Privacy policy

Controller: Jose Ramon Acosta Montesino, owner of the website webseoconsult.com.

Address: Av. el Puente, 56, 38700 Santa Cruz de la Palma, Santa Cruz de Tenerife, Spain.

Contact address for data protection matters: admin@webseoconsult.com.

Given the nature and scale of the processing — a single contact form, no large-scale processing and no special categories of data — none of the circumstances in article 37 of Regulation (EU) 2016/679 requiring a data protection officer apply. Privacy enquiries are handled directly at the address above.

The contact form collects your name, email address, telephone number (optional) and whatever you write in the message. Nothing else is requested, and you are advised not to include sensitive information or anything not needed to answer your enquiry.

If you email the owner directly, the data processed is whatever appears in that message and whatever you choose to include in it.

The form also uses technical measures against automated bulk submission: a hidden field that legitimate submissions leave empty, a check on how long the form was open before sending, and a limit on the number of submissions per hour.

That last measure is worth explaining, because it is the only thing this site does with your IP address. The server calculates a SHA-256 cryptographic digest of the IP address combined with the current hour, and uses that digest as the filename of the counter. The IP address itself is never written to any application log, is never attached to the message you send, and the counter falls out of use as soon as the hour changes. This is still the processing of personal data, which is why it is disclosed here rather than left unsaid.

Separately, the hosting server produces the standard technical access logs any web server produces, which may include the IP address, the date and time of the request and the resource requested. Those logs are operated by the hosting provider under its own configuration and are used for maintaining and securing the service.

To deal with and reply to the enquiry, information request or quotation request you send.

To handle steps taken before any contract and, where one follows, the contractual relationship and the invoicing arising from it.

To prevent automated bulk submission and abuse of the form, and to keep the site secure.

The data is not used to build commercial profiles, and not used to send advertising or newsletters. This site operates no mailing list.

The primary legal basis is your consent, under article 6(1)(a) of Regulation (EU) 2016/679. Consent is obtained through a checkbox you must actively tick before the form will send, and it can be withdrawn at any time.

Where a message is unambiguously a request for a quotation or for engagement, the processing is additionally supported by article 6(1)(b), as a step taken at your request prior to entering a contract. That basis is secondary and does not replace consent.

The anti-abuse measures described above, including the counter derived from the cryptographic digest of the IP address, rest on the controller’s legitimate interests under article 6(1)(f), understood strictly and solely as preventing automated abuse of the form and keeping the site secure. They are not used for any other purpose, not to identify visitors, and not for audience measurement.

Where an enquiry leads to a contract, retention of the associated tax and accounting records rests on article 6(1)(c), as necessary for compliance with the controller’s legal obligations.

Data is not sold, not disclosed to third parties for commercial purposes, and not shared with advertising networks or social media platforms. Beyond the processors identified below, no third party receives it except where required by law or by a competent authority.

The website and the associated email are delivered on the infrastructure of a web hosting provider and an outgoing mail provider, each acting as a processor within the meaning of article 28 of Regulation (EU) 2016/679. Their access is limited to what is strictly necessary to provide the contracted service, they are bound by a written processing agreement and by confidentiality, and they may not use the data for their own purposes.

The identity of those providers, and the country their servers are located in, is supplied in writing to anyone who asks at admin@webseoconsult.com, and is recorded in this section whenever either of them changes.

If any further processor is engaged in future — a transactional email service, an off-site backup, or a content delivery network or firewall that handles visitors’ IP addresses, for example — it will be identified in this section before it starts to be used.

The controller does not, on its own initiative, transfer personal data outside the European Economic Area.

Should any of the processors named above process data outside the European Economic Area, the transfer would rely on an adequacy decision of the European Commission or on standard contractual clauses adopted by it, and this section would state the destination country and the specific safeguard applied.

Messages received through the form or by email are kept for as long as the exchange continues and then for a maximum of two years from the last contact, after which they are deleted. If you ask for deletion sooner, they are deleted then.

Where an enquiry leads to a contract, the associated records are kept for the duration of the relationship and afterwards for the limitation periods set by the applicable tax, accounting and civil law, restricted and accessible only to meet legal obligations.

The submission-limiter counters described above are discarded when the hour changes and are not retained.

You have the rights of access, rectification, erasure, restriction of processing, objection and data portability granted by articles 15 to 22 of Regulation (EU) 2016/679 and by Spanish Organic Law 3/2018 of 5 December on data protection and the guarantee of digital rights.

To exercise any of them, send a request to admin@webseoconsult.com saying which right you wish to exercise. Proof of identity may be requested if there is reasonable doubt about who is making the request. Requests are answered within the period the legislation allows, and exercising these rights is free of charge.

Where processing is based on your consent, you may withdraw it at any time and without giving a reason. Withdrawal does not affect the lawfulness of processing carried out before it.

If you believe your data is not being handled in accordance with the law, or you are not satisfied with the response to a request, you may complain to the Spanish supervisory authority.

Agencia Española de Protección de Datos (Spanish Data Protection Agency). C/ Jorge Juan 6, 28001 Madrid, Spain. Online office: sedeaepd.gob.es.

You do not have to contact the controller first before complaining to the Agency, although doing so is often the quicker way to resolve a problem.

Name, email address and message are needed in order to answer an enquiry. Without them the form cannot be submitted and no reply is possible.

The telephone number is optional. Giving it simply allows a reply by phone where that is quicker than email; withholding it has no other consequence.

Ticking the box to accept this policy is required, because it is the consent on which the processing relies.

No decisions are taken solely by automated processing that produce legal effects concerning you or similarly significantly affect you, and no profiling is carried out.

The form’s anti-spam checks do not assess the person. They test technical characteristics of the submission and, where one fails, refuse the message with an error shown on screen, which does not prevent you getting in touch by phone or email instead.

This website uses no cookies and no tracking technology of any kind. No analytics, advertising or social media tools that place cookies on your device are used. Typefaces are served from this site’s own server, with no calls to external services.

If any cookie that is not strictly necessary were added in future, your consent would be requested beforehand through a clear notice, as the law requires. The detail is set out in Cookie policy.

Information is transmitted encrypted over HTTPS. Messages received are handled in environments with access restricted to the controller, and the providers involved apply their own technical and organisational measures.

For obvious reasons the specific security configuration is not detailed here. No measure removes risk entirely: if a security breach occurred that was likely to result in a high risk to your rights, you would be notified in accordance with article 34 of Regulation (EU) 2016/679.

This policy may be amended to reflect changes in the law, the engagement of new processors, or changes in how the site works. The version that applies is the one published on this page.

The date of the last revision appears at the top of the document. Substantial changes affecting processing based on your consent will be communicated before they take effect.