and we do not sell it.

We also measure, in aggregate and without identifying you, how many people visit the website and which pages they read, in order to improve it.

Our legal basis

• Your consent (article 6.1.a GDPR), which you give by ticking the box in the form, to process your request data and for us to write or call you through the channels you give us in order to handle it (article 21 of the Spanish LSSI). You can withdraw it at any time, without affecting what was done before.
• Pre-contractual measures taken at your request (article 6.1.b GDPR), to prepare the demo and the quote you ask for.
• Our legitimate interest (article 6.1.f GDPR) in keeping the website and our systems secure (technical logs).
• A legal obligation (article 6.1.c GDPR), to keep invoices and accounting records if you hire us.

For visit measurement, our legitimate interest (Article 6(1)(f) GDPR) in knowing how the website is used and improving it. The measurement is aggregate, cookie-free, profile-free and uses no data that identifies you, and it is limited to the measurements that the Spanish Data Protection Agency considers strictly necessary (its January 2024 guide on cookies for audience-measurement tools), so its impact on you is minimal. You can object as explained in “Your rights”.

How long we keep it

While we handle your request. If no job comes out of it, we delete your data at most 12 months after the last contact, or sooner if you ask. If you hire us, we keep it for as long as the relationship lasts and afterwards, blocked and only available to judges, courts and public authorities, for the legal limitation periods, which in practice are up to 6 years for tax and accounting records (article 32 of the Spanish LOPDGDD).

Backups are encrypted and overwritten automatically within a week at most; the execution logs of our automation systems are deleted after 14 days.

Visit-measurement data is kept for 14 months and then deleted automatically.

Who receives the data

We do not share your data with third parties for their own purposes unless the law requires it. To provide the service, the following providers are involved: nearly all act as data processors and only process the data on our instructions; the messaging and email ones provide their communication service under their own terms.

• Hosting and form: Netlify, Inc. (USA), which hosts this website, receives what you send in the form, keeps it in its dashboard, passes it through an anti-spam filter (Akismet, by Automattic Inc.) and notifies us.
• Domain and connection: Cloudflare, Inc. (USA), which manages the domain, forwards to our mailbox the messages sent to hola@paseweb.com and protects the connection with our own systems.
• Client management and automation: we record your request in a client manager (CRM) and an automation system installed and controlled by us on our own servers. We make encrypted backups in a storage service (MEGA Limited, New Zealand), which cannot read their content.
• Email and internal alerts: we receive messages in a Google mailbox (Google LLC, USA) and an alert with the basic request data (business name, type, city and phone) in the Telegram messaging app (Telegram Messenger Inc.).
• Artificial-intelligence assistant: we work with an assistant (Claude, by Anthropic PBC, USA) to prepare drafts and organise follow-up; it can read the data on your request record while we work on it. It makes no automated decisions about you.
• Tax adviser: if you hire us, your billing data is processed by our tax adviser to meet tax obligations.
• Visit measurement: Umami, an open-source tool that we install and control ourselves on our own equipment, so no other analytics provider receives that data. The connection to that tool goes through the network of Cloudflare, Inc. (the same service that manages our domain), which acts as a data processor.

International transfers

Some of those providers are based, or have servers, outside the European Economic Area. The safeguards are:

• Netlify, Cloudflare and Google (United States): they are certified under the EU-US Data Privacy Framework, covered by a European Commission adequacy decision (Implementing Decision (EU) 2023/1795); in addition, their data processing agreements include the Commission’s standard contractual clauses as a fallback.
• Anthropic (United States): the European Commission’s standard contractual clauses (modules 2 and 3), included in its data processing agreement.
• Telegram: according to its privacy policy, it stores the data of users in the European Economic Area in data centres in the Netherlands and shares it with its group companies under standard contractual clauses.
• MEGA (New Zealand): a country with a European Commission adequacy decision; in addition, backups are encrypted before they leave our equipment.

You can ask for a copy of these safeguards by writing to hola@paseweb.com.

If we contacted you first

Sometimes we get in touch for the first time with a business that has not written to us, for example to show them the demo of their new website. In that case, and to comply with article 14 GDPR:

• What data we use: the business’s professional contact details (business name, address, phone, email, website and profiles) and what its own website and profiles already show to the public.
• Where it comes from: publicly accessible sources: its website, Google Maps, its social-media profiles and business directories.
• What for: to make you a first proposal, individual and tailored to your business.
• Our legal basis: our legitimate interest (article 6.1.f GDPR) in offering our services to other businesses. Spanish law presumes that interest covers the processing of professional contact data of sole traders and professionals (article 19 LOPDGDD). It is minimal processing, and you can object at any time.
• How long: if you do not reply, we send at most one reminder and do not write again; we keep your data for up to 12 months after the last contact. If you ask us not to write to you again, we keep only what is essential to respect that request.

To object or exercise any other right, just reply to the message or write to hola@paseweb.com. The sections of this policy on recipients, transfers and rights also apply in this case.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to hola@paseweb.com and saying which right you are exercising. We may ask you to prove your identity. We will reply within the legal deadline, which is one month (extendable by two more months if the request is complex, in which case we will tell you).

Visit measurement: because that data does not identify you, we cannot find “yours” to deal with a right of access or erasure. To object, simply switch on your browser’s “Do Not Track” signal or block the measurement script; you can also write to hola@paseweb.com.

If you think we have not handled your data as we should, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Minors

This website is aimed at professionals and business owners. It is not meant for children under 14 and we do not knowingly collect data from them. If you think a child has sent us their data, write to us and we will delete it.

Cookies and similar technologies

This website does not use cookies or equivalent storage technologies, neither our own nor third-party, and it includes no advertising or tracking tools that identify people. Fonts and all other resources are served from the site itself, not from external services.

This website measures visits with Umami, an open-source tool that we install on our own equipment and that loads from a subdomain of ours (analitica.paseweb.com). It uses no cookies and stores nothing in your browser: when a page opens or a contact button is pressed it only sends basic technical data (the page, where you came from, your language, screen size and type of browser). With that and your IP address, which is not stored, the server works out the approximate country and an identifier that does not allow you to be recognised and that changes every month. We remove whatever follows “?” and “#” from addresses. We respect the “Do Not Track” (DNT) signal: if your browser sends it, nothing is measured. The data is kept for 14 months. That is why we do not show a cookie banner: the measurement is limited to what the Spanish Data Protection Agency considers strictly necessary for audience measurement (its January 2024 guide): anonymous statistics, produced only by us and on our behalf, not cross-matched with other data, not passed to third parties and kept for less than 25 months.

If you tap the WhatsApp button, that service will open and has its own privacy policy. We receive nothing until you write to us.

Security

We apply reasonable technical and organisational measures to protect your data: encrypted connection (HTTPS), restricted access to the systems where it is stored (with authentication and a protected tunnel), personal passwords, encrypted backups and collecting only the minimum data. No system is infallible. If a breach affected you significantly, we will notify the Spanish Data Protection Agency within 72 hours and tell you when the law requires it.

Changes to this policy

If something important changes, we will update this page and its date.