Privacy policy

Data controller

The data controller is Manuel Costinel Paduretu, a self-employed professional operating under the trade name ManuWebs, NIE Y0812672G.

Data processed

Depending on the channel and relationship, we may process:

• Data provided in an enquiry: name, company if provided, email, telephone or WhatsApp if provided, service of interest, approximate date and message content.
• Data from a professional relationship: identification and contact details, project information, communications, proposals, contracts, invoicing, payments and tax or accounting obligations.
• Technical and security data: IP address and basic request data, server logs, timestamps and a pseudonymised IP fingerprint to limit abusive submissions.
• Measurement data, only with permission: pages visited, interactions, approximate origin, originating campaign and general browser or device characteristics.

The form requires name, email, type of need, approximate timing, message and confirmation that the privacy information has been read. Without them, we cannot process the enquiry. Company and telephone are optional. No special categories of data are requested; avoid including unnecessary confidential or third-party information.

Purposes and legal bases

• Responding to enquiries and preparing proposals: taking pre-contractual steps at the data subject's request (Article 6(1)(b) GDPR). The form checkbox confirms that this information has been shown; it is not consent to advertising.
• Carrying out a project or providing a service: managing the contractual relationship, communications, deliveries, support and payments (Article 6(1)(b) GDPR).
• Meeting obligations: issuing and retaining invoices, responding to requests and complying with tax, accounting and administrative rules (Article 6(1)(c) GDPR).
• Protecting the website and preventing abuse: applying security controls, investigating incidents and limiting automated submissions, based on the legitimate interest in maintaining a secure, operational service (Article 6(1)(f) GDPR).
• Analytics and campaign measurement: understanding the website's aggregate performance and, when enabled, attributing conversions from Google Ads campaigns. These purposes are based on consent (Article 6(1)(a) GDPR and Article 22.2 LSSI), which may be refused or withdrawn at any time.

Form data is not used to send newsletters, automated commercial communications or third-party advertising. If a different purpose were offered in the future, it would be explained separately and, where necessary, specific, optional consent would be requested.

Google Analytics, Search Console and Google Ads

Google Analytics is used only after the Analytics category is accepted. It enables statistics on visits and interactions. The IP address may be used temporarily to obtain an approximate geographical area, but Google states that it does not log or store it individually for European Union users. Names, email addresses, telephone numbers and form text are not sent to Google.

Google Search Console is used by the owner to verify domain ownership and consult aggregate search performance. Verification uses a technical meta tag and does not install cookies in visitors' browsers.

Google Ads is used to promote ManuWebs services. If a valid configuration exists and the Campaign measurement category is accepted, actions such as an enquiry attributed to an advert may be measured. This website does not display third-party adverts and keeps remarketing, audience creation and advertising personalisation disabled. Consent preferences are communicated through Google Consent Mode and, by default, permissions for analytics, advertising storage, advertising user data and personalisation remain denied until appropriate.

Recipients and processors

Data is not sold or shared with third parties for commercial purposes. Access may be granted only to:

• Hostinger, as the hosting, infrastructure and email provider. The form sends the enquiry via SMTP to the mailbox managed by ManuWebs; it does not create a commercial contact database on the website.
• Google Ireland Limited and its subprocessors, solely for Analytics or Google Ads measurement when the corresponding consent has been given.
• Public authorities, courts, tribunals or law enforcement, where there is a legal obligation or valid request.
• Professionals bound by confidentiality, such as tax, accounting or legal advisers, where necessary for the relationship or to defend rights.

Providers act under their contracts and data protection terms. Access is limited to the information necessary to provide each service.

International transfers

Hosting and email are contracted with the aim of having the main processing take place in the European Economic Area. Some providers or their subprocessors may provide support or process information from other countries.

Google may process information in the United States and other countries. Where an international transfer occurs, the safeguards provided in Articles 44 to 49 GDPR will apply, such as an adequacy decision — including the EU-US Data Privacy Framework for certified entities — or standard contractual clauses and additional measures where necessary. You can consult Google's privacy policy and its information on advertising data transfers.

Retention periods

• Enquiries that do not become projects: until the conversation is resolved and for no more than 12 months after the last contact, unless longer retention is necessary to establish, exercise or defend a claim.
• Professional relationships: during the project or service and subsequently blocked for the applicable liability periods. Commercial and accounting documentation is generally retained for six years and tax-relevant documentation for at least the statutory limitation period, usually four years.
• Security: the pseudonymised fingerprint used to limit form submissions is retained for one hour. Hosting technical logs are kept for the limited period configured by the provider and only for security, diagnostics and compliance.
• Google Analytics: user and event data is configured for two-month retention; aggregate reports may be retained as long as needed to compare website performance.
• Google Ads: measurement identifiers are limited to the duration stated in the Cookie Policy and the configured conversion window, which will not exceed 90 days.
• Cookie preference: 12 months, unless withdrawn earlier or a substantial change requires it to be requested again.

When a retention period ends, data is deleted or blocked to prevent ordinary use for as long as it may be needed to meet legal liabilities.

Rights and complaints

You may request access to your data, rectification or erasure, restriction of processing, portability where applicable, and object to processing based on legitimate interest. You may also withdraw consent for analytics or campaign measurement at any time without affecting the lawfulness of earlier processing.

To exercise a right, write to info@manuwebs.com or the stated postal address, identify the right requested and provide only the information necessary to verify your identity. The procedure is free except for manifestly unfounded or excessive requests under the terms of the GDPR.

If you consider the processing improper, you may lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001 Madrid, or use its electronic office.

Minors, security and automated decisions

ManuWebs services are aimed at adults, professionals and organisations. A minor must not send a contractual request without the involvement of their legal representative. If data from a minor submitted without a sufficient basis is detected, it will be deleted as soon as reasonably possible.

Technical and organisational measures proportionate to the risk are applied, including encrypted connections, access controls, session protection, form validation, anti-automation measures and backups. No system is infallible, so measures are reviewed when the service changes or a significant risk arises.

No automated decisions with legal or similarly significant effects are made, and no individual commercial profiles are created. Automated abuse control can only temporarily limit new submissions and has no legal effects.

Changes to this policy

This policy will be updated when processing activities, providers or regulatory requirements change. The date shown at the beginning identifies the current version. If a change substantially affects a consent-based purpose, a new choice will be requested before that processing is activated.