1. Data controller
Lehitgaber, S.L. (Spanish tax ID B21631288), registered address: C/Orión s/n, Urb. Pueblo Los Olivos, Bloque E, Puerta S2, 29649 Mijas (Málaga), Spain. Email: arco@lehitgaber.com.
2. Data we collect and purpose
Through the contact form we collect the data you provide (first name, last name, email address, phone number and the content of your message) for the sole purpose of handling your request for information or a quote and following it up.
If you accept the statistics cookies in the cookie notice, we collect audience measurement data via Google Analytics 4: pages visited, basic interactions and pseudonymised online identifiers, for the sole purpose of understanding how the website is used and improving it. If you reject those cookies, no measurement data is collected.
To protect the website against attacks, the security firewall logs technical request data (including the IP address) when it detects malicious or suspicious activity.
3. Legal basis
The processing of form data is based on your consent, which you give by submitting the form, and on pre-contractual measures when you request a quote (Art. 6.1.a and 6.1.b GDPR).
Audience measurement with Google Analytics 4 is based on your consent (Art. 6.1.a GDPR), which you can withdraw at any time from the consent management notice on the website.
The firewall security log is based on the legitimate interest in protecting the website and its users (Art. 6.1.f GDPR).
4. Retention
We keep form data while we handle your request and, once it is closed, for the legally required periods; after that it is erased. Form entries are stored in the website database.
When a request has been closed and has not led to a contractual relationship, we delete its entry from the form records 12 months after closure. This deletion affects only the website records; it does not affect email.
About backups:
- Scheduled backups of the website files are stored on Google Drive and do not contain the database or personal data. On a transitional basis, one older backup that does contain personal data remains stored until it is deleted.
- The database is exported manually and occasionally for safekeeping by the controller outside the website.
- The hosting provider (OVHcloud) additionally keeps its own point-in-time backups as a non-contractual extra service: in practice, retention of up to roughly one month for the database and up to about two weeks for files.
Emails sent by the website are technically logged on the server for 14 days and then automatically deleted.
Google Analytics 4 data is retained for 2 months (events) and 14 months (user data); its cookies remain in your browser for up to 2 years unless you delete them; if you withdraw consent, those cookies stop being used for measurement from that moment on.
5. Recipients
We do not sell your personal data. To operate this website we work with these providers:
(a) OVHcloud: hosting of the website and email; it also sends the emails generated by the website (for example, contact form notifications).
(b) Google Ireland Limited: audience measurement with Google Analytics 4, only with data from people who accept the statistics cookies and in accordance with Google’s Data Protection Terms; its use may involve international transfers to Google LLC (USA) covered by the EU-U.S. Data Privacy Framework or, where not applicable, by standard contractual clauses.
(c) Google Drive: stores backups of the website files, which contain no personal data. On a transitional basis, one older backup that does contain personal data remains stored until it is deleted (planned after the first local database copy). This service is used with a standard Google account, without specific contractual data protection guarantees.
(d) Defiant Inc. (Wordfence, USA): the firewall shares the IP addresses of requests it detects as malicious with its security network, to protect this and other websites; Defiant offers standard contractual clauses in line with the GDPR.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to arco@lehitgaber.com. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply appropriate technical and organisational measures to protect your personal data, including a security firewall.
8. Cookies
For details of the cookies used, see the Cookie Policy.