Privacy policy

1. Data controller

The data controller for your personal data is:

Full name

Daniel Eduardo Sanz Arilla

Spanish national ID (DNI / NIF)

26578790J

Activity

Custom web and app development (Landinowebs)

Registered address

Valencia, (ES)

Contact email

landinowebs@gmail.com

Phone / WhatsApp

649 23 05 22

2. What personal data do I collect?

I only collect the data I need for each purpose. Specifically:

• Contact data: name, email, phone or WhatsApp if you provide them when you write to me.
• Project data: description of what you need, indicative budget, deadlines, materials you provide (text, photos, logos, etc.).
• Billing data: name or company name, tax ID, billing address and bank details, only if you hire a service.
• Browsing data: IP address, browser, device, pages visited and time on site. Collected through cookies and analytics (see point 6).

I do not collect specially protected data (health, ideology, sexual orientation, etc.) or data of children under 14.

3. What do I use it for?

• Answering your questions and quotes: replying to emails, WhatsApp, phone calls and messages you send me.
• Delivering the contracted service: building your website or app, maintaining it during the warranty period, and if you sign up for it during the maintenance plan.
• Managing billing and payments: issuing invoices, recording payments and meeting tax and accounting obligations.
• Complying with legal obligations: responding to requests from the Spanish Tax Agency (AEAT), competent authorities, or in case of legal incidents.
• Improving the site: anonymous analysis of usage to detect broken pages, interesting content, etc.

4. Legal basis (why I am allowed to process it)

• Consent: when you first write to me, you give consent for me to reply and process the data of your enquiry.
• Performance of a contract: when you accept a quote, processing project and billing data is necessary to perform it.
• Compliance with legal obligations: keeping invoices (4 years) or responding to a request from the AEAT.
• Legitimate interest: analysing aggregated site usage to improve it, always respecting your privacy.

5. How long do I keep your data?

• Uncontracted enquiries: up to 12 months from the last contact. After that, I delete it.
• Client and project data: during the contractual relationship, and for 5 years afterwards (general statute of limitations for contractual obligations in Spain).
• Invoices and accounting: 4 years from issue (Spanish General Tax Law 58/2003).
• Browsing / analytics data: 26 months maximum (Spanish DPA criterion for Google Analytics and similar).

6. Recipients and processors

I do not sell or share your data with third parties. I only share it with the providers I need to deliver the service. All are in the EU or have equivalent guarantees:

• Hosting and CDN: Vercel, Inc. (static site hosting, may process data outside the EEA under the EU-US Data Privacy Framework).
• Email: Google Workspace (Gmail) for landinowebs@gmail.com, with US transfers covered by the Data Privacy Framework.
• Domains and DNS: the registrar you choose or we agree in your contract.
• Payments and billing: Stripe or direct bank transfer. I do not store card data.
• Web analytics: if I ever enable Google Analytics 4, I will let you know and ask for prior consent. Currently this site does not use Google Analytics.
• Fonts: Google Fonts, with optimised loads from Google's CDN.

If on any project I need to bring in a new provider that processes personal data, I will let you know and, where appropriate, ask for your consent first.

7. International transfers

Some of the providers above (Vercel, Google) may process data outside the European Economic Area. In all cases they are covered by the EU-US Data Privacy Framework (European Commission adequacy decision of July 2023) or sign the European Commission Standard Contractual Clauses, which guarantee a level of protection equivalent to the European one.

8. Your rights

The GDPR grants you a set of rights over your personal data. You can exercise them by writing to landinowebs@gmail.com:

• Access: know what data I have about you and what I use it for.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask me to delete your data when it is no longer needed.
• Restriction: ask me to keep it only for claims or to meet legal obligations.
• Portability: receive your data in a structured, commonly used format (for example, JSON or CSV).
• Objection: object to processing based on legitimate interest or for marketing purposes.
• Withdraw consent: at any time, without retroactive effects.

Response time: 1 month from receiving your request, extendable to 2 months if the request is complex.

If you consider I have not properly handled your rights, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es - C/ Jorge Juan, 6, 28001 Madrid.

9. Security

I apply reasonable technical and organisational measures to protect your data:

• HTTPS / TLS connections across the site and forms.
• Two-step verification on email and accounts.
• Encrypted backups of in-development projects.
• Unique passwords per service, managed with a password manager.
• Encrypted computer and devices, with up-to-date antivirus.

In case of a personal-data security breach, I will notify you within 72 hours, as required by the GDPR.

10. Changes to this policy

I may modify this policy to adapt it to legal developments or to changes in the services I offer. When I do, I will update the "Last updated" date at the top. If the change is substantial (for example, adding new providers outside the EEA), I will let you know by email if we have an open contractual relationship.