Privacy policy
Last updated: [date]
Before you publish: this is a working template prepared for a Spain-based web design business. Replace every highlighted field with your real details and have it reviewed by a lawyer — MHCreators isn't one, and requirements vary with how you actually operate.
This policy explains what personal data MHCreators collects, why we collect it, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
| Controller | [Full legal name / company name] |
|---|---|
| Tax ID (NIF/CIF) | [NIF or CIF] |
| Registered address | [Street, postcode, city], Spain |
| mark@mhcreators.com |
2. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone, company and anything you write to us | Answering your enquiry and preparing a proposal | Steps taken at your request before entering a contract (Art. 6.1.b GDPR) | Up to 2 years after our last contact, unless you become a client |
| Contract, billing and project data | Delivering the project and meeting accounting and tax duties | Contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) | 6 years from the end of the tax year, per Spanish commercial law |
| IP address, browser, pages visited | Keeping the site secure and available; measuring how it is used | Our legitimate interest in a secure site (Art. 6.1.f); consent for analytics (Art. 6.1.a) | Up to 14 months |
| Cookie preferences | Remembering the choice you made in the cookie banner | Legal obligation (Art. 6.1.c) | 12 months |
We do not use your data for automated decision-making or profiling, and we never sell it.
3. Who else sees it
We share data only with service providers who process it on our instructions under a data processing agreement:
- Hosting and infrastructure — [provider name]
- Email — [provider name]
- Analytics — [provider name, if used]
- Accounting — [accountant / software]
We may also disclose data where a law, court or public authority requires it. Where a provider processes data outside the European Economic Area, that transfer relies on an adequacy decision or the European Commission's Standard Contractual Clauses; you can request a copy of the safeguards in place.
4. Your rights
You can ask us at any time to:
- confirm what data we hold and get a copy of it (access);
- correct anything inaccurate or incomplete (rectification);
- delete your data where we no longer need it (erasure);
- limit how we use it while a dispute is resolved (restriction);
- receive it in a portable, machine-readable format (portability);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting processing already carried out.
Write to mark@mhcreators.com with proof of identity. We reply within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
5. Security
We apply appropriate technical and organisational measures — encryption in transit (HTTPS), access control, and regular backups — to protect your data against loss, misuse or unauthorised access.
6. Children
This site is aimed at businesses and is not directed at anyone under 14. We do not knowingly collect data from children.
7. Changes
If we update this policy, we will post the revised version here with a new date. Material changes affecting your rights will be communicated directly where we have your contact details.