Privacy policy for clients
Last updated: 14 October 2026
This policy explains how I process the personal data of clients and prospects when preparing proposals, signing contracts and invoicing. The policy for the pepaguilo.com website is published there.
Controller
Jose Alberto Aguilo Escamez, self-employed Salesforce Marketing Cloud consultant, based in Palma de Mallorca. Contact: pep@aguilo.cloud.
Data I process
- Prospects: company name, name and role of the contact person, and the business context you share with me.
- Proposals: the proposal content and a count of visits to its link, without IP address or browser data.
- Contract signature: company name, tax ID and registered address; name, ID or passport number, role, email and, optionally, phone of the signer; and the signature record (date and time, IP address, user agent, document hash and accepted text).
- Invoicing and management: client tax details, pro forma invoices, invoices and hours spent per client and project.
Purposes and legal basis
- Preparing and sending the proposal you requested: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
- Entering into the contract by electronic signature and managing it: performance of the contract (Article 6(1)(b) GDPR).
- Invoicing and bookkeeping: compliance with tax and accounting obligations (Article 6(1)(c) GDPR).
- Encrypted backups, to keep the evidence of the signature and be able to recover the data: legitimate interest (Article 6(1)(f) GDPR).
Retention
- Contract and signature: for the duration of the contract and then for the statutory limitation periods (six years for commercial records and four years for tax records under Spanish law).
- Prospects and proposals not accepted: at most 12 months from the last contact, after which they are erased automatically. Any update to the request or the proposal counts as contact, as does each time you open the proposal link. You can ask me to erase them earlier at any time.
- Signed or accepted proposals follow the contract periods above.
- Backups: weekly copies for 12 weeks and one monthly copy for one year. Erased data remains in them until they expire.
Processors
These providers process data on my behalf, only to provide their service to me, under a data processing agreement (Article 28 GDPR) except where noted below the table:
| Provider | Entity | Data | Location | Transfer |
|---|---|---|---|---|
| Vercel | Vercel Inc. (US) | Requests and data in transit for proposals, signing and internal accounting | EU (Dublin) | standard contractual clauses (to the US) |
| Upstash | Upstash, Inc. (US) | Prospects, proposals and signature data | EU (Ireland) | the EU-US Data Privacy Framework and standard contractual clauses (to the US) |
| Cloudflare | Cloudflare, Inc. (US) | Encrypted backups of the proposal and signature database | EU | the EU-US Data Privacy Framework and standard contractual clauses (to the US) |
| GitHub | GitHub, Inc. (US) | The backup during the seconds it takes to encrypt it | US | the EU-US Data Privacy Framework and standard contractual clauses (to the US) |
| Holded | Holded Technologies S.L. (Spain) | Client company tax details, pro forma invoices and invoices | EU | No transfer |
| Supabase | Supabase Pte. Ltd. (Singapore) | Invoices, payments and expenses | EU (Ireland) | standard contractual clauses (to Singapore) |
| Toggl Track | Toggl OÜ (Estonia) | Hours spent per client and project | EU | No transfer |
| Resend | Plus Five Five, Inc. (US) | Notice of each signature, with the signer's details | US | the EU-US Data Privacy Framework and standard contractual clauses (to the US) |
| Google Workspace | Google Ireland Limited (Ireland) | Client emails, contracts and invoices | EU and US | the EU-US Data Privacy Framework and standard contractual clauses (to the US) |
| Anthropic | Anthropic Ireland, Limited (Ireland) | Company, contact person and context of prospects, and invoices in internal accounting. Never the signer's details | US | standard contractual clauses (to the US) |
GitHub, Inc. (US) has no data processing agreement under Article 28 GDPR: it processes the data under its terms of service and privacy statement, relying on the EU-US Data Privacy Framework and standard contractual clauses, and only for processing backups for a few seconds before they are encrypted.
International transfers
Some processors are established outside the European Economic Area or access the data from there, which is an international transfer: Vercel, Upstash, Cloudflare, GitHub, Resend, Google Workspace and Anthropic to the US; Supabase to Singapore. These transfers rely on the standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR) and, for Upstash, Cloudflare, GitHub, Resend and Google Workspace, also on the Commission's adequacy decision on the EU-US Data Privacy Framework.
Disclosures
I do not disclose your data to third parties unless required by law (for example, to the Spanish Tax Agency).
Your rights
You can exercise your rights of access, rectification, erasure, objection, portability and restriction by writing to pep@aguilo.cloud. If you are not satisfied with the answer, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).