At YAG Comunicación we take the protection of the personal data you share with us seriously. This policy explains clearly what data we collect, what we use it for, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), which apply to YAG Comunicación as a Spanish-domiciled data controller.
1. Data controller
- Name: Yeray Álamo González
- Spanish tax ID (NIF): 78569611R
- Trading name: YAG Comunicación
- Registered address: Tenerife, Canary Islands, Spain
- Email: [email protected]
- Phone: +34 680 762 331
2. Purpose of processing
At YAG Comunicación we process your personal data for the following purposes, depending on your relationship with us:
- Contact form: to handle your enquiry, respond to you and, where applicable, prepare a commercial proposal for the services you request.
- Clients: to provide contracted services, issue invoices, maintain the contractual relationship and comply with legal obligations (commercial, tax and accounting).
- Marketing: to send you commercial communications about our services when you have given express consent or where a prior contractual relationship exists.
- Web analytics: to understand how the Website is used through self-hosted analytics cookies (Matomo), always subject to your prior consent.
We do not create profiles based on automated decisions that produce legal effects on the data subject.
3. Legal basis for processing
| Processing activity | Legal basis |
|---|---|
| Contact form | Consent of the data subject (Art. 6(1)(a) GDPR) |
| Provision of services to clients | Performance of a contract (Art. 6(1)(b) GDPR) |
| Invoicing and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Commercial communications | Consent or legitimate interest (Art. 6(1)(a) or 6(1)(f) GDPR) |
| Web analytics | Consent (Art. 6(1)(a) GDPR + Art. 22.2 LSSI-CE) |
4. Data retention period
The personal data provided will be kept for as long as necessary to fulfil the purpose for which it was collected, and within the legally established periods:
- Enquiries and contacts: 2 years from the last contact.
- Contracts and invoices: for the duration of the contractual relationship and, once it has ended, for the legal limitation periods (up to 6 years for commercial and tax obligations).
- Commercial communications: until the user withdraws consent.
- Cookies: as set out in the Cookie Policy.
5. Recipients and data processors
We do not share your data with third parties except where legally required. We do, however, use suppliers that act as data processors under contracts governed by Article 28 GDPR:
- Hetzner Online GmbH (Germany, EU): hosting and server infrastructure.
- Vercel Inc. (USA): frontend hosting, under the EU-US Data Privacy Framework adequacy decision.
- Cloudflare, Inc. (USA): CDN and security, under the EU-US Data Privacy Framework adequacy decision.
- Google Ireland Ltd. (Ireland, EU): professional email services (Google Workspace), where applicable.
- Matomo Analytics, self-hosted on our own servers (Hetzner, EU), with no transfer to third parties.
We do not carry out international data transfers outside mechanisms with adequate safeguards (adequacy decisions or Standard Contractual Clauses).
6. Your rights
You can exercise the following rights by emailing [email protected] stating your name and the right you wish to exercise, together with a copy of an identity document:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure (“right to be forgotten”): have your data deleted when it is no longer necessary.
- Objection: object to processing on grounds relating to your particular situation.
- Restriction: restrict processing in certain circumstances.
- Portability: receive your data in a structured, commonly used, machine-readable format.
- Not to be subject to automated decisions with legal effects.
You have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es), if you believe that the processing does not comply with applicable regulations.
7. Security measures
YAG Comunicación applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- TLS 1.3 encryption on all communications with the website.
- Two-factor authentication on internal systems.
- Encrypted, automated backups.
- Access logging for systems that process personal data.
- Ongoing staff training on data protection.
8. Minors
YAG Comunicación's services are aimed at adults. We do not knowingly collect personal data from minors under 14. If we discover that we have received data from a minor under 14 without verifiable parental or guardian consent, we will delete it without delay.
9. Amendments
YAG Comunicación reserves the right to amend this Privacy Policy to adapt it to legislative or case-law developments, as well as industry practice. Where this happens, the changes introduced will be announced on this page with reasonable notice before they take effect.