Quote
Menu

Privacy policy

Last updated:

This policy explains what personal data we process on this website, why, for how long and what rights you have. It is based on the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). The Spanish version of this text prevails.

Who is the controller

  • Controller: Iker Xavier Salgado Santana, trading as SSAI Company
  • Tax ID (NIF): 50628376V
  • Address: Calle Marcelino Castillo 18, 28047 Madrid, España
  • Email: hola@ssaicompany.com
  • Phone: +34 640 723 796

We have not appointed a data protection officer because, given our activity, the law does not require one. For any question about your data, write to us at hola@ssaicompany.com.

What data we process, why and on what basis

If you ask for a quote through the form

  • Data: your name, your email and/or phone number, how you would like us to reply, the type of business and project you choose and your message.
  • Why: to reply to you and, if you wish, to prepare your quote and discuss it with you. We do not use it to send you advertising.
  • Legal basis: your own request. We process the data to take steps, at your request, prior to a possible contract (article 6(1)(b) GDPR).
  • How long: 12 months from when you write to us; after that it is deleted automatically. If we end up working together, the necessary data becomes part of that relationship and is kept for as long as it lasts and for the periods required by tax and commercial law.

Each message reaches us by email. We also get a Telegram notification on our phones that does not include any of your data: it only says that a new contact has arrived and the type of business.

If, instead of sending the form, you choose to open WhatsApp or your email program with the message ready, you send it yourself from your own account. The website does not keep it, and that message is governed by the terms of WhatsApp (Meta) or of your email provider.

If you email or call us

We use your data to reply to you, on the same basis (your request), for as long as the conversation lasts. If we do not reach an agreement, we keep it for no more than 12 months.

If you try the booking system demo

The demo is a made-up studio. What you type when booking is kept on the booking server only until that night, when the demo is reset and everything is deleted. No notifications are sent to anyone. Please use made-up details. Legal basis: our legitimate interest in letting you try the system before signing up (article 6(1)(f) GDPR).

To make the website work and keep it secure

When you visit the website, your browser sends technical data such as your IP address, the type of browser and the page you request. We only use it to show you the website and to protect it from abuse:

  • the hosting provider keeps technical access logs for a limited time, for security;
  • neither the form nor the booking system stores your IP address: to stop mass submissions and abuse, they use an encrypted, irreversible fingerprint of it for one hour at most.

Legal basis: our legitimate interest in keeping the website available and secure (article 6(1)(f) GDPR).

Visit statistics

We measure visits with Umami Cloud, from Umami Software, Inc. (United States), which stores our statistics on its servers in the European Union. It does not use cookies, stores nothing in your browser and keeps no data that identifies you: it only gives us aggregated figures, such as the most viewed pages, the country or the type of device. Your IP address is only used for a moment, for security and to work out the approximate country, and it is not stored. Statistics are kept for 6 months.

Legal basis: our legitimate interest in knowing which pages are used, in order to improve them (article 6(1)(f) GDPR). As Umami is a United States company, its data processing agreement includes the European Commission’s standard contractual clauses.

If you book on one of our clients’ websites

Some businesses use our booking system on their own websites. If you book there, that business is the controller of your data. We only process it on their behalf, as a processor, following their instructions. To exercise your rights or find out more, check their privacy policy or contact them directly.

Who we share your data with

We do not sell or give your data to anyone, unless a law requires us to. We are helped by providers who process it on our behalf, as processors, under contract and only to provide their service to us:

  • Hostinger International Ltd. (Cyprus, European Union): hosting of the website and of the form and booking server, on servers in the European Union, and email service.
  • Backblaze, Inc. (United States): backups, stored in its Amsterdam data centre (European Union). They leave our server already encrypted, Backblaze does not have the key to open them, and they are deleted automatically after 14 days.
  • Umami Software, Inc. (United States): visit statistics without cookies or data that identifies you, stored on servers in the European Union.

Telegram (Telegram Messenger Inc.) only receives the internal notifications sent to our phones, and they do not include any of your data.

International transfers

Umami and Backblaze are United States companies; our other providers are European Union companies. Backblaze participates in the EU-U.S. Data Privacy Framework, and its data processing agreement includes the European Commission’s standard contractual clauses. If another provider had to process your data outside the European Economic Area, it would do so with the safeguards required by the GDPR, such as those same clauses. This is what Hostinger’s data processing agreement provides for, for example.

Your rights

You can ask us at any time to:

  • access your data and find out what we do with it;
  • correct it if it is inaccurate;
  • delete it when it is no longer needed;
  • restrict its use or object to us processing it;
  • receive it in a format you can take elsewhere (portability).

Write to us at hola@ssaicompany.com saying which right you want to exercise. If we need to check that it is you, we will ask you to prove it. We will reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Children

Our services are for businesses and professionals. If you are under 14, please do not send us your data.

Changes to this policy

If what we do with data changes, we will update this page and its date.