Privacy policy.

The controller of your data is:

Owner

Andrés Gil Shapcott, known professionally as Andrew Shapcott

Trading name

Shapcott’s & Co.

Activity

Web development

Legal form

Individual (natural person): Andrés Gil Shapcott

Address

La Nucía, Alicante (Spain)

Email

privacidad@shapcotts.com

Website

www.shapcotts.com

We have not appointed a Data Protection Officer because, given our size and activity, the law does not require one (Art. 37 GDPR and Art. 34 LOPDGDD). For anything about your data, write to privacidad@shapcotts.com.

We process your data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI”).

If you write to us using the form. The form does not send anything to this website or store it: it opens your email app with the message already written, and you decide whether to send it. If you send it, we receive your name, your business and your website (if you include them), what you need, your message and your email address.

If you email or call us directly. We receive the details you give us: your email address or phone number and whatever you tell us.

If we work together. We also process the data needed for the quote, the contract and the invoice, and any logins to your website or domain that you give us so we can do the work.

When you visit the website. As with any website, the server hosting it logs technical data about each visit (IP address, browser, date and page) to keep it running and to detect attacks. We do not use this data to identify you or to build profiles.

Do you have to give us your data? No. But without a name, a way to reply to you and an idea of what you need, we cannot answer you or prepare a quote. If you hire us, billing details are required by law: without them we cannot provide the service. Your business name and website are optional.

We ask for the minimum. You do not need to give us any sensitive data (health, political opinions…), and we ask you not to.

Each use has a legal basis that allows it:

• Replying to your message and preparing a quote

  At your request, as a step prior to entering into a possible contract (Art. 6(1)(b) GDPR).

• Building and maintaining your website if you hire us, and invoicing you

  Performance of the contract (Art. 6(1)(b) GDPR) and our tax and accounting obligations (Art. 6(1)(c) GDPR).

• Keeping the website secure and protecting it from attacks

  Legitimate interest (Art. 6(1)(f) GDPR): making sure the website works and is not used to cause harm. You can object, and we will consider your objection.

• Counting visits in aggregate, without cookies, to improve the website

  Legitimate interest (Art. 6(1)(f) GDPR): knowing whether the website is useful. We only see totals and do not identify you. You can object.

Data about your own customers. When we design or maintain your website, we may see data about your own customers (for example, messages from your contact form or bookings). In that case you are the controller and we act as your processor: we only use that data to do the work you ask us to do, and we put this in writing in a data processing agreement (Art. 28 GDPR).

We do not send advertising or newsletters. If we ever do, we will ask for your permission first and every message will let you unsubscribe. We do not make automated decisions about you or build profiles.

If we don't end up working together: we keep the conversation for a maximum of 12 months in case you want to pick it up again, and then we delete it.

If you are a client: for as long as the service lasts. After that, we keep only what the law requires us to: accounting records and invoices, for six years (Art. 30 of the Spanish Commercial Code).

Server logs: for the period set by Cloudflare, our hosting provider, in its privacy policy, only to keep the website running and protected.

When we erase data that the law requires us to keep for a period, it is first blocked: set aside, not used, and available only to courts and competent authorities for as long as any liability arising from it can be claimed. Once that period ends, it is deleted (Art. 32 LOPDGDD).

We do not sell your data or pass it on to third parties. The only parties with access are the providers we need in order to work, acting as processors under a contract that requires them to protect your data and use it only for that purpose:

• Email: Cloudflare, Inc. (receives messages sent to @shapcotts.com and forwards them) and Google LLC (Gmail, where we read and reply to them).
• Website hosting: Cloudflare, Inc. (Cloudflare Workers).
• Tax and accounting advisers, if you are a client, for invoicing.

We may also have to disclose data to the tax authorities, courts or other authorities where the law requires.

Outside Europe. Cloudflare and Google are US companies, so your data may be processed outside the European Economic Area. They do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework (a European Commission adequacy decision) and standard contractual clauses (Arts. 45 and 46 GDPR). You can ask us for a copy of those safeguards.

This website does not use cookies and does not store anything in your browser. It has no advertising pixels or third-party videos or maps, and its fonts are served from our own server. That is why we do not show you a cookie banner (Art. 22(2) LSSI).

Visit statistics. We use Cloudflare Web Analytics to see how many visits the website gets, which pages are read, from what type of device and country, and which website you came from. We only see totals: it does not use cookies, does not store anything in your browser and does not identify you or track you across websites. We do this on the basis of our legitimate interest in knowing whether the website is useful and improving it (Art. 6(1)(f) GDPR).

If we ever add a tool that uses cookies, we will ask for your permission before turning it on and explain it here.

You can exercise these rights over your data at any time (Arts. 15 to 22 GDPR):

• Access: find out what data we hold about you
• Rectification: correct any data that is wrong
• Erasure: have your data deleted
• Objection: ask us to stop using it
• Restriction: have us keep it without using it
• Portability: receive it in a file

Write to privacidad@shapcotts.com with the subject “My data” and tell us what you need. It is free of charge. We will reply within one month at most; if the request is complex, that period may be extended by two further months, and we will let you know within the first month (Art. 12 GDPR). If we are not sure it is you, we will ask only for what we need to check.

We do not currently process any data on the basis of your consent. If we ever do, you will be able to withdraw it at any time, without affecting the lawfulness of anything done before you withdrew it.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es. We would appreciate it if you told us first, so we can try to put it right.

We apply appropriate technical and organisational measures to protect your data (Art. 32 GDPR): the website runs over an encrypted connection (HTTPS), we protect access to your website and to our email with strong passwords, and within Shapcott’s & Co. only its owner, Andrés Gil Shapcott, has access to your data.

If there were ever a security breach putting your data at risk, we would notify the Spanish Data Protection Agency and, if the risk is high, you as well (Arts. 33 and 34 GDPR).

Our services are for businesses and professionals. We do not knowingly collect data from children under 14 (Art. 7 LOPDGDD).

If we make any significant change to this policy, we will publish it here with the date of the update and, if you are a client, we will let you know by email.

Details of who is behind this website are in the legal notice.