Privacy Policy
This page is a courtesy translation of the Spanish original. If there is any discrepancy, the Spanish version prevails. Read the Spanish original.
In short: we only process the data you give us or that is published on your company's website, we do not sell it or hand it to anyone for their own use, and you can ask us to delete it by sending an email.
1. Who processes your data
TONYBERIA SL (“Autoridad Digital”), Tax ID B13855564, registered at Plaza de la Constitución 2, Esc. 1, 2º 7, 29640 Fuengirola, Málaga (Spain).
For anything related to your data: hello@autoridaddigital.com. We are not required to appoint a data protection officer and have not done so.
2. What we process, why we may do so and how long we keep it
| Channel | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form (Spanish site) | Name, email, company, website, sector and, if you provide it, revenue range | To answer your request and prepare a proposal | Your consent and the pre-contractual measures you ask for when you write to us | 3 years from the last contact; if there is a contract, 6 years under commercial law |
| Contact form (English site, /en/contact) | Name, work email, company, website, sector, main market and, if you provide it, a message | To answer your request and send you the AI-visibility summary you asked for. Replies come from hello@autoridaddigital.com | Your consent and the pre-contractual measures you ask for when you write to us | 3 years from the last contact; if there is a contract, 6 years under commercial law |
| GEO Scanner | Email and the URL you analyse | To show you the report, contact you about the result and, only if you tick the box, send you commercial communications | The pre-contractual measures you ask for when you analyse your website; for commercial communications, your consent | 2 years from the last analysis, or until you unsubscribe |
| Newsletter | To send you articles and news | Your consent, which you can withdraw in one click from any mailing | Until you unsubscribe | |
| Commercial outreach | Company name, website and a professional email address published on it | To offer you an analysis of the visibility of your own website | Legitimate interest in offering a service to your company (Art. 6.1.f GDPR) | 1 year from sending; if you reply “baja” (unsubscribe), the address stays only on the exclusion list |
| Analytics cookies | Cookie identifier, pages viewed and technical browser data | To know which content works | Your consent, managed in the cookie banner | That of each cookie, detailed in the cookie policy |
| Form and server security | IP address and technical request data | To limit submissions per IP to curb abuse, and to log server errors | Legitimate interest in protecting the site (Art. 6.1.f GDPR) | The per-IP counter expires on its own, between one minute and one day; server logs follow Vercel's retention period |
We do not take automated decisions that affect you or build profiles: the scanner analysis evaluates a web page, not a person.
3. If we write to you without you having contacted us
We have written to companies whose professional address is published on their own website to offer them an analysis of their visibility. We process that address on the basis of legitimate interest in offering a service to your company (Art. 6.1.f GDPR). Each email identifies TONYBERIA SL, says which website we took the address from and how to stop.
Just reply “baja” (Spanish for “unsubscribe”; “unsubscribe” or “no” also works) and you will not receive anything again: we delete your data and keep only the address on an exclusion list, which is what prevents us from writing to you again. We never buy or sell contact lists.
4. Who else sees your data
Nobody receives it to use on their own account. These providers process it on our behalf, and only for what is needed:
- Vercel Inc. — Website hosting and running of the forms. (USA, with delivery infrastructure in the EU)
- Hostinger International Ltd. — Outgoing mail server (SMTP) used to send form notifications. (European Union)
- Vera OS (our own client management system) — Recording your request so it can be followed up commercially. (European Union)
- Google Ireland Ltd. (Google Analytics 4) — Aggregated traffic measurement, only if you accept analytics cookies. (Ireland, with transfers to the USA)
- Microsoft Ireland Operations Ltd. (Clarity) — Analysis of how the site is used, only if you accept analytics cookies. (Ireland, with transfers to the USA)
- Grafana Labs (Faro) — Logging of technical errors and browser load times (without the text typed in forms), only if you accept analytics cookies. (United Kingdom (EU adequacy decision); headquarters in the USA)
- Google Ireland Ltd. (Subscribe with Google) — “Add as a preferred source” button on blog articles, only if you accept third-party cookies. (Ireland, with transfers to the USA)
Public authorities may also access it where the law requires.
5. Transfers outside the European Union
Google and Microsoft may process data in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in July 2023, and they also apply standard contractual clauses. Vercel processes data under those same clauses.
If you reject analytics cookies, neither Google nor Microsoft receives anything from you: their scripts are never loaded.
6. Your rights
You can ask us to access your data, rectify it, erase it, restrict its processing, object to it or receive it in a portable format. You can also withdraw your consent at any time, without affecting what was processed until then.
Write to hello@autoridaddigital.com stating which right you want to exercise. We reply within one month at most.
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid.
7. Cookies
Technical cookies are necessary for the site to work and cannot be disabled. Analytics cookies are only activated if you accept them in the banner, and you can change your mind at any time from “Cookie settings” in the footer. The detail of each one is in the cookie policy.
8. Security
The site is always served encrypted (HTTPS with HSTS), email leaves over a TLS connection and service credentials live in server environment variables, never in the code that reaches your browser. Forms have a per-IP submission limit and anti-bot measures.
Minors
This site is aimed at professionals and companies. It is not intended for children under 14 and we do not knowingly process their data; to contract a service you must be of legal age.
9. Changes
If this policy changes, it is published here with its new date. Changes that genuinely affect you are notified by email to those who are subscribed.
Last updated: 23 September 2026