Privacy policy

Data controller

Controller

Damián Agulló Sánchez

Trade name

White Lion Spain

EU VAT number

ES49215594X

Address

C. San Antonio Abad 11, 02660 Caudete (Albacete), Spain

Email

hello@whitelionspain.com

We are not required to appoint a data protection officer. For any question about your data, write to hello@whitelionspain.com.

What data we process

Assessment and contact forms

name, email, company, role, approximate revenue, sales channels and the information about your operations or the message you choose to share.

Newsletter

your email address and, if you provide it, your name.

Email and WhatsApp

the data you send us when you contact us.

Browsing

IP address, device and cookie identifiers, pages visited and interaction with the site, only if you accept analytics or advertising cookies.

Fields marked as required are necessary to handle your request. We don't need special categories of data: please don't include them in free-text fields.

Purposes and legal basis

• Handling your assessment request or enquiry and, where relevant, preparing a proposal: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in replying (Art. 6(1)(f) GDPR).
• Recording and managing the request in our CRM (Odoo): pre-contractual steps and legitimate interest.
• Sending you the newsletter: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE), which you confirm with the link in the email we send when you sign up (double opt-in). You can unsubscribe at any time using the link in every issue.
• Protecting the forms against spam and abuse with Cloudflare Turnstile: legitimate interest in the security of the site (Art. 6(1)(f) GDPR).
• Measuring use of the site in aggregate and without cookies with Cloudflare Web Analytics: legitimate interest.
• Analytics with Google Analytics 4 and campaign measurement with Google Ads and Meta Pixel: your consent, which you can withdraw at any time from “Cookie settings”.
• Meeting tax and accounting obligations if we end up working together: legal obligation (Art. 6(1)(c) GDPR).

We don't make automated decisions or build profiles with legal effects on you.

Retention

• Requests that don't lead to a contract: up to 2 years from the last contact.
• Clients: for the duration of the relationship and then for the legal periods (6 years for commercial records and 4 years for tax records under Spanish law).
• Newsletter: until you unsubscribe. If you don't confirm your subscription, we delete your data within 60 days at the latest.
• Google Analytics 4 data: 14 months. Cookies: the periods set out in the Cookie Policy.

Recipients and processors

We don't sell or disclose your data to third parties, except where required by law. We work with providers that process data on our behalf under contracts in line with Article 28 GDPR:

• Cloudflare, Inc.: web hosting, content delivery, form protection (Turnstile) and cookieless analytics.
• Odoo S.A. (Belgium): CRM and email marketing; we record requests and manage the newsletter subscriber list.
• Maileroo Group Pty Ltd (Australia): delivery of the newsletter and marketing emails, using servers in the European Union.
• Microsoft Ireland Operations Ltd.: email (Microsoft 365).
• Google Ireland Ltd.: Google Analytics 4 and Google Ads, only with your consent.
• Meta Platforms Ireland Ltd.: Meta Pixel, only with your consent. For the collection and transmission of data through the Pixel we are joint controllers with Meta (Art. 26 GDPR); any further processing is carried out by Meta under its own privacy policy.
• WhatsApp Ireland Ltd.: if you choose to write to us on WhatsApp.

International transfers

Some providers (Cloudflare, Google, Meta and Microsoft) may process data in the United States. These transfers are based on the adequacy decision for the EU-U.S. Data Privacy Framework, under which these companies are certified, and, where applicable, on the European Commission's standard contractual clauses.

Maileroo processes data on servers in the European Union, but the company is based in Australia. Any access from outside the EU is covered by the European Commission's standard contractual clauses (Decision 2021/914).

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time without affecting the lawfulness of prior processing, by writing to hello@whitelionspain.com. We will reply within one month. If we have reasonable doubts about your identity, we may ask you for additional information.

If you believe we haven't handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), forms submitted through our server without exposing credentials in the browser, and CRM access limited to the people who need it.