01Data controller
- Trade name
- Webmake
- Website
- webmake.es
- [email protected]
02What data we process
- Quote requests: name, email, phone, business name, current website, chosen plan and your notes.
- Clients: account, contract (signer name, ID number and signature), billing, messages and files shared in the client area.
- Payments: processed by Stripe; we only receive the payment confirmation and amount, never your card number.
- Evidence and security: IP address, browser, date and time of document acceptances, sign-ins and preview access.
- Business prospecting: public business data (trade name, phone, contact email, website, social media profiles and address) from accessible sources such as Google Maps listings or the business's own website, to offer our services to businesses. In our first message we tell you where your data came from and how to object (GDPR art. 14).
03Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Prepare the quote you request | Pre-contractual steps at your request (art. 6.1.b) |
| Deliver the contracted service and support | Performance of the contract (art. 6.1.b) |
| Invoicing, tax and accounting duties | Legal obligation (art. 6.1.c) |
| Keep acceptance evidence, protect previews and prevent fraud or copying | Legitimate interest in defending our rights (art. 6.1.f) |
| Contact businesses to offer our services | Legitimate interest (art. 6.1.f), with the right to object at any time |
| Inform clients about services similar to those contracted | Art. 21.2 LSSI-CE; you can object in every message |
04How long we keep it
- Quotes that do not become a contract: 12 months.
- Client data: for the relationship and 6 further years for commercial and tax obligations.
- Acceptance evidence and security logs: while legal claims arising from the contract are possible (up to 5 years).
- Prospecting data: until you object; we then keep the minimum in an exclusion list so we never contact you again.
05Who we share data with
- Stripe, for payments.
- Hosting and infrastructure providers, including the Cloudflare network that protects and speeds up the site.
- The electronic contract signature service.
- Public authorities and courts, only when the law requires it.
06International transfers
Some providers, such as Stripe or Cloudflare, may process data outside the EEA under adequate safeguards: the EU-US Data Privacy Framework or the European Commission standard contractual clauses.
07Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected]. We reply within one month. You may also complain to the Spanish Data Protection Agency at www.aepd.es.
08How we protect your data
Encrypted connections, hashed passwords, expiring sessions, per-project access control and a tamper-proof audit log. If a breach affects you, we will tell you and notify the authority within the legal deadlines.
09Minors
Our services are aimed at businesses and adults. We do not knowingly process data of minors.