This is a courtesy translation. In case of discrepancy, the Spanish version (Política de privacidad) prevails.

Last updated: 30 September 2026.

Your privacy matters to me. Here I explain what personal data I collect on this website, what I use it for and what rights you have. I encourage you to read it before sending me your data.

My principles regarding your privacy:

I never ask for personal data I do not need to deal with your request.
I never share your data with anyone, except where required by law or with your authorisation, beyond the providers I need for the website to work (listed below).
I never use your data for a purpose other than those explained here.

This policy complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI).

Data controller

Controller: Sergio Pérez Alonso (Lupaseo)
NIF (Spanish tax ID): 76999750M
Registered address: C/ Estrada Porto, 23, Mougás, 36309 Oia (Pontevedra), Spain
Email: [email protected]
Activity: web design, SEO, online advertising management and development of digital tools for businesses

Principles I apply to your information

Lawfulness, fairness and transparency: I explain in advance what I use your data for and on what legal basis.
Data minimisation: I only ask for the data that is essential for your request.
Storage limitation: I keep it only for as long as necessary and tell you for how long.
Integrity and confidentiality: I apply measures to prevent unauthorised access, loss or misuse.

How I obtain your data

The contact form on the website.
The messages you send me by WhatsApp or email and the calls you make to me.
The WhatsApp button on the Google Ads campaign page, which asks for your name and telephone number before opening the conversation.
Your browsing on the website, only if you accept analytics or advertising cookies (see the cookie policy).

What I use your data for

Contact form

I ask for your name, an email address or telephone number and your message. I use them to reply to your enquiry and, if you ask me to, to prepare a proposal for you. I do not use them to send you advertising.

WhatsApp, email and telephone

If you write to me or call me directly, I use the data you provide (name, number or address and the content of the message) to reply to you, for the same purpose as the form.

WhatsApp button on the campaign page

On the page my Google ads lead to, the WhatsApp button is a ToChat service that asks for your name and telephone number before opening the conversation. This lets me contact you even if the WhatsApp message is never actually sent, and know that the contact came from the campaign. Same use as the form.

Website security

To protect the form from spam, Cloudflare Turnstile analyses technical data from the browser (such as the IP address) and checks that the person sending it is a human.

Measuring visits and ads

Only if you accept the corresponding cookies, I use Google Analytics to know how many visits arrive and which pages are read, and Google Ads, Meta and OpenAI to measure which ads bring in enquiries and to show ads to people who have already visited the website. I use Google Tag Manager to manage these tools according to your choice.

Legal basis

Your consent, when you send me the form, write to me or accept cookies. You can withdraw it at any time.
Taking pre-contractual steps, when you ask me for a proposal or quote.
Legitimate interest in protecting the website against spam and attacks (Cloudflare).
Compliance with legal obligations, such as tax obligations, if we end up working together.

What type of data I process

Identification and contact data (name, email, telephone), the content of your messages and, if you accept cookies, browsing data. I do not process special categories of data.

How long I keep it

Enquiries that do not lead to a project: for the time needed to deal with them and, at most, 12 months.
Clients: for as long as the business relationship lasts and, afterwards, for the periods required by law (for example, tax and commercial periods).
Cookies: the period of each one, which you will find in the cookie policy.

Recipients and providers

I do not sell, rent or transfer your data. For the website to work I use providers that process it on my behalf, under contract and with data protection safeguards:

Cloudflare, Inc.: website hosting, security and anti-spam protection of the form (Turnstile).
Google Ireland Limited: the spreadsheet where form messages are stored and the email account where I receive the notifications; and, only if you accept the corresponding cookies, Google Analytics, Google Ads and Google Tag Manager.
Resend, Inc.: sending the form emails: the notification I receive and the confirmation you receive if you leave an email address.
Meta Platforms Ireland Limited: measuring ads on Facebook and Instagram, only if you accept advertising cookies.
OpenAI: measuring ads, only if you accept advertising cookies.
WhatsApp Ireland Limited: if you write to me on WhatsApp.
ToChat: WhatsApp button on the Google Ads campaign page.
Email provider for lupaseo.es, where I receive and keep enquiries.

International transfers

Some of these providers (Cloudflare, Google, Resend, Meta and OpenAI) are US companies or belong to groups headquartered in the US, so your data may reach that country. These transfers are covered by the EU-US Data Privacy Framework for participating companies and, failing that, by the standard contractual clauses approved by the European Commission.

Your rights

At any time you can ask me to:

Confirm whether I process your data and give you access to it.
Rectify any data that is inaccurate or erase it when it is no longer necessary.
Restrict its processing: in that case I will only keep it to exercise or defend against claims.
Object to processing on grounds relating to your particular situation.
Data portability: receive the data you gave me in a structured, commonly used format, or have me send it to another controller, when the processing is based on your consent or on a contract and is carried out by automated means.
Withdraw your consent, without affecting processing carried out before.

Write to me at [email protected] stating which right you wish to exercise. I will reply within one month at most. If you believe I have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Minors

This website is aimed at businesses and professionals. If you are under 14, do not send personal data through it: processing your data would require the consent of your parents or guardians.

Confidentiality and security of data

I undertake to treat your data confidentially and to apply the measures needed to prevent its alteration, loss or unauthorised access. The website runs on HTTPS, so data travels encrypted between your browser and the server.

People who work with me on a project and have access to personal data are bound by a duty of confidentiality. If there were a security breach affecting your data, I would notify the Spanish Data Protection Agency within 72 hours and, if it posed a high risk to you, I would also inform you.

Accuracy of data

You are responsible for ensuring that the data you send me is true and up to date. Please let me know if it changes.

Giving and withdrawing consent

By sending me your data you declare that you have read this policy and accept the processing on the terms described. You can withdraw your consent at any time by writing to me at [email protected], and your cookie consent from the "Cookie settings" link in the footer. Withdrawal does not have retroactive effect.

Commercial communications

In accordance with the LSSI, I do not send commercial communications by email or other electronic means that you have not expressly requested or authorised, and when I do send them they will be identified as such.

Changes to this policy

I may update this policy to adapt it to legal changes or changes in how the website works. The version in force, with its date, will always be published here.

Privacy policy