Baqueiro Desarrollo Web

Privacy policy

Last reviewed: 13 October 2026

1. Controller and scope

This policy explains how the data of visitors, people who get in touch and clients of baqueiro.es is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). When Baqueiro processes data on behalf of a client in a project, that processing is also governed by the corresponding data processing agreement; the client remains the controller of its own processing.

2. Data processed

We process the data you provide when you get in touch: name, email, phone number if provided, the service requested and the content of your message. In a professional relationship this includes contact and billing details and the data needed to carry out the project. Browsing may generate technical data, such as IP address, device, pages viewed and identifiers, depending on the tools enabled and your cookie choices.

When you choose an option in the cookie notice, a record of that choice is kept (accepted or rejected categories, date, browser and an encrypted summary of the IP address, not the full address) so that it can be demonstrated.

Please do not send passwords, full bank details, identity documents or sensitive data through the general form. If a project requires additional information, an appropriate channel and privacy information will be provided.

Purpose Legal basis
Responding to quote requests and preparing a service you have requested. Pre-contractual steps at the request of the data subject, article 6(1)(b) GDPR.
Dealing with general enquiries that are not pre-contractual. Legitimate interest in responding to communications addressed to the business, article 6(1)(f) GDPR, limited to that response and subject to your right to object.
Performing and managing the contracted service. Performance of a contract, article 6(1)(b) GDPR. For contacts at companies, legitimate interest in maintaining the professional relationship, article 6(1)(f) GDPR and article 19 LOPDGDD.
Billing and compliance with legal obligations. Legal obligation, article 6(1)(c) GDPR.
Technical security, abuse prevention and defense of claims. Legitimate interest in protecting the service and exercising or defending rights, article 6(1)(f) GDPR, with proportionate processing.
Measuring visits and usage with Google Analytics 4 (GA4) and Burst Statistics. Consent for non-exempt analytics, article 6(1)(a) GDPR and article 22.2 LSSI-CE. Refusing does not prevent you from using the website.
Advertising measurement with Google Ads; personalization or remarketing only if enabled and expressly disclosed. Specific consent for marketing, article 6(1)(a) GDPR and article 22.2 LSSI-CE.

Getting in touch does not in itself authorize marketing campaigns. If subscriptions are offered, a separate and voluntary choice will be requested. Electronic commercial communications must comply with article 21 LSSI-CE, including, where applicable, the exception for clients regarding similar own services and an easy, free way to unsubscribe.

4. Mandatory information and forms

Fields marked as mandatory are needed to process the request; without them it may not be possible to respond. The rest are optional. Reading or acknowledging the privacy policy does not turn all processing into consent-based processing.

The website’s forms only send data when you press the submit button; field data is not collected or transmitted before that moment.

5. Retention

Enquiries are kept while they are being handled and for any follow-up requested. Contract documentation is kept for the duration of the relationship and, afterwards, for the periods required for tax and accounting obligations and possible liabilities. Where deletion applies, data is blocked in accordance with article 32 LOPDGDD and deleted once those periods have ended.

The record of cookie choices is kept for 24 months and then deleted automatically.

Server access logs (IP address, date and time, requested address and browser) are kept for up to 90 days, except those needed to investigate an incident or deal with liabilities. Google Analytics keeps user and event data for 2 months. Burst Statistics data is deleted automatically after 12 months. Cookie expiry is described separately in the cookie policy.

6. Recipients and providers

The necessary hosting, email, maintenance and administrative providers may access data to the extent needed for their functions and under the corresponding legal conditions. Data will be disclosed to authorities, courts or other recipients where there is a legal obligation.

The hosting provider is Hostout (hostout.com.br), which also provides the @baqueiro.es email service: the website and the mailboxes are on the same server. It may access hosted data to the extent needed to provide the infrastructure and support service, as a processor under article 28 GDPR. For sending email and spam filtering, the domain also authorizes the MailBaby and SpamExperts services, which act on behalf of the email provider.

Google Analytics 4 (GA4), Google Ads and Burst Statistics are used for the measurement purposes described, and only after you accept the corresponding category. Burst is a plugin that runs on this website: its statistics are stored on our server and are not shared with third parties other than the hosting provider. It does not use cookies; to recognize returning visits it computes a fingerprint from technical browser and device data, and it does not run if the browser sends a Do Not Track signal.

Google Analytics and Google Ads are contracted with Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). In Google Analytics, Google processes the data as a processor under the Google Ads Data Processing Terms. In Google Ads conversion measurement, Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. In both cases Google LLC and other Google group subprocessors are involved. See Google’s privacy policy.

If you choose to contact us via WhatsApp, the messages and associated data will also be processed by the WhatsApp provider under its own terms. You can use email as an alternative. External links to social networks lead to services with their own policies; they do not authorize Baqueiro to use them for purposes other than those described here.

7. International transfers

Google services may involve processing outside the European Economic Area, in particular in the United States by Google LLC. Google LLC is certified under the EU-US Data Privacy Framework, covered by the European Commission adequacy decision of 10 July 2023, and Google relies on it for these transfers; where it does not apply, Google uses standard contractual clauses. More information in its data transfer terms.

The Hostout server that hosts the website and email is in Brazil (data center in São Paulo). This transfer relies on the adequacy decision adopted by the European Commission for Brazil on 26 January 2026 (article 45 GDPR). The email sending and filtering services mentioned may process messages in other countries, under the safeguards set in their contracts with the email provider. You can request information on, and a copy of, the applicable safeguards through the controller’s contact details, subject to the limits needed to protect confidential information.

8. Your rights

You can request access, rectification, erasure, restriction or objection to processing and, where applicable, data portability. You can also withdraw your consent at any time, without affecting the lawfulness of prior processing. For processing based on legitimate interest, you may object on grounds relating to your situation; objections to direct marketing will be honored without requiring such grounds.

Write to contacto@baqueiro.es, to the controller’s address, or use the data subject rights form, stating which right you wish to exercise. Additional identification will only be requested if there are reasonable doubts about your identity; it is not necessary to attach a copy of an ID document to every request.

We will respond within one month of receipt, extendable by two further months where justified by the complexity or number of requests, in which case we will inform you of the extension and the reason within the first month. You can lodge a complaint with the Spanish Data Protection Agency (AEPD), especially if you do not receive a satisfactory response.

9. Profiling and automated decisions

No decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you are made. Measurement is not used to build advertising profiles: Google Analytics runs without Google signals or User-ID, and Google Ads is only used to measure campaign conversions, without remarketing, without ad personalization based on data from this website and without enhanced conversions. Form data is not combined with measurement data.

10. Security and changes

The controller must maintain technical and organizational measures appropriate to the risk and limit access to data. Significant changes to purposes, providers or safeguards will be communicated through updated information and, where appropriate, new consent will be requested before the new processing.

This English version is provided for information. In case of discrepancy, the Spanish version prevails.