Privacy policy

This policy explains which personal data we process when you use digitalbakers.com or get in touch with us, what for, on what legal basis, for how long we keep it and what rights you have. It is written in plain language; if anything is unclear, write to us.

Who the controller is

Digital Bakers, S.L. · NIF B-65485468 · Calle Torrent d’en Vidalet, 55, L2, 08024 Barcelona, Spain · hello@digitalbakers.com.

We have not appointed a data protection officer because our activity does not require one; for any question about your data, that e-mail is the channel.

What data we process and why

If you write to us through the contact form

• Data: your name, your e-mail address and the message you write, plus the language and the page you write from.
• Purpose: to handle your enquiry and reply to you.
• Legal basis: your own request (Article 6(1)(b) GDPR, steps taken prior to a possible contract) and our legitimate interest in answering whoever writes to us (6(1)(f)). We do not ask for consent because none is needed: without that data we could not reply.
• What happens to your message: the site does not store it. It reaches a shared team mailbox by e-mail, and you receive an acknowledgement that does not repeat your text. Both e-mails are sent by Cloudflare Email Sending.
• What technical trace remains: each submission leaves a security record without your name, your e-mail address or your message: only a pseudonymous reference derived from your address. That record is kept for a maximum of seven days. Cloudflare also keeps delivery data of those e-mails (such as the recipient address, date and result) for the period its service sets and, if an e-mail cannot be delivered, may note that address so as not to retry it.
• How long we keep it: we keep your enquiry for a maximum of 12 months from your last message. If it leads to a contractual relationship, the necessary information becomes part of the project documentation and is retained for the duration of that relationship and the applicable statutory retention periods.
• Anti-abuse: so that bots cannot use the form, Cloudflare Turnstile checks your browser without cookies, and we limit the number of submissions per session and overall. To do so, Cloudflare processes your IP address and technical data about your browser, on the basis of our legitimate interest in the site’s security.

If you write to us by e-mail or on LinkedIn

We process your address and your message to reply to you, on the same legal basis and for the same period as the form.

When you browse the site

Our network provider, Cloudflare, processes your IP address and the technical details of the connection to serve you the pages and protect the site from attacks; this is necessary for the site to work (legitimate interest). We ourselves keep only technical error logs and browser security reports, which do not identify you, for a maximum of seven days.

In addition, to know how many people visit the site and how long its pages take to load, we use Cloudflare Web Analytics on every visit. It uses no cookies and stores nothing on your device: Cloudflare receives your IP address and technical page data (which page, where you came from, your device type, browser and operating system, your approximate country and load times) and returns only aggregate figures to us, without identifying you. Legal basis: our legitimate interest in understanding how the site is used and how it performs.

If you accept analytics

When you arrive on the site we ask whether you accept analytics cookies. Only if you accept:

• Data: a random identifier stored in a cookie, the pages you visit, how you reached the site (for example, from a search engine, a social network or a campaign link), how you interact with the pages (for example, how far you scroll or which external links you click), your device and browser type, and your approximate location (country or city), which Google derives from your IP address. If you write to us through the form, the fact that a message was sent is recorded, never its content or your contact details.
• What for: to know how many people visit the site, which content interests them and through which channels enquiries reach us, so we can improve the site.
• Tool: Google Analytics. We do not use it for advertising and we do not combine this data with other Google services.
• Legal basis: your consent (Article 6.1.a GDPR). If you do not accept, Google Analytics is not loaded and the site works just the same.
• How long we keep it: the data from each visit is kept for 14 months at most; the cookie expires after two years at most.
• How to change your mind: with the “Cookie settings” link in the footer of every page. More detail in the Cookie policy.

People who appear on the site

We publish the names, roles and photographs of our team, and client testimonials, with each person’s authorisation, which they can withdraw at any time by writing to us.

Who we share data with

We do not sell or pass on your data. These providers process data on our behalf, as processors and under contract:

• Cloudflare, Inc.: network, security and running the site, cookieless visit measurement (Cloudflare Web Analytics), and sending both your enquiry to our mailbox and the acknowledgement through Cloudflare Email Sending.
• Google: Google Workspace, the team’s mailboxes, and Google Analytics, visit measurement if you accept it.
• Amazon Web Services EMEA SARL: the content management system, in the Ireland region.

We will only disclose data to authorities when the law obliges us to.

Transfers outside the European Economic Area

Cloudflare and Google are US companies certified under the EU-US Data Privacy Framework, and additionally hold the European Commission’s standard contractual clauses. You can check their certification in the official list. The content management system is hosted in Ireland.

Your rights

You can access your data, rectify it, erase it, object to a processing operation, ask us to restrict it, take it to another provider, and withdraw a consent without affecting what was done before. Write to us at hello@digitalbakers.com stating which right you are exercising; we may ask you to confirm your identity.

Exercising your rights is generally free of charge. We respond within one month of receiving your request. If its complexity or the number of requests requires it, we may extend this period by up to two additional months; in that case, we will inform you within the first month and explain the reasons.

When we process your data on the basis of legitimate interest, we have first assessed that this interest does not override your rights; if you would like to see that assessment, ask us for it.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency, although we would be grateful if you told us first.

Minors

The site is not aimed at children under 14 and we do not knowingly collect their data.

Automated decisions

We make no automated decisions with effects on you.

Security

We apply encryption in transit, a content security policy to restrict the resources the site can load, and authentication-based access controls for the content management system and the team’s email.

Changes to this policy

Every version carries its date; the one in force is the one published here. If we make significant changes that affect the processing of your data, we will inform you through an appropriate channel. It is published in Spanish, Catalan and English; in the event of any discrepancy, the Spanish version prevails.

Version: 2026-10-15.