Privacy Policy

1. Data Controller

Alejandro Briz (hereinafter, "the Owner"), with Spanish Tax ID (NIF) 48499761-Y, registered address at C/ Nuestra Señora de los Caballeros 34, 39574 Frama (Cantabria, Spain) and operations in San Pedro de Alcántara, Marbella (Málaga, Spain), is the Data Controller responsible for the processing of personal data collected through this website (alejandrobriz.es).

Direct Contact: link@alejandrobriz.es / info@alejandrobriz.es · Tel. +34 629 671 944

2. Categories of Data We Collect

All personal data processed is obtained directly from data subjects through form submissions on this website or direct email/WhatsApp communications:

• Inquiry & Proposal Forms: Name, business email address, telephone number, requested service scope, and project details. Fields marked with an asterisk (*) are strictly necessary to evaluate and respond to your inquiry.
• Analytical Navigation Data: De-identified navigation metrics (pages visited, session duration, referral source) operating strictly under Google Consent Mode V2. Please refer to our Cookie Policy.

3. Purposes of Processing and Legal Basis

Your personal data is processed for the following specified purposes and under the following legal bases pursuant to Article 6 of Regulation (EU) 2016/679 (GDPR):

• Inquiry Management and Technical Support: Responding to questions and technical requests submitted through contact forms or email.
  Legal Basis: Explicit consent of the data subject (Art. 6.1.a GDPR).
• Web Audits & Educational Newsletters: Generating and delivering requested technical performance audits (/en/audit/) and sending actionable insights on web performance, local SEO, and cybersecurity via our privacy-first platform (Listmonk), with one-click unsubscribe links in every communication.
  Legal Basis: Consent of the data subject (Art. 6.1.a GDPR and Art. 21 LSSI-CE).
• Commercial & Administrative CRM Management: Preparing formal commercial proposals, tracking milestones, and managing prospective client communications.
  Legal Basis: Performance of pre-contractual measures or contract execution (Art. 6.1.b GDPR).
• Service Execution & Invoicing: Delivering contracted web engineering services, managing code deployment, and complying with statutory fiscal accounting requirements.
  Legal Basis: Contract execution and compliance with legal obligations (Art. 6.1.b and 6.1.c GDPR).
• Platform Security (reCAPTCHA / Bot Protection): Protecting server infrastructure against malicious brute-force attacks and spam submissions.
  Legal Basis: Legitimate interest of the Data Controller in safeguarding network and information security (Art. 6.1.f GDPR).
• Statistical Analytics: Measuring aggregated traffic and performance through cookies only when consent is granted.
  Legal Basis: Freely given consent (Art. 6.1.a GDPR).

4. Data Retention Periods

Inquiry and contact data are retained solely for the duration required to address your consultation and manage commercial interactions. Invoicing and accounting records are preserved for the statutory periods established under Spanish tax and commercial law (minimum 4 to 6 years). Analytics metrics are stored for a maximum of 14 months (default retention in Google Analytics 4).

5. Recipients and Third-Party Processors

Personal data is never sold or transferred to third parties for commercial exploitation. Necessary data access is granted solely to trusted service processors under strict Data Processing Agreements (DPAs):

• Webempresa Europa, S.L.: Web hosting and secure email infrastructure. Servers physically located in Spain (EU).
• Stripe Technology Europe, Ltd.: Payment gateway and credit card processing. Payment card details are tokenized and processed directly by Stripe; financial credentials never touch our servers.
• Google Ireland Ltd.: Analytical measurement (GA4) and security verification (reCAPTCHA), operating under Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• Proprietary Infrastructure (CRM & Direct-Booking): Dedicated client repositories hosted on secured servers under the direct control of the Owner with encrypted off-site backups.

6. Automated Decision-Making

No automated profiling or automated decision-making producing legal effects is performed with personal data collected through this website.

7. Your Statutory Rights

Under the GDPR, you are entitled to exercise the following statutory rights free of charge at any time:

• Right of Access: Obtain confirmation of whether your data is being processed and receive a copy thereof.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data when no longer necessary for the purposes collected.
• Right to Restriction of Processing & Right to Object: Restrict processing in certain circumstances or object to processing based on legitimate interest.
• Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format.

To exercise these rights, send an email to link@alejandrobriz.es or write to our registered postal address indicated in Section 1, enclosing verification of your identity.

You also hold the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your data protection rights have been infringed.

8. Technical and Organizational Security

The Owner applies robust technical and organizational security controls—including TLS/SSL encryption protocols, strict access permissions, perimeter firewalls, and regular encrypted backups—to prevent accidental loss, alteration, or unauthorized access. While no internet transmission is 100% impervious, all industry best practices are actively enforced.

9. Policy Updates

The Owner reserves the right to modify this Privacy Policy to reflect evolving regulatory requirements or changes in internal data handling workflows. The latest revision date is prominently displayed at the top of this document.