Privacy policy

1. Data controller

The controller responsible for processing personal data collected through this website is the individual who owns it:

• Controller: Saúl Antonio Díaz Díaz
• Tax ID (NIF): 07271150E
• Address: Montijo, Badajoz (España)
• Email: [email protected]
• Website: https://negocioenlinea.es

NegocioEnLinea.es is the trade name under which the controller operates. Given the volume and nature of the processing described in this policy, appointing a Data Protection Officer is not mandatory; for any privacy-related question, you can contact the controller directly at the email address above.

2. What data we process and why

2.1. Contact form

When you fill in the contact form, we process the data you provide yourself: name, email address, optionally your business name and phone number, and the content of your message. The date and time of submission is recorded alongside it.

The sole purpose is to handle and respond to your enquiry, and to keep up any follow-up communication needed to assess and, where relevant, prepare a work proposal. We do not use this data to send unsolicited marketing, we do not add you to any mailing list, and we do not build profiles.

We ask that you do not include special-category datain your message (health, ideology, trade-union membership, etc.) or third-party personal data that isn't strictly necessary to handle your enquiry.

2.2. Cookie-free web analytics

To understand which content is useful and where visits come from, we use Umami, an open-source analytics tool installed on our own infrastructure. Browsing data is never sent to any advertising platform or third party.

For each visit, we record technical, aggregated information:

• Page visited, date and time, and approximate visit duration.
• Referring page or search engine (referrer) and, if the link includes them, the campaign parameters utm_source, utm_medium, utm_campaign, utm_content and utm_term, which tell us what channel you arrived from (a social-media post, for example).
• Device type, operating system, browser, screen resolution, language and approximate country.
• Anonymous usage events, such as clicking a call-to-action button or submitting the form. These events never include the content of the form or any data that could identify you — they only indicate that the action happened, and from which channel.

Umami sets no cookies and stores nothing on your device. To distinguish visits without identifying people, it generates a temporary identifier using an irreversible hash function that combines the IP address, the browser, and a random key that rotates daily: the IP address itself is never stored, and the identifier stops being valid after 24 hours. The result is statistical information that, on its own, cannot identify any individual.

2.3. Server technical logs

The infrastructure serving the website generates technical logs (IP address, date and time, resource requested) needed to guarantee its security and availability, and to detect and mitigate abuse or attacks. These logs are kept for a short period and used for no other purpose.

3. Legal basis for processing

• Contact form: your consent (Art. 6(1)(a) GDPR), given expressly by ticking the corresponding box before submitting it, and taking pre-contractual steps at your request (Art. 6(1)(b) GDPR) when your enquiry is aimed at requesting a quote or a service proposal.
• Web analytics and technical logs: the controller's legitimate interest (Art. 6(1)(f) GDPR) in understanding, in aggregate, how the website is used, and in keeping it secure and available. As this processing involves no cookies, no IP storage, no profiling and no sharing with third parties, its impact on your rights and freedoms is minimal.

4. Retention periods

• Form messages: kept for as long as the communication lasts and, afterwards, for a maximum of one year from the last contact, unless the enquiry leads to a service relationship, in which case the applicable legal retention periods apply. If you withdraw your consent, they are deleted sooner.
• Analytics data: kept in aggregate form for a maximum of 24 months, after which it is deleted or kept only as global statistics that cannot be attributed to specific visits.
• Server technical logs: kept for a maximum of 30 days, unless they need to be retained longer for security reasons.

5. Recipients and data processors

We do not share your data with third parties, nor do we sell it. Only the providers strictly necessary to keep the website and email running have access to it, acting as data processors on the controller's behalf:

In addition, your data is recorded in systems belonging to the controller. These are not third parties, but you should know where your data is kept:

• Internal management panel: Enquiries received are automatically registered in the owner's internal management panel (DBrain, dbrain.negocioenlinea.es), hosted on their own infrastructure in Spain, in order to follow up on the enquiry. It is not publicly accessible and only team members can log in.
• Form backup: If the panel were unavailable at the time of submission, the enquiry is temporarily stored in a file on the server itself until it can be registered. That file never leaves the owner's infrastructure.

The following, on the other hand, involve no third-party intervention at all:

• Hosting: The website is hosted on the owner's own infrastructure, located in Spain. No external hosting provider is involved.
• Web analytics (Umami): The analytics tool is Umami, open-source software installed and run on the owner's own infrastructure. Browsing data never leaves those servers and is never shared with any advertising platform.
• Typefaces: Typefaces are served from our own domain. Google Fonts and any other external repository are not used, so merely visiting the site does not disclose your IP address to any third party.
• Advertising: No page on this site loads third-party advertising resources, with a single narrow exception: the /verifactu page (available in Spanish only) may load the Google Ads measurement tag, and only if the user expressly accepts it in the notice shown on that page. There are no advertising tags of any kind anywhere else on the site.

Data may also be disclosed to judges, courts and public authorities where there is a legal obligation to do so.

6. International transfers

Some of the providers listed above are based outside the European Economic Area, in the United States. These transfers take place under the safeguards set out in Chapter V of the GDPR: the adequacy decision covering the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission, as provided for in the processing agreement signed with each provider.

7. Your rights

You can exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data once it is no longer needed.
• Objection: object to processing based on legitimate interest.
• Restriction: request that processing be suspended while a claim is being verified.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these, simply email [email protected] stating which right you wish to exercise. We may ask you to prove your identity if there are reasonable doubts about who is making the request. We will respond within one month of receiving it at the latest.

No automated decisions are made and no profiling that produces legal effects on you is carried out.

8. Complaints to the supervisory authority

If you believe our processing of your data does not comply with the law, or that we have not properly handled your request to exercise your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid, Spain — www.aepd.es).

9. Cookies

As a general rule, this website does not use analytics, advertising or third-party cookies, which is why you will not see a cookie banner while browsing it. The obligation to obtain consent (art. 22.2 of the Spanish LSSI-CE) arises when information is stored on or accessed from the user's device, which does not happen here for analytics purposes: our analytics are self-hosted and do not use cookies.

9.1. The exception: the /verifactu page

The /verifactu page, available in Spanish only, receives visits from advertising campaigns. To find out which ads generate enquiries, it may load the Google Ads measurement tag, which does install cookies. That is why, and only on that page, you will see a notice asking whether you accept it.

• If you decline, nothing is loaded. No request is made to Google and no cookie is installed. The page works exactly the same.
• Our analytics do not depend on that decision: they work the same either way, because they use no cookies and do not identify you.
• You can change your mindby clearing this site's data in your browser: the notice will appear again on your next visit.
• There is no remarketing or advertising profiling. The tag is used solely to count how many enquiries come from each ad.

9.2. Technical cookies

Apart from the above, the network provider may set strictly necessary cookies for security and for the correct functioning of the connection (for example, to distinguish automated traffic). These are exempt from the consent requirement as they are essential to provide the requested service.

Nor are typefaces, videos, maps or other scripts hosted on third-party servers loaded: the rest of the site's resources are served from our own infrastructure. Should this change in the future, this policy would be updated and, where applicable, the corresponding consent mechanism would be introduced.

10. Security measures

We apply appropriate technical and organisational measures to ensure a level of security matched to the risk, including encrypting communications via HTTPS, restricted and authenticated access to the systems where messages and statistics are stored, and minimising the data requested in the form.

11. Minors

This website's services are aimed at professionals and businesses. We do not knowingly request or process data from minors under 14. If we discover that a minor's data has been provided without the consent of their parent or legal guardian, it will be deleted.

12. Changes to this policy

This policy may be updated to reflect regulatory changes or changes to how the website works. The version in force is always the one published on this page, together with its last-updated date. We recommend reviewing it periodically.

You can also read the website's legal notice.