Privacy policy
Last updated: June 2026
This Privacy Policy governs the processing of personal data carried out by Bouzon Digital through the website www.bouzondigital.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).
1. Data controller
- Controller: Pablo Bouzon, doing business under the trade name Bouzon Digital.
- Spanish NIE: Z0115635L
- Address: Av. Gamonal 4, 29630 Benalmádena (Málaga), Spain
- Email: [email protected]
For any matter concerning the processing of your personal data you may contact the controller at the email above. A Data Protection Officer (DPO) is not required under article 37 GDPR.
2. Data we collect and purposes
| Source | Data | Purpose |
|---|---|---|
| Contact form | Name, email, phone (optional), message, project subject | Reply to the enquiry and, where applicable, prepare a commercial proposal |
| Onboarding form | Business data (name, address, phone), contact details of the owner, files (logo, photos, menu), service preferences | Onboard the client and provision the contracted services |
| Public support chat | Messages exchanged, language, source page | Resolve pre-sale questions and guide the user to the right service |
| Subscriptions / payments | Identification and bank/card data provided to the GoCardless or Stripe payment gateway | Manage invoicing and collection of the contracted service |
| Web analytics (with consent) | Technical browsing data (URL, event, viewport, referrer, anonymous session ID) | Understand how the site is used and improve experience |
| Marketing (with consent) | Pixel identifier, interest events (visits, clicks, form starts) | Optimise advertising campaigns and build retargeting audiences |
3. Legal basis
- Consent of the data subject (art. 6.1.a GDPR) for the contact and onboarding forms, the chatbot, analytics cookies and marketing cookies.
- Performance of a contract (art. 6.1.b GDPR) for managing the contracted service, invoicing and support.
- Legal obligations (art. 6.1.c GDPR) in tax, accounting and fraud-prevention matters.
- Legitimate interest (art. 6.1.f GDPR) for maintaining site security, preventing abuse and handling pre-contractual enquiries.
4. Retention periods
- Pre-sale enquiries without a contract: up to 2 years from the last contact, unless the data subject requests earlier erasure.
- Client data: for the duration of the contractual relationship and, after termination, for the applicable legal periods: up to 6 years for commercial documentation (Spanish Commercial Code, art. 30) and up to 4 years for tax obligations (Spanish General Tax Law, art. 66).
- Analytics data: up to 25 months (Microsoft Clarity default). The anonymous session ID is only linked to an email when the user provides it in a form.
- Marketing data: up to 13 months (Meta Pixel) or until consent is withdrawn.
After these periods data is deleted or anonymised, unless a legal obligation requires further retention.
5. Processors (third parties processing data on our behalf)
To provide the service we rely on the following processors, each under a written data processing agreement compliant with article 28 GDPR. Unless otherwise stated, servers are located in the European Economic Area (EEA):
| Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting | Germany (EU) |
| Cloudflare, Inc. | CDN, DDoS protection, DNS resolution | USA — DPF |
| Resend, Inc. | Transactional email and notifications | USA — DPF |
| Soluciones Corporativas IP, S.L. (DonDominio) | Domain registration and professional email hosting (when contracted) | Spain — EU |
| Microsoft Corporation (Clarity) | Cookieless web analytics | USA — DPF |
| Meta Platforms Ireland Ltd. | Ad Pixel and Conversions API (marketing consent only) | Ireland (EU) / USA — DPF |
| GoCardless Ltd. | SEPA direct-debit and subscription management | United Kingdom (Adequacy Decision) |
| Stripe Payments Europe Ltd. | Card payment gateway (online shop or deposits, when contracted) | Ireland (EU) / USA — DPF |
| Google Ireland Ltd. (reCAPTCHA, optional) | Anti-spam form protection | Ireland (EU) / USA — DPF |
6. International transfers
Some of the above processors handle data in the United States. Bouzon Digital relies on the EU-US Data Privacy Framework (European Commission Adequacy Decision of 10 July 2023) where the processor is certified, or on Standard Contractual Clauses (Decision 2021/914) otherwise. Transfers to the United Kingdom rely on the Adequacy Decision of 28 June 2021.
7. Recipients
Your data is not shared with third parties other than the processors listed above, except:
- Under a legal obligation (tax, judicial or supervisory authorities).
- With your express consent for a specific purpose.
Bouzon Digital does not sell or rent personal data to third parties for advertising.
8. Automated decision-making and profiling
Bouzon Digital does not take automated decisions with legal or significant effects on users, nor does it carry out profiling with that scope. Marketing cookies may use standard ad-segmentation, but no algorithm decides on contracting, pricing or service provision without human intervention.
9. Minors
The services and website are aimed at professionals and businesses (B2B). We do not knowingly process data of minors under 14. If we detect such processing it will be deleted immediately.
10. Your rights
As a data subject you may exercise the following rights at any time by emailing [email protected] with a copy of a document proving your identity:
- Access — know which of your data we process.
- Rectification — correct inaccurate data.
- Erasure ("right to be forgotten").
- Objection to processing, under the GDPR conditions.
- Restriction of processing.
- Portability of data to another controller.
- Withdrawal of consent, without affecting the lawfulness of prior processing.
If you believe your rights have not been properly addressed, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es, C/ Jorge Juan 6, 28001 Madrid.
11. Security measures
We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), encrypted daily backups, minimum necessary access controls, records of processing activities and breach-management procedures pursuant to article 33 GDPR.
12. Cookies
See the Cookie Policy for the cookies used and how to manage your consent.
13. Use of YouTube API Services
Bouzon Digital uses YouTube API Services for a single purpose: publishing the video manuals for our software on our own channel, which we then link from the admin panel and from the documentation our clients receive.
When you use the features that display or link to that content, the YouTube Terms of Service apply to you. Information processed by Google through those services is further governed by the Google Privacy Policy.
- What data we handle — only the authorisation credentials (OAuth 2.0) of the Google account that owns our channel, needed to upload our own videos. We do not collect, store or process personal data of YouTube users, nor do we access any third party's account data.
- Retention and deletion — authorisation tokens are stored encrypted and outside the repository, only for as long as the publishing tool is in use, and are deleted when access is revoked or on written request to [email protected].
- Revoking access — you may withdraw the permissions granted to this and any other application at any time from your Google account permissions page.
14. Changes
Bouzon Digital reserves the right to update this Privacy Policy to adapt it to regulatory changes or to the evolution of the service. The "last updated" date appears at the top of the document.