Legal
Privacy policy
Last updated: 29 October 2026
This is a translation for your convenience. The legally binding version is the Spanish one. Read it in Spanish
Data controller
Pablo Pacheco Delgado (Isla IA), Tax ID NIF pendiente, Santa Cruz de Tenerife, Islas Canarias. Contact for any privacy matter: hola@islaia.es.
What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your enquiries (form, email, WhatsApp) | Name, email, phone, business and message | Your consent and pre-contractual steps (Art. 6(1)(a) and 6(1)(b) GDPR) | Until the enquiry is resolved and for 2 years at most |
| Client area: account, contracted services and support | Name, email, phone, company, tax ID, address and encrypted password | Performance of the contract (Art. 6(1)(b) GDPR) | For as long as the relationship lasts and the legal periods after it |
| Invoicing and tax obligations | Tax and billing details | Legal obligation (Art. 6(1)(c) GDPR) | The periods set by tax and commercial law (usually 4 to 6 years) |
| Questionnaires, files, quotes and requests in the client area | Answers, photos, videos, documents and links you give us | Performance of the contract or pre-contractual steps (Art. 6(1)(b) GDPR) | For as long as the relationship lasts; you can ask us to delete them sooner |
| Newsletter (tips and ideas for your business, once a month) | Email and name | Your consent (Art. 6(1)(a) GDPR), with double opt-in | Until you unsubscribe with the button in each email or from “My details” |
| Offers and promotions of our services (a separate list from the newsletter) | Email and name | Your express, separate consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE) | Until you unsubscribe with the button in each email or from “My details” |
| Website visit statistics | Page, referrer, country, device and language, without IP address | Your consent in the cookie notice (Art. 6(1)(a) GDPR) | 13 months |
| Website security (preventing abuse and unauthorised access) | IP address and technical logs | Legitimate interest (Art. 6(1)(f) GDPR) | Up to 90 days |
We do not make automated decisions with legal effects on you, nor do we build commercial profiles.
Recipients and processors
We do not share your data with third parties unless required by law. To provide the service we use providers acting as processors under a contract compliant with Art. 28 GDPR:
- Cloudflare (website hosting, database and files). The database and files are stored in data centres in the European Union. Cloudflare, Inc. participates in the EU-US Data Privacy Framework for any access from outside the EU.
- Cloudflare Email Service (sending automatic emails, the newsletter and offers), under the same Cloudflare contract.
- Microsoft 365, contracted through GoDaddy (our mailbox, where we receive what you write to us).
- Unsplash (some photos on the website): when they load it receives your IP address, without cookies.
- Meta (WhatsApp), only if you choose to message us on WhatsApp, under its own privacy policy.
Your rights
You can access, rectify or erase your data, object to or restrict its processing, request its portability and withdraw your consent at any time by writing to hola@islaia.es. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Security
Passwords are stored encrypted with a key derivation algorithm and random salt; nobody, not even us, can see them. Connections are always encrypted (HTTPS) and each client can only see their own information.