Legal
Privacy Policy
Last updated: July 12, 2026
1. Data controller
| Field | Detail |
|---|---|
| Controller | Rubén Blanco Cabello |
| Tax ID (NIF) | 24418618R |
| Address | C/ Estrella Altair, Nº 6, Cartagena (Murcia), Spain, postal code 30203 |
| info@jesterin.com | |
| Trade name | Jester In |
No Data Protection Officer (DPO) has been appointed: the scope and nature of the processing carried out do not require one under the GDPR, since no large-scale processing or special categories of data are involved.
2. Data collected and its source
The personal data processed comes directly from the user, who provides it voluntarily through the Website's qualified contact form. The following categories of data are collected:
- Identification and contact data: name, email address and, where provided, phone number and company name.
- Commercial qualification data: what the user needs to solve in their business, their industry, how long they have worked in it, their timeline or urgency and how they heard about Jester In.
- Message content that the user chooses to include in the free-text field.
- Browsing and analytics data (IP address, device type, pages visited), processed only if the user consents to analytics cookies (see the Cookie Policy).
No special categories of data are requested or processed (Art. 9 GDPR: health, ideology, religion, ethnic origin, etc.). Users are asked not to include this type of information in the message field.
3. Purposes of processing
Data is processed for the following purposes:
- Handling the diagnosis request submitted through the form and managing the resulting commercial communication.
- Qualifying the request according to the form's variables and, where applicable, facilitating a booking through Google Calendar.
- Managing the commercial relationship and, should the user become a client, delivering the contracted services and billing for them.
- Analyzing use of the Website in aggregate form to improve its content and experience, solely through previously consented analytics cookies.
Form data is added to the controller's CRM (hosted on Supabase) for orderly management. No automated decisions with legal effects are made, nor is any profile built that produces a significant effect on the user.
4. Legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Handling the form request and the resulting commercial communication | Consent of the data subject (Art. 6.1.a) and pre-contractual measures at the data subject's request (Art. 6.1.b) |
| Booking (Google Calendar) | Consent and pre-contractual measures (Art. 6.1.a and 6.1.b) |
| Managing the contractual relationship and billing (if a contract is entered into) | Performance of a contract (Art. 6.1.b) and a legal, tax/accounting obligation (Art. 6.1.c) |
| Analytics cookies (GA4) | Consent (Art. 6.1.a), obtained via the cookie banner |
| Website security and abuse prevention | Legitimate interest of the controller (Art. 6.1.f) |
Users may withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
5. Retention period
- Inquiry data that does not lead to a contractual relationship: kept for as long as needed to handle the request, and for a maximum of one (1) year from the last contact, unless the user requests earlier deletion.
- Client data: for the duration of the contractual relationship and, once it ends, for the applicable legal limitation periods (generally, up to 6 years for commercial and accounting obligations, Art. 30 of the Spanish Commercial Code, and 4 years for tax obligations, General Tax Law).
- Analytics data (GA4): a maximum of 14 months, in line with Google Analytics 4's retention configuration.
Once these periods elapse, the data is deleted or anonymized.
6. Recipients and data processors
Data is not shared with third parties, except where legally required. The following data processors, however, are involved in delivering the service, and the controller maintains or will enter into the corresponding Art. 28 GDPR agreement with each:
| Provider | Function |
|---|---|
| Vercel Inc. | Hosting and deployment of the Website |
| Google Ireland Ltd. / Google LLC | Google Analytics (GA4) and Google Calendar (bookings) |
| Supabase Inc. | The CRM database where leads are stored |
7. International transfers
Some of the providers listed above may process data outside the European Economic Area (EEA), mainly in the United States. Such transfers rely on the safeguards set out in Chapter V of the GDPR: adherence to the EU-US Data Privacy Framework, Standard Contractual Clauses (SCC) approved by the European Commission, and/or additional security measures. Users may request information about these safeguards at the contact address given above.
8. Data subject rights
Users may exercise the following rights recognized under the GDPR and the LOPDGDD:
- Access to their personal data.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten") once data is no longer needed.
- Objection to processing on grounds relating to their particular situation.
- Restriction of processing in the cases provided for.
- Portability of data to another controller, where applicable.
- Withdrawal of consent given, at any time.
- Not to be subject to automated individual decisions with legal effects.
How to exercise these rights: send a request to info@jesterin.com, indicating the right you wish to exercise and attaching a copy of a document proving your identity. Requests will be handled within a maximum of one (1) month of receipt, extendable under the terms of Art. 12 GDPR.
Complaints to the supervisory authority: if a user believes processing does not comply with applicable regulations, they have the right to file a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain.
9. Data security
The controller has adopted the technical and organizational measures necessary to guarantee the security, confidentiality and integrity of personal data, and to prevent its alteration, loss, unauthorized processing or access, in accordance with Art. 32 GDPR.
10. Accuracy of data
Users guarantee that the data provided is accurate and up to date, and agree to notify any changes. Where a user provides third-party data, they represent that they hold that party's consent for its processing.