Privacy policy

Last updated: 12 October 2026

This English version is provided for information only. In the event of any discrepancy, the Spanish version prevails.

This policy explains what personal data we process, why, and what rights you have (Arts. 12 and 13 of Regulation (EU) 2016/679, the General Data Protection Regulation – GDPR, and Art. 11 of Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales – LOPDGDD, the Spanish Data Protection and Digital Rights Act).

1. Data controller

Arturo Jornet Espí (“Cumbreo”) · Tax ID (NIF) 48414534V · C/ Ademuz, 19, piso 3, puerta 9, 46180 Benaguasil (Valencia), Spain · hola@cumbreo.com · +34 672 864 386 (Art. 13.1.a GDPR).

We are not required to appoint a data protection officer (Art. 37 GDPR and Art. 34 LOPDGDD).

2. What data we process and where it comes from

Enquiries: name, email, your website URL, the service you are interested in and your message.
Clients: name or company name, tax ID, address, email, phone and, for companies, the contact person (Art. 19 LOPDGDD).
Technical data: IP address and connection logs, kept by the hosting provider for security purposes.

Data marked as required is necessary to deal with your request; if you do not provide it, we will not be able to reply (Art. 13.2.e GDPR). We do not process special categories of data (Art. 9 GDPR). Our services are aimed at adults and we do not knowingly process data of children under 14. If we discover that a minor has sent us their data, we will delete it (Art. 8 GDPR and Art. 7 LOPDGDD).

3. Purposes and legal basis (Art. 13.1.c GDPR)

Purpose	Legal basis
Answering your request and preparing any audit or quote you ask for	Pre-contractual steps at your request (Art. 6.1.b GDPR). For general enquiries, legitimate interest (Art. 6.1.f GDPR)
Providing the contracted services and managing the client relationship	Performance of a contract (Art. 6.1.b GDPR)
Invoicing and tax and accounting obligations	Legal obligation (Art. 6.1.c GDPR, in conjunction with Art. 29 of the LGT (Spanish General Tax Act), Art. 25 of the CCom (Spanish Commercial Code) and Real Decreto 1619/2012 (Spanish Invoicing Regulation))
Communications about services similar to those contracted (clients only)	Legitimate interest (Art. 6.1.f GDPR and Art. 21.2 of the LSSI-CE (Spanish Information Society Services and E-commerce Act))
News for non-clients, only if they tick the box	Consent (Arts. 6.1.a and 7 GDPR and Art. 21.1 LSSI-CE)
Website security and defence against claims	Legitimate interest (Art. 6.1.f GDPR and Recital 49 GDPR)

Legitimate interest: we rely on it to reply to you, to inform clients about similar services, and for security and legal defence (Art. 13.1.d GDPR).
Unsubscribing: every commercial communication lets you unsubscribe easily and free of charge (Art. 21.2 LSSI-CE and Art. 21.2 GDPR).
No automated decisions: we do not make decisions based solely on automated processing, nor do we carry out profiling (Arts. 13.2.f and 22 GDPR).
AI: we do not enter personal data from forms into artificial intelligence tools (Art. 5.1.c GDPR, data minimisation).

4. Retention (Arts. 5.1.e and 13.2.a GDPR)

Enquiries that do not lead to a contract: up to one year from the last contact.
Clients: for the duration of the relationship and, afterwards, blocked (Art. 32 LOPDGDD):

- 6 years for accounts, books and invoices, from the last entry (Art. 30 CCom);

- for tax purposes, until tax obligations become time-barred: 4 years from the end of the filing period (Arts. 66 and 67 LGT and Art. 19 of Real Decreto 1619/2012).

While blocked, data is only used if requested by judges, courts or public authorities.

Unsubscribes from commercial communications: we keep your email solely to avoid contacting you again (Art. 23.4 LOPDGDD).
Server technical logs: [PERIOD], depending on the hosting provider.

5. Recipients and data processors (Arts. 13.1.e and 28 GDPR)

We do not disclose your data to third parties unless required by law (for example, to the Agencia Tributaria, the Spanish Tax Agency: Art. 93 LGT). The following providers access it as data processors, under a contract compliant with Art. 28.3 GDPR:

Email: Microsoft 365, contracted through GoDaddy (Microsoft Ireland Operations Ltd., Ireland; possible transfers to the USA covered by the EU-U.S. Data Privacy Framework).
Hosting of this website: [HOSTING PROVIDER, country].
Form submission: [FORM PROVIDER, country].
Clients’ domain registration: GoDaddy Operating Company, LLC (USA).
Accountancy firm and invoicing software, for accounting and tax purposes. The bank receives payment data as an independent controller.

International transfers (Arts. 13.1.f and 44 to 46 GDPR): [If all providers are in the EEA: “We do not carry out international data transfers.”] [If any is in the USA: “[PROVIDER] may process data in the United States. The transfer is covered by Commission Implementing Decision (EU) 2023/1795 on adequacy (EU-U.S. Data Privacy Framework, Art. 45 GDPR) or, failing that, by the Commission’s standard contractual clauses (Art. 46.2.c GDPR). You may ask us for a copy of the safeguards.”]

6. Data on our clients’ websites

When we host, maintain or manage the content of a client’s website, we process its users’ data as a processor on behalf of that client, who is the controller. We do so under the data processing agreement signed with them (Art. 28 GDPR and Art. 33 LOPDGDD). Users should contact the client to exercise their rights (Art. 28.3.e GDPR).

7. Your rights

What you can exercise: access, rectification, erasure, restriction, portability and objection (Arts. 15 to 21 GDPR and Arts. 13 to 18 LOPDGDD).
Consent: you may withdraw it at any time, without affecting processing carried out beforehand (Arts. 7.3 and 13.2.c GDPR).
How: email hola@cumbreo.com or write to our postal address, stating which right you are exercising. It is free of charge (Art. 12.5 GDPR).
Identity: if there is reasonable doubt about your identity, we may ask you to prove it (Art. 12.6 GDPR).
Time limit: we will reply within one month, extendable by two further months for complex cases (Art. 12.3 GDPR). This time limit applies to data protection rights; complaints about our services follow the time limit set out in the terms and conditions.
AEPD: you may lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es), C/ Jorge Juan, 6, 28001 Madrid (Arts. 13.2.d and 77 GDPR).

8. Security

We apply technical and organisational measures appropriate to the risk: HTTPS, strong authentication, restricted access and providers offering adequate guarantees (Arts. 25 and 32 GDPR).

9. Changes

If we change this policy, we will publish the new version with its date. If the change is significant, we will notify clients by email (Art. 12.1 GDPR).