Privacy policy
What data we process, why, and how you can exercise your rights. Last updated: 27 October 2026.
Draft pending legal review
This text is a draft and is not final yet. A lawyer will review it. The owner’s identifying details are already filled in.
English translation
This page is a translation of the Spanish original, provided for convenience. If the two versions differ, the Spanish version prevails.
1. Controller
- Controller
- Gassiot & Llobet
- Tax ID (NIF)
- J66534553
- Address
- C. de la Llotja, s/n, Recinte Firal El Sucre, 08500 Vic (Barcelona)
- hi@gassiotllobet.com
- Data protection officer
- None appointed
2. What data we process and why
| Activity | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Browsing the website | IP address, date and time, page requested and browser, in the server logs. | Serving the website, keeping it secure and detecting abuse. | Legitimate interest (Art. 6(1)(f)). | [PLAZO] days. |
| Visit statistics (Google Analytics) | Only if you accept them: visitor identifier in a cookie, pages viewed, where you came from, browser, device, language and approximate location. | Knowing which pages are used, so that we can improve them. | Your consent (Art. 6(1)(a)), which you can withdraw at any time from “Cookie settings” in the footer. | [PLAZO] months in Google Analytics. The cookie lasts 2 years at most; your cookie choice, 12 months. |
| Free audit | Address of the scanned page and technical data to prevent abuse. | Carrying out the analysis, showing you the result and preventing abuse. | Your request (Art. 6(1)(b)) and legitimate interest in preventing abuse (Art. 6(1)(f)). | [PLAZO]. |
| Product news | Email, if you tick the relevant box. | Writing to you about SiteNorma news. | Your consent (Art. 6(1)(a)), which you can withdraw whenever you wish. | Until you unsubscribe. |
| SiteNorma account | Email and account details you provide when you sign up. If you sign in with Google, the name and email of your Google account, which Google sends us once you give your permission on its screen (we do not receive your Google password). | Creating and managing your account, and providing the service. | Performance of a contract (Art. 6(1)(b)). | While your account is active and, afterwards, for the applicable legal periods. |
| Contact form | Name, email and message. | Replying to you. | Your request and our legitimate interest in dealing with it (Art. 6(1)(f)). | The time needed to deal with your request and, after that, [PLAZO]. |
The “Does the EAA apply to me?”, statement generator and contrast checker tools run in your browser: what you type into them does not reach us.
Data relating to customers of the paid service, such as user accounts or billing, will be explained in the terms of service and in the data processing agreement.
3. Recipients
We do not sell your data or pass it on to third parties. We will only disclose it to authorities where required by law. We are helped by providers acting as processors, under contract and with guarantees: hosting in the European Union and email sending. If you sign in with your Google account, Google Ireland Limited, which is responsible for your Google account and identifies you on its own screen. If you accept analytics cookies, also Google Ireland Limited (Google Analytics). [LISTA DEFINITIVA DE PROVEEDORES PENDIENTE] (final list of providers pending)
4. International transfers
Our servers and main providers will be in the European Union. If any provider involves transferring data outside the European Economic Area, we will do so with the safeguards required by the GDPR, such as standard contractual clauses, and we will state this here. If you accept analytics cookies, Google may process the data of your visit outside the European Economic Area, including the United States. [PENDIENTE DE CONFIRMAR: safeguards applying to Google Analytics] (to be confirmed)
5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time, by writing to hi@gassiotllobet.com. We will reply within one month.
If you believe that we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), at aepd.es.
6. Minors
This website is aimed at businesses and professionals. We do not knowingly process the data of minors under the age of 14.
7. Security
We apply technical and organisational measures to protect your data, such as encryption of communications, access control and encrypted backups.
8. Changes
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will let you know.