Data controller
Controller: Pedro Mateo (ByteBalear).
Contact details: bytebalear@gmail.com · Phone/WhatsApp: +34 685 825 254.
No Data Protection Officer is required given the nature of the processing activities.
Legal framework
Privacy policy
This policy explains how personal data collected through bytebalear.es is processed in compliance with GDPR (EU) 2016/679 and the Spanish LOPDGDD 3/2018.
Data collected and source
Data provided directly via forms: name, email, phone, company information, goals, budget, preferred channels and free-text notes.
Browsing data: IP address, device identifiers and aggregated analytics, only when consent has been granted through the cookie banner.
Purposes and lawful bases
Responding to enquiries, audit requests and proposals: consent (Art. 6.1.a GDPR) and pre-contractual measures (Art. 6.1.b GDPR).
Sending updates, resources or promotional communications: explicit consent with opt-out available in every message.
Aggregated analytics to improve the service: legitimate interest pursued by the controller, limited to anonymised data or subject to prior consent for analytics cookies.
Recipients and processors
Third-party services involved: Airtable (lead capture), Google Workspace (email), Notion (project follow-up), Formspree (forms) and Vercel (hosting).
Appropriate safeguards are in place through data processing agreements and, where applicable, Standard Contractual Clauses or Data Privacy Framework certification.
Retention
Commercial data is kept while the relationship remains active or until the user requests deletion.
Accounting and invoicing data is stored for the statutory periods required under Spanish tax regulations.
Email threads and project notes are reviewed annually to remove outdated information.
User rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by emailing bytebalear@gmail.com.
If you believe your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
No automated individual decisions or profiling with legal effects are carried out.
Security measures
Technical measures include TLS encryption, role-based access, strong passwords and multi-factor authentication. Organisational measures include confidentiality agreements and documented procedures.
Security incidents will be reported to users and the supervisory authority when legally required.
Children’s data
Services are not targeted at individuals under 18. If we become aware of personal data belonging to a minor, we will delete it immediately.