Who is responsible for your data
- Controller
- [Legal name - company name S.L., or your full name if trading as autónomo] (trading as ENTRAILED)
- NIF / CIF
- [NIF / CIF]
- Address
- Calle Alejandro Dumas 17, Oficinas, 29004 Málaga, Spain
- Contact
- hello@entrailed.com
We are a small team and have not appointed a Data Protection Officer, as the law does not require one for our activity. Write to the address above for anything related to your data.
What we collect
- Contact form: your name, email, company (optional), the services you're interested in and your message.
- Emails and calls: whatever you choose to share when you write to us or book a discovery call.
- Clients: contact and billing details of the people we work with, and the information needed to deliver the project.
- Technical data: our hosting provider automatically logs IP address, browser type and time of request to keep the site secure and working.
- Digital Health Check: your answers are scored in your own browser. They are not sent to us or stored, unless you later choose to share them with us.
We don't use analytics or advertising trackers. Cookies are covered in our cookie policy.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry and preparing a proposal | Steps you ask us to take before a contract - Art. 6(1)(b) |
| Delivering projects and managing the client relationship | Performance of a contract - Art. 6(1)(b) |
| Invoicing, accounting and tax | Legal obligation - Art. 6(1)(c) |
| Keeping the website secure (server logs) | Legitimate interest - Art. 6(1)(f) |
| Loading third-party content such as Google Maps | Your consent - Art. 6(1)(a) |
| Occasional updates about our services to clients | Legitimate interest (Art. 21 LSSI-CE) - you can opt out in every email |
We don't sell your data or use it for automated decisions with legal or similarly significant effects. The Health Check score is guidance only.
How long we keep it
- Enquiries that don't lead to a project: up to 12 months after our last contact.
- Client data: for the duration of the relationship, then as long as the law requires - six years for accounting records and four years for tax purposes.
- Server logs: a short period set by our hosting provider, for security only.
- Consent records: while the choice is valid (12 months), so we can show you gave it.
Who we share it with
Only with providers that help us run the business, under contracts that bind them to protect your data and use it only on our instructions:
- Vercel Inc. - website hosting.
- Formspree Inc. - delivers contact-form messages to our inbox.
- [Email provider, e.g. Google Workspace (Google Ireland Ltd.)] - email.
- Our accountant / tax advisor - invoicing and tax filings.
If you allow third-party content, Google loads the map on our Contact page and processes data as an independent controller under its own privacy policy. We share data with public authorities only when the law requires it.
International transfers
Vercel and Formspree are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
Your rights
You can, at any time and free of charge:
- Access the data we hold about you.
- Correct anything inaccurate.
- Delete your data when it's no longer needed.
- Restrict or object to how we use it.
- Port it to another provider.
- Withdraw consent - via “Cookie settings” in the footer, or by writing to us.
Email hello@entrailed.com with the subject “Data protection request”. We reply within one month and may ask you to confirm your identity.
If you're not satisfied, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid - www.aepd.es.
Security
The site is served over HTTPS, access to our systems is limited to the people who need it and protected with strong authentication, and we only work with providers that meet recognised security standards.
Other information
Children. Our services are for businesses. We don't knowingly collect data from anyone under 14.
Changes. We'll update this policy when our practices change and show the new date at the top. Significant changes will be highlighted on the site.