Privacy policy

1. Data controller

Alejandra Ara Berges, a self-employed professional trading as Co., with Spanish tax ID 73018942Z and address Calle Unceta 35, 50010 Zaragoza, Spain, is the data controller. For any question about your data, email administracion@somosco.es.

2. When you contact us by email

We process your email address, your name if provided, and the content and attachments you choose to send in order to answer your enquiry and, where relevant, prepare a proposal or manage our professional relationship.

If you request a quotation or service, the legal basis is taking steps at your request before entering into a contract or performing a contract (Article 6(1)(b) GDPR). For other enquiries, it is our legitimate interest in responding to communications you send us (Article 6(1)(f) GDPR), limited to that purpose. Data needed to comply with legal obligations is processed under Article 6(1)(c) GDPR.

There are no forms or newsletter subscriptions. We do not use your messages to send unsolicited advertising. Please provide only the information needed and avoid sending particularly sensitive data that is not relevant to your enquiry.

3. Analytics, if you accept it

We use Google Analytics 4, managed through Google Tag Manager, only after you accept the analytics category. It helps us understand visits, pages viewed, interactions and general device and browser characteristics so we can improve the site. It also records clicks on the email link; it cannot access the message you write or its contents.

The legal basis is your consent (Article 6(1)(a) GDPR). Before you accept, Tag Manager is not loaded and no analytics data is sent to Google. We do not use personalised advertising, remarketing, Google Ads or Meta Pixel. We do not send names, email addresses or correspondence as analytics parameters.

You can withdraw or change consent at any time using “Cookie settings” in the footer. Withdrawal does not affect the lawfulness of earlier processing or prevent you from using the website.

4. Technical operation

When you request a page, the hosting provider needs to process technical connection data, such as your IP address and browser request, to deliver it and protect its infrastructure. This processing serves the legitimate interest in keeping the website available and secure; it is separate from optional analytics. Your cookie preference is stored only in your browser.

5. Retention

We keep enquiries for as long as necessary to respond and complete any follow-up. If a professional relationship is established, data is retained throughout that relationship and afterwards for the statutory periods applicable to obligations and potential liabilities, with restricted storage where required. We do not retain enquiries indefinitely without an ongoing purpose.

The analytics configuration limits user and event data retention to two months, without resetting it following new activity. Aggregated statistical reports may be kept longer without the individual detail of those events. The consent preference and analytics cookies have a configured maximum lifetime of 180 days; browsers may shorten it.

6. Providers and international transfers

We use Netlify to host the website and Google Workspace for email. Google Ireland Limited provides Google Analytics and Tag Manager. These providers may process data to deliver their services under the applicable agreements and terms. We do not sell your data. Data may also be disclosed to authorities where legally required.

Providers’ infrastructure may involve processing outside the European Economic Area, including the United States. Transfers must have the safeguards required by Chapter V GDPR: an adequacy decision where applicable, or standard contractual clauses and any necessary supplementary measures. You can request information about the applicable safeguards by email.

Further information is available in the privacy policies of Netlify and Google.

7. Your rights

You can request access, rectification, erasure, restriction, portability and objection where applicable, and withdraw consent, by writing to the email above. Please identify the right you wish to exercise and provide the information needed to locate your request. We will ask for further information to verify your identity only if there are reasonable doubts.

We will generally respond within one month; the GDPR allows this period to be extended in certain cases, and we will inform you if this applies. You may lodge a complaint with the Spanish Data Protection Agency, particularly if you are dissatisfied with our response.

8. Decisions and updates

We do not make automated decisions with legal effects or build profiles for personalised advertising. This policy will be updated if processing changes. It is drafted in accordance with the GDPR and Spanish Organic Law 3/2018 (LOPDGDD). The Spanish version is the legal reference version.