Costa Tiling
Free quote
Services
Call Email

Privacy policy

[Template — have this reviewed before publishing.]

This policy explains what personal data we process when you visit costatiling.com or get in touch with us, what we use it for and what rights you have. It is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

  • Controller: [Name or company name], trading as Costa Tiling
  • Tax ID (NIF/CIF): [NIF/CIF]
  • Address: [Registered address]
  • Email: costatilingspain@gmail.com
  • Phone: +34 663 39 46 43

2. What data we process

Contact and quote form. When you write to us through the form, we collect:

  • your name;
  • your email address;
  • your phone number;
  • the type of project;
  • the message you write to us;
  • any photographs you choose to attach, which are optional.

Please make sure your photos show only the space you want to renovate and do not include people, documents or other unnecessary personal information. We do not need special categories of data (for example, health data), so please do not send them to us.

Email, phone and WhatsApp. If you contact us directly by email, phone or WhatsApp, we process the data you give us in that communication, such as your name, your phone number and the content of your messages.

Technical data. Like any web server, our hosting provider's server may log technical data about visits (IP address, browser type, date and time of access) for security and operational reasons. We do not use analytics or advertising tools, and we do not profile visitors.

3. What we use your data for

  • To answer your enquiry.
  • To arrange the site visit and prepare the quote you ask for.
  • To follow up on that request and, if you hire us, to manage our relationship with you as a client (scheduling, communication during the work and invoicing).
  • To keep the website secure.

We will not send you marketing communications or newsletters, and we do not make automated decisions that affect you.

4. Legal basis

  • Your consent (article 6(1)(a) GDPR), which you give when you submit the form or contact us on your own initiative. You may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Steps taken at your request before entering into a contract (article 6(1)(b) GDPR), such as the site visit and preparing the quote.
  • If you become a client, performance of the contract (article 6(1)(b) GDPR) and compliance with legal obligations, such as tax and accounting obligations (article 6(1)(c) GDPR).
  • Our legitimate interest in keeping the website secure (article 6(1)(f) GDPR), in the case of the server's technical data.

5. How long we keep your data

  • If we do not go ahead with a contract, we keep the data from your request for [retention period, e.g. 12 months] from our last contact, in case you want to pick up the project again, and then delete it.
  • If you hire us, we keep it for as long as the relationship lasts and afterwards for the periods required by law, for example for tax purposes or liability for the work.
  • Server technical logs are kept for the period set by the hosting provider.

When the data is no longer needed, it will be deleted or, where the law requires, kept blocked until any possible liabilities have expired.

6. Recipients

We do not share your data with third parties, except where required by law (for example, with the tax authorities or with courts when they request it).

For the website and email to work, some providers have access to the data as data processors, solely to provide their service to us and following our instructions:

  • Web hosting: Hostinger, which hosts the website, and whose servers send the form messages to our inbox.
  • Email: Google (Gmail), through which we receive form messages and reply to enquiries.

If you choose to write to us on WhatsApp, that service is provided by WhatsApp, which processes your data as a controller under its own terms and privacy policy.

7. International transfers

We do not transfer data outside the European Economic Area (EEA) on our own initiative. Some providers, such as our email or hosting provider, may process data on servers located outside the EEA or belong to corporate groups based outside it. In that case, the transfer is covered by the safeguards provided for in the GDPR, such as an adequacy decision of the European Commission or the standard contractual clauses it has approved. Location of the website's server: [Hostinger data-centre location].

8. Your rights

You may exercise the following rights at any time:

  • Access: to know whether we process your data and to obtain a copy.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure: to ask us to delete your data, for example when it is no longer needed.
  • Objection: to object to processing based on our legitimate interest.
  • Restriction: to ask us to suspend processing in certain cases, for example while the accuracy of your data is being checked.
  • Portability: to receive the data you gave us in a structured, commonly used format, or to have us send it to another controller, where processing is based on your consent or on a contract.
  • Withdrawal of consent: at any time, without affecting earlier processing.

How to exercise them. Email us at costatilingspain@gmail.com with the subject "Data protection", or write to us at [Registered address], stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month, which may be extended by two further months in complex cases; if so, we will let you know.

9. Complaints to the supervisory authority

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) through its website, www.aepd.es. We would appreciate it if you told us first, in case we can resolve it directly.

10. Security

We apply reasonable technical and organisational measures to protect your data against loss, unauthorised access or misuse, such as encrypting the website connection (HTTPS) and restricting access to the mailbox where requests are received.

11. Minors

This website is not aimed at children under 14. If you are under that age, please do not send us personal data without the consent of your parents or guardians.

12. Changes to this policy

We may update this policy if the website, our providers or the law change. The version in force is always the one published on this page.

Last updated: [date].