Privacy Policy

At a glance

Controller	David Bonal Sánchez (IS Margin)
Purpose	Replying to messages, keeping the website secure and, if authorised, obtaining aggregated usage statistics.
Legal basis	Your consent for the contact form and Google Analytics, and the legitimate interest in protecting the website.
Recipients	Data is not sold. Hosting, organisation, messaging and email providers are involved and, if you accept analytics, Google Analytics.
Rights	Access, rectification and erasure of your data, and the other rights explained below.

1. Who is the data controller?

• Identity: David Bonal Sánchez, trading as IS Margin
• Tax ID (NIF): 12470114C
• Postal address: Lugar Cabanela 9, Villarente, Abadín (Lugo), Spain
• Email: hola@ismargin.com

2. What data do we process and why?

• Contact form: name, business name (optional), email address and your message. They are used only to reply to your enquiry and, if you ask for one, to prepare a quote. Each message is stored in the owner’s contacts database (in Notion) and a notification is sent to the owner’s phone (via Telegram) so it can be answered promptly.
• Email and phone: the details you give us when you write or call, for the same purpose.
• Browsing data: when you visit the website, the hosting provider technically logs data such as your IP address and browser, which are needed to serve the pages and protect them from abuse. In addition, the IP address is used temporarily in memory to apply a 15-minute window in the access-code area and a 10-minute window in the contact form. It is not added to the contacts database.
• Optional analytics: if you accept measurement cookies, Google Analytics processes information about visited pages, interactions, device and browser type and approximate location to produce usage statistics. The details you enter in the contact form are not sent to Analytics and no first-party user ID is used. Google states that the IP address is used during collection to obtain geographical data and is then discarded without being logged or stored.

Your data is not used for commercial profiling or automated decisions, and no marketing communications are sent. Advertising features, Google signals and ad personalisation remain disabled.

3. What is the legal basis?

• For the contact form, your consent, given by ticking the box before sending it.
• For Google Analytics, your consent, which you may grant or reject in the cookie notice and later withdraw from the Cookie Policy.
• If the conversation leads to a project, the performance of a contract or pre-contractual steps taken at your request.
• For browsing data, the legitimate interest in keeping the website available and secure.

4. How long do we keep your data?

• Contact messages: for as long as the conversation lasts and, afterwards, for the legal limitation periods for possible liabilities. If no project follows, they are deleted within a reasonable time.
• Clients: for the duration of the professional relationship and the periods required by tax and commercial law.
• Security logs (access-code area and form): they are held temporarily in memory to apply control windows of 15 and 10 minutes, respectively, and are not added to the contacts database.
• Google Analytics: user-level and event-level data is retained for 2 months. _ga cookies may remain for up to 2 years unless you withdraw consent or delete them sooner. Aggregated statistical reports are not subject to the same period.

5. Who receives your data?

Data is not sold or disclosed for purposes unrelated to those described. The following providers help us provide the service, under the conditions and safeguards stated for each one:

• Vercel Inc. (website hosting), based in the United States. International transfers rely on its certification under the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses approved by the European Commission.
• Notion Labs, Inc. (database where contact form messages are stored), based in the United States. International transfers are governed by the Standard Contractual Clauses included in its data processing agreement.
• Telegram (notification to the owner’s phone with the name, business name if provided, email address and message). For users in the European Economic Area, Telegram stores data in data centres in the Netherlands and has an EU representative under article 27 of the GDPR.
• Email providers, to answer your messages.
• Google Ireland Limited and its group companies (Google Analytics, optional website usage measurement), only if you accept. Google may process data outside the European Economic Area and uses, where applicable, the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

6. What are your rights?

You have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data when, among other reasons, it is no longer needed.
• Restrict processing in certain circumstances.
• Object to processing on grounds relating to your particular situation.
• Request the portability of your data.
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to hola@ismargin.com or to the postal address above, with proof of identity. You can withdraw Analytics consent from the Cookie Policy. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe the processing does not comply with the law.

7. Accuracy of data

Users guarantee that the data they provide is accurate and agree to report any changes.

This English version is provided for convenience; the Spanish version prevails in case of discrepancy.