Privacy policy
DRAFT — pending review by a legal adviser.
Courtesy translation. In case of discrepancy, the Spanish version prevails.
Courtesy translation. In case of discrepancy, the Spanish version prevails.
Last updated:
1. Data controller
| Item | Details |
|---|---|
| Controller | XXXX, trading as GUADIGITAL |
| Tax ID (NIF) | XXXX |
| Address | XXXX |
| Email (also for exercising rights) | hola@guadigital.com |
| Data Protection Officer | Not appointed |
This policy explains how GUADIGITAL processes the personal data of people who visit https://guadigital.com or contact it through its channels.
2. What data we process, why and on what legal basis
2.1 Diagnosis or quote form
| Purpose | To handle your request for a diagnosis or quote and keep the business conversation going. |
|---|---|
| Data | What you type in the form: name, email, , current website (if you give it) and your message. Date and time are also stored, and . |
| Legal basis | Your consent (Art. 6.1.a GDPR), by ticking the form checkbox. If you ask for a quote, also pre-contractual measures at your request (Art. 6.1.b). |
| Recipients | Technical providers acting as processors (see section 3). No data is passed to other third parties except where required by law. |
| Retention | Requests that do not lead to a contract are deleted 12 months after the last contact. If there is a contract, they are kept while it lasts and then blocked for legal periods (generally up to 6 years under commercial and tax law). |
| Notes | Form entries are stored in the website database (Fluent Forms plugin) and a copy is emailed through the Banahost mailbox (FluentSMTP plugin). |
2.2 Form anti-spam protection
To prevent automated submissions, the form uses Cloudflare Turnstile, a Cloudflare, Inc. service that checks whether the sender is a person. It may process technical browser data and your IP address. Legal basis: legitimate interest in site security and preventing abuse (Art. 6.1.f GDPR). Cloudflare acts as processor or controller depending on the service . It may involve a transfer to the US (see section 4).
2.3 Contact by email
| Purpose | To reply to messages you send to hola@guadigital.com. |
|---|---|
| Legal basis | Your consent when writing to us or the pre-contractual measures you request (Art. 6.1.a and 6.1.b GDPR). |
| Recipients | Banahost (mailbox) and, , Google. See section 3. |
| Retention | 12 months from the last contact, unless there is a contract (see 2.1). |
2.4 Contact by WhatsApp
| Purpose | To handle enquiries you send via WhatsApp from the website button or by writing to the contact number. |
|---|---|
| Data | Your phone number, your profile name and the content of the conversation. |
| Legal basis | Your consent when starting the conversation (Art. 6.1.a GDPR). |
| Recipients | Meta (WhatsApp) processes data as an independent controller under its own privacy policy. GUADIGITAL accesses the conversation in its WhatsApp Business account. |
| Retention | 12 months from the last message; you can ask for earlier deletion. |
| Notes | The button is a link: it does not load WhatsApp content or set cookies when you visit the page. Data is processed when you click and open WhatsApp. |
2.5 Web analytics (Google Analytics 4) — PLANNED
[PLANNED: not yet installed] Once activated, the site will use Google Analytics 4 (Google Ireland Limited / Google LLC) to understand how the site is used and improve it, only if you accept analytics cookies in the banner. It will use Google Consent Mode v2: if you reject, Google Analytics does not store identifiers on your device . Data: page views, duration, device, browser, approximate country/city and cookie identifiers; . Legal basis: consent (Art. 6.1.a GDPR). Retention: 14 months in Google Analytics. It may involve a transfer to the US (see section 4).
2.6 Cookies and consent management
We use CookieYes to show the banner and store your choice. A technical cookie stores your preferences (see the cookie policy). Legal basis: legal obligation and consent management (Art. 6.1.c GDPR and Art. 22.2 LSSI-CE). CookieYes acts as processor .
2.7 Security, maintenance and backups
| Purpose | To maintain the website, protect it from attacks and be able to restore it. |
|---|---|
| Data | Website administration accounts, technical server logs (IP address, access date and time) and backups of files and database, which include form entries. |
| Legal basis | Legitimate interest in the security and integrity of the site (Art. 6.1.f and Art. 32 GDPR). |
| Recipients | Banahost (hosting) and Google (Drive, backup storage with UpdraftPlus). |
| Retention | Server logs: Banahost’s period . Backups: the latest 3 are kept and replaced by new ones. |
2.8 Language
The site uses Polylang to remember your chosen language with a technical cookie (pll_language). It is not used to identify you.
2.9 Artificial intelligence assistant (website chat and, where applicable, WhatsApp)
Transparency notice (Art. 50 of Regulation (EU) 2024/1689, AI Act): the assistant is an artificial intelligence system, not a person. It can make mistakes. The “from” prices, timeframes and conditions it gives are indicative; they are binding only once a person at GUADIGITAL confirms them in writing. It does not replace a quote.
| Purpose | To answer questions about our services, indicative prices, timeframes and contact and, if you ask, put you in touch with a person. |
|---|---|
| Data | The text you type in the chat (we do not ask for personal data, but it may appear if you write it). IP address, transiently, only to limit abuse: used as a salted hash inside counters that expire after 1 and 24 hours. On WhatsApp (when active): your phone number, profile name (sent by Meta) and message text. |
| Legal basis | Pre-contractual measures at your request (Art. 6.1.b GDPR) and, additionally, legitimate interest in handling enquiries (Art. 6.1.f) . It is not based on consent. |
| Recipients | Anthropic (provider of the Claude AI model, via its API) receives the conversation history (max. 10 messages) to generate the reply, as processor (Art. 28 GDPR) . Requests leave GUADIGITAL’s server: your browser does not connect to Anthropic. See sections 3 and 4. |
| Retention | Web chat: GUADIGITAL stores no conversations or IP addresses on its server. The history stays only in your browser (sessionStorage) and is deleted when you close the tab or press “Clear chat”. Only anonymous daily totals (number of chats, messages and usage) are kept, for 31 days. Anthropic: under its commercial API policy, inputs and outputs are deleted within 30 days at most, unless flagged for breaching its usage policy (up to 2 years) or required by law . By default Anthropic does not use commercial API data to train its models . WhatsApp: conversation context (last 10 messages) for 24 hours after the last message, then deleted. If you ask for a person, we receive an email alert with your number and your last message (max. 200 characters), kept 12 months like other requests (see 2.3). |
| Automated decisions | None. The assistant only informs. It makes no decisions with legal or similarly significant effects on you (Art. 22 GDPR) and builds no profiles. Fixed prices, quotes and appointments are always decided by a person. |
| Notes | Please do not type health data or other special categories of data (Art. 9 GDPR), bank details, passwords or other people’s data. Because we do not store web chat conversations on the server, we cannot give you a copy of a chat you have already closed. If you prefer to talk to a person, use the WhatsApp button or the contact form. |
WhatsApp through the WhatsApp Business API (Phase B, not active yet). Once active, Meta Platforms Ireland Ltd. carries the messages. For message content that GUADIGITAL handles in its business account, Meta acts as processor under the WhatsApp Business data processing terms; for other app usage data (for example your WhatsApp account data and metadata) it acts as an independent controller under its privacy policy . This is different from the simple button in section 2.4, which only opens a chat in your app.
3. Recipients and data processors
GUADIGITAL does not sell personal data. It uses providers that access data only to deliver their service (processors, Art. 28 GDPR):
| Provider | Service | Data | Location / safeguards |
|---|---|---|---|
| Banahost | Web hosting, domain email and server backups | Website content, form entries, emails, logs | Europe per its control panel |
| Google (Drive) | Off-site storage of UpdraftPlus backups | Website backups (files and database) | US / EU (see 4) |
| CookieYes | Cookie banner and consent log | Cookie preferences, anonymised IP address | |
| Cloudflare | Anti-spam (Turnstile, see 2.2) | Technical browser data | US (see 4) |
| Google (Analytics) — PLANNED | Web analytics (see 2.5) | Usage data | US / EU (see 4) |
| Anthropic | Claude AI model (API) for the AI assistant (see 2.9) | Conversation text (last 10 messages max.) | US (see 4) |
| Meta Platforms Ireland (WhatsApp Business) — PLANNED | Transport of assistant messages over WhatsApp (see 2.9) | Number, profile name, messages | EU / US (see 4) |
With the simple WhatsApp button (2.4), Meta is not a processor: it processes data as an independent controller. With the assistant on WhatsApp (2.9, once active), Meta’s role is as described there. Data may also be disclosed to authorities where there is a legal obligation.
4. International transfers
Some providers (Google, Cloudflare and Anthropic) may process data in the United States. These transfers rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, if the provider is listed as certified , and, where applicable, on the European Commission’s standard contractual clauses. For Anthropic, the data processing addendum (DPA) accompanying its commercial terms incorporates standard contractual clauses (modules 2 and 3 of Decision (EU) 2021/914) ; its certification under the EU-US Data Privacy Framework . Meta (WhatsApp) processes data under its own terms and transfer safeguards . You can ask for more information at hola@guadigital.com.
5. Retention periods (summary)
| Processing | Period |
|---|---|
| Form and email | 12 months from the last contact; if there is a contract, while it lasts and then blocked for legal periods |
| 12 months from the last message | |
| AI assistant (web chat) | No conversations or IPs on the server; anonymous totals 31 days; at Anthropic, 30 days max. |
| AI assistant (WhatsApp, PLANNED) | Context 24 h; hand-over alert 12 months |
| Anti-spam | Provider’s period |
| Analytics (PLANNED) | 14 months |
| Cookie consent | Up to 12 months; asked again after 24 months at most |
| Backups | The latest 3 copies, in rotation |
| Server logs | Banahost’s period |
6. Your rights
You can exercise:
- Access: know what data about you we process.
- Rectification: correct inaccurate data.
- Erasure: ask for it to be deleted.
- Objection: object to processing based on legitimate interest on grounds relating to your particular situation.
- Restriction: ask for processing to be suspended in the cases provided by law.
- Portability: receive your data in a structured format, where processing is based on consent or a contract.
- Withdraw consent at any time, without affecting earlier processing.
- Not to be subject to automated decisions. We do not make automated decisions or build profiles with legal effects; the AI assistant (2.9) only informs. Closed web chats cannot be recovered or copied because they are not stored on our server.
How to exercise them: write to hola@guadigital.com stating the right and the details needed to identify you. We will reply within one month at most, extendable as the law allows.
7. Complaint to the supervisory authority
If you believe the processing does not comply with the rules, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es. We would appreciate it if you wrote to us first so we can try to resolve it.
8. Security
We apply reasonable technical and organisational measures: encrypted connection (HTTPS), updates, access control, anti-spam protection and backups. If a security breach poses a risk to your rights, it will be notified to the AEPD within 72 hours and, where required, to the people affected.
9. Children
This site is not aimed at children under 14. Children under that age cannot give consent themselves (Art. 7 LOPDGDD).
10. Changes to this policy
We may update this policy. The current version is the one published on this page, with its update date.