Privacy policy

Controller

Miguel Zumaquero Bernal

Trading name

Zumaquero Dev

NIF

77193245R

Address

C/ Espiritu Santo 23, Coín (29100), Málaga

Contact email and email for exercising rights

info@zumaquerodev.es

Website

https://zumaquerodev.es

Given the volume and type of processing carried out, it is not mandatory to appoint a data protection officer (article 37 of the GDPR), so privacy enquiries are handled directly at the email address indicated.

I only process the data you provide voluntarily and what is strictly necessary for the website to work securely. I do not buy databases or obtain your data from third-party sources.

Free review form (both the one on the review page and the short form at the bottom of the home page)

Name, email address and the URL of the website you want me to review. Optionally, your company name and phone number. A record is also kept that you ticked the box accepting this policy and of the time of submission, as proof of consent.

Quote request form

Name, email address, the project description you write yourself and an indication of whether you already have a website or app up and running. A record is likewise kept that you ticked the box accepting this policy and of the time of submission, as proof of consent. Bear in mind that the description is a free-text field: only the personal data you choose to include in it will be processed.

Emails you send me

Your email address and any personal data you include in the message or in attachments.

Technical security data

IP address and basic request data, processed temporarily to limit the number of form submissions per hour, to limit the number of pages that can be requested per minute from the same IP and to detect automated submissions (anti-spam). It is not stored in any database, is not used to identify you and is not used for profiling.

Cookie preference

Your decision about cookies is stored in your own browser (local device storage). It is not sent to any server or linked to your identity.

The free review form and the quote request form are the only two forms on the site that collect personal data. Neither of them writes the information to a database: both simply send me an email with what you have written.

I do not process special categories of data (health, ideology, trade union membership, biometric data, etc.). I ask you not to include them in the forms or in emails: if I receive them unnecessarily, I will delete them.

I do not make automated decisions producing legal effects on you and I do not build profiles with your data. Nor will I send you commercial communications unrelated to the service you have requested: if a newsletter is created in the future, it will require a specific, separate subscription.

Requests that do not lead to an engagement

Both review requests and quote requests are kept while the request is being handled and for up to twelve months after the last contact, in case you resume the conversation. They are then deleted.

Client data

Throughout the contractual relationship and, once it ends, for the limitation periods of the possible liabilities arising from the contract.

Invoicing and accounting data

Six years from the last entry, under article 30 of the Spanish Commercial Code, and four years for the purposes of tax limitation (article 66 of the Spanish General Tax Act).

Proof of consent

While the processing based on that consent remains active and for the period necessary to demonstrate compliance in the event of a claim.

Technical security data (IP)

Kept only in server memory during the relevant control window (one hour for the submissions of each form, one minute for page requests) and discarded automatically afterwards. It is not written to disk or to any database.

This site has no client or lead database: what you send through either of the two forms reaches me by email and is kept in my professional inbox for the periods indicated above, after which it is deleted.

I do not sell or transfer your data to third parties for commercial purposes. In order to provide the service I rely on technology providers acting as data processors, subject to a processing agreement under article 28 of the GDPR incorporated into their terms of service:

Vercel Inc. (United States)

Hosting and deployment of the website, and aggregated, anonymous visit statistics (Vercel Web Analytics) once you accept the analytics category. It processes the technical request data needed to serve the pages and for that measurement.

Resend (United States)

Sending the transactional email generated by the forms: the notice I receive and the acknowledgement you receive.

Professional email provider

Manages the inbox from which I keep up the correspondence with you.

In addition, your data may be disclosed to the tax authorities, to banks and to my accountant where there is a legal obligation or it is essential to manage payment and accounting, as well as to courts and tribunals when they require it.

Some of the providers indicated are based in the United States, so an international transfer of data may take place. Those transfers are covered by the mechanisms provided for in Chapter V of the GDPR: standard contractual clauses approved by the European Commission, the provider's adherence to the EU-US Data Privacy Framework where applicable, and additional measures such as encryption in transit and at rest.

If you want the detail or a copy of the safeguards applied to a specific provider, email me and I will provide it.

You can exercise the following rights at any time and free of charge:

Access

To know what data of yours I process and obtain a copy of it.

Rectification

To correct inaccurate data or complete incomplete data.

Erasure

To request that I delete your data when it is no longer necessary or you withdraw your consent, unless I must keep it under a legal obligation.

Objection

To object to processing based on my legitimate interest on grounds relating to your particular situation.

Restriction

To ask that I suspend processing while a claim of yours about its accuracy or lawfulness is verified.

Portability

To receive the data you have provided in a structured, commonly used format, or to request that it be transmitted to another controller.

Withdrawal of consent

To revoke the consent given at any time, without affecting the lawfulness of processing prior to the withdrawal.

To exercise them, simply send a request to info@zumaquerodev.es stating the right you want to exercise. I may ask you to prove your identity if there is reasonable doubt about who is making the request. I will respond within a maximum of one month of receipt, extendable by a further two months if the request is particularly complex, in which case I will inform you of the reason.

If you consider that I have not handled your request properly or that the processing breaches the regulations, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es), the competent supervisory authority in Spain.

I apply technical and organisational measures appropriate to the risk of the processing, including: encryption of traffic via HTTPS across the whole site, validation of data received in the forms both in the browser and on the server, limitation of the number of submissions per IP address, access control to the systems where the information is stored, regular updating of dependencies and backups.

No system is infallible. Should a security breach occur that poses a high risk to your rights and freedoms, I will inform you without undue delay and notify the Spanish Data Protection Agency within the 72-hour period provided for in article 33 of the GDPR.

The fields marked as mandatory in the forms are the minimum essential to be able to help you. In the free review form, without name, email and URL I cannot prepare or send you the report; the optional fields (company and phone) only serve to speed up contact and you can leave them blank. In the quote request form, without name, email and a description of what you need I cannot estimate the project or send you the proposal; the indication of whether you already have a website or app is informative and you can leave it unticked. Likewise, not ticking the box accepting this policy prevents the submission of either form, because without informed consent I cannot process your data.

The services on this site are aimed at professionals, companies and individuals over the age of 14, the minimum age to consent to the processing of their data under article 7 of the LOPDGDD. If I detect that I have received data from a minor below that age without the authorisation of their parents or guardians, I will delete it.

This policy may be updated when the services provided, the providers used or the applicable regulations change. The version in force is always the one published on this page, with its last-updated date. If the change substantially affects processing based on your consent, it will be requested from you again.

The legally binding version of this document is the Spanish one. This English translation is provided for convenience only; in case of any discrepancy, the Spanish version prevails.