Privacy policy

This is a summary of the information required by Articles 13 and 14 of the GDPR. Each point is explained in detail in the sections that follow.

• Controller: Serman Illes S.L. (SERMAN), tax ID B57781452.
• Purposes: answering your enquiries, preparing service proposals, managing our client relationships and protecting the website.
• Legal bases: your consent, steps taken at your request before entering into a contract, performance of a contract, compliance with legal obligations and our legitimate interests.
• Recipients: we do not disclose your data to third parties unless the law requires it. Some providers process it on our behalf as processors. WhatsApp (Meta) processes the data of any conversation you start on that channel.
• Your rights: access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent, plus the right to complain to the Spanish Data Protection Agency (AEPD).
• Contact: info@serman.agency.

The controller of your personal data is the owner of this website. For any question about your data, email info@serman.agency with “Data protection” in the subject line. The controller's details are:

• Identity: Serman Illes S.L.
• Trading name: SERMAN
• Tax ID (NIF): B57781452
• Place of business: Calle Joan Crespí, 13C, 07014 Palma de Mallorca (Balearic Islands), Spain
• Email: info@serman.agency
• Phone: +34 602 56 18 95
• Data protection officer: [Data protection officer details pending, if applicable]

We process the data you give us directly when you write to us, call us or work with us, along with the minimum technical data your visit generates:

• Identity and contact details: name, email address and, if you provide them, phone number and company or website.
• Your enquiry: the service area you are interested in, your indicative budget if you share it, and your message.
• If you message us on WhatsApp: your phone number, your profile name and the content of the messages you send us.
• Professional relationship: job title, billing details, proposals, contracts, correspondence and project documentation.
• Technical browsing data: IP address, date and time, page requested and browser type, which the hosting server logs for security purposes.

At the moment, submitting the contact form opens your email app with the message ready to send, so it reaches us as an ordinary email. Once we switch on direct submission from the website, the form will be processed by a form provider (we will name it here before we start using it), acting as our processor.

If you choose to message us on WhatsApp from the button on the site, the conversation takes place on WhatsApp, a service of WhatsApp Ireland Limited (Meta group). We use the conversation data only to deal with your enquiry, with the same legal bases and retention periods as any other enquiry. WhatsApp processes your data as an independent controller, under the terms and privacy policy you accepted when you signed up to that service. If you prefer not to use it, you can email or call us.

Fields marked as required are needed to reply to you: without them we cannot deal with your enquiry. We do not need any special category data (health information, for example), so please do not include it in your messages.

If you are the contact person at a client or supplier company, your work details (name, job title, work email and phone) may have been given to us by that company to coordinate a project. If you give us someone else's details, you must have told them first.

We use your data only for the following purposes and never process it later in a way that is incompatible with them:

• Answering your enquiries by email, phone or whichever channel you prefer.
• Preparing proposals and quotes tailored to what you tell us, including any initial diagnosis meetings.
• Managing client relationships: delivering the services contracted, coordinating projects, invoicing and meeting our accounting and tax obligations.
• Protecting the website against fraudulent use or attacks, using the server's technical logs.

Just as important is what we never do:

• We do not send you marketing messages by email or other electronic means without your prior consent. The only exception is the one Article 21 of the LSSI-CE allows: writing to existing clients about services similar to those they have contracted, provided they have not objected, with a simple way to unsubscribe in every message.
• We do not sell, rent or share your data for commercial purposes.
• We do not profile you or take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
• We do not use your data to train artificial intelligence models. When an AI tool helps us prepare a proposal, we favour settings that keep client information out of model training and never enter personal data without a legal basis, as our AI policy explains.

Each processing activity relies on one of the legal bases in Article 6 of the GDPR. Where the basis is your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before you did. The bases we apply are:

• Enquiries: your consent, given when you send us your message (Art. 6(1)(a)). If your enquiry is about hiring a service, also steps taken at your request before entering into a contract (Art. 6(1)(b)).
• Proposals and quotes: steps taken at your request before entering into a contract (Art. 6(1)(b)).
• Client relationships: performance of the contract (Art. 6(1)(b)) and compliance with legal obligations, such as commercial and tax rules (Art. 6(1)(c)).
• Business contact persons: our legitimate interest in maintaining the professional relationship with the organisation you work for (Art. 6(1)(f) GDPR and Article 19 LOPDGDD).
• Website security: our legitimate interest in protecting the site and its visitors (Art. 6(1)(f)).
• Marketing messages: your consent (Art. 6(1)(a)) or, if you are already a client, our legitimate interest in telling you about similar services, within the limits of Article 21 of the LSSI-CE.

We keep data only for as long as each purpose requires. After that, we keep it blocked for as long as any liability could arise, as Article 32 of the LOPDGDD provides, and then delete it securely:

• Enquiries that do not lead to a business relationship: up to 12 months from the last contact, in case you want to pick up the conversation again.
• Proposals not accepted: up to 12 months from when they were sent.
• Client data: for the duration of the contract and then for the statutory retention periods. As a general rule, six years for commercial records (Article 30 of the Spanish Commercial Code) and four years for records relevant to tax.
• Marketing messages: until you withdraw your consent or unsubscribe.
• Server logs: for the limited period set by the hosting provider for security purposes.

We do not disclose your data to third parties unless the law requires it (for example, to the Spanish Tax Agency, the courts or law enforcement authorities).

To deliver our services we work with providers that process data on our behalf as processors. We sign a contract with each of them under Article 28 of the GDPR, which obliges them to use the data only on our instructions and to keep it secure. They fall into these categories:

• Web hosting: the provider that hosts the site and runs its servers, including the technical logs: Hostinger International Ltd. (Cyprus, EU).
• Email and work tools: the providers of our email (Google Ireland Limited (Google Workspace)), cloud storage and productivity tools, including the AI tools we use to prepare proposals.
• Contact form: a form provider (we will name it here before we start using it), once direct submission from the website is switched on.
• Messaging: WhatsApp (WhatsApp Ireland Limited), only if you choose to contact us that way; it acts as an independent controller of its own service.
• External advisers: accountants, tax advisers or lawyers, when they are involved in managing client relationships.

Some technology providers, such as those for web hosting, email, cloud storage or artificial intelligence, may process data outside the European Economic Area. Where that happens, the transfer only takes place with the safeguards set out in Chapter V of the GDPR: a European Commission adequacy decision or standard contractual clauses approved by the Commission, together with any supplementary measures required. If you message us on WhatsApp, Meta may process the conversation data in the United States under the EU-US Data Privacy Framework, covered by a European Commission adequacy decision of 10 July 2023.

You can ask us about the safeguards that apply to each provider by emailing info@serman.agency. Before switching on direct form submission, we will check where the chosen provider processes data and update this policy if needed.

You can exercise the rights granted by Articles 15 to 22 of the GDPR at any time, free of charge, as well as withdraw your consent (Article 7(3)):

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate data or complete incomplete data.
• Erasure: ask us to delete your data when it is no longer needed, among other grounds.
• Objection: object to processing based on our legitimate interests or carried out for direct marketing.
• Restriction of processing: ask us to keep your data without using it, for example while a complaint is being resolved.
• Portability: receive the data you gave us in a structured, commonly used format, or have us transmit it to another controller.
• Withdrawal of consent: for processing based on consent, without affecting earlier processing.
• Not to be subject to automated decisions that produce legal effects concerning you or similarly significantly affect you.

Email info@serman.agency or write to Calle Joan Crespí, 13C, 07014 Palma de Mallorca (Balearic Islands), Spain, stating which right you wish to exercise. We will only ask for proof of identity if we have reasonable doubts about who you are.

We reply within one month of receiving your request. If it is particularly complex or we receive a large number of requests, this may be extended by two further months; if so, we will tell you within the first month and explain why.

Dealing with your request is free. Only if a request is manifestly unfounded or excessive, in particular because it is repetitive, may we charge a reasonable fee or refuse to act on it, and we will always explain why.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan, 6, 28001 Madrid, through its electronic office or its website www.aepd.es.

If you prefer, you can write to us first: it is usually the quickest way to resolve an issue, although it is not a requirement for making a complaint.

Marketing projects often give us access to data about our clients' own customers: contacts in a CRM during a marketing automation project, conversions in an advertising account or conversations handled by a WhatsApp chatbot. In those cases our client is the controller and SERMAN acts as a processor.

That processing is governed by the data processing agreement we sign with each client and by the client's own privacy policy, not by this one. If you have questions about it, please contact the company you deal with first.

We apply technical and organisational measures appropriate to the risk, as Article 32 of the GDPR requires. They include:

• Encrypted connections (HTTPS) across the whole website.
• Access to data limited to the team members who need it, all bound by a duty of confidentiality.
• Strong authentication on the accounts and tools that hold client data.
• Backups and regular reviews of access rights, permissions and providers.
• A breach response procedure: if a security breach poses a risk to your rights, we notify the AEPD without undue delay and, where feasible, within 72 hours; if the risk is high, we also inform the people affected.

This site is aimed at businesses and professionals. We do not knowingly collect data from children under 14, the minimum age for consenting to the processing of one's own data under Article 7 of the LOPDGDD. If we find that we have received data from a child under that age without the authorisation of their parents or guardians, we will delete it.

We review this policy whenever our processing, our providers or the law change; for example, when we switch on direct form submission or if we add analytics tools. The date of the latest update is shown at the top of the page.

If a change significantly affects our clients' data, we will tell them by email before it applies. See also our legal notice and cookie policy.