Privacy policy

1. Who we are

Yerbabuena Digital (“we”, “us”) is the data controller for personal data processed through this website and our project inquiry channels.

Contact: hola@yerbabuena.digital · +34 681 313 868 · service area: Vélez-Málaga / Axarquía, Spain. We do not publish a visitable street address.

We operate as a digital studio from the Axarquía, serving local businesses in person and remote clients where the scope allows.

2. Data we collect

Depending on how you interact with us, we may process:

• Identity and contact data: name, email address, company name, phone number if you provide it.
• Project data: service interest, budget range, message content and any files you choose to send.
• Technical data: aggregated, anonymous page views measured without cookies by Vercel Web Analytics, and search performance data from Google Search Console.
• Cookies: this site sets no cookies that require consent (see our cookie policy).

3. Why we use your data

We use personal data only when we have a lawful basis under the GDPR and Spanish LOPDGDD:

• To respond to project inquiries and prepare quotes (contract steps / legitimate interest).
• To deliver services under a signed agreement (performance of a contract).
• To maintain site security, prevent abuse and improve usability (legitimate interest).
• To comply with legal obligations (tax, accounting, regulatory requests).
• With your consent, for marketing communications — you may withdraw consent at any time.

4. How long we keep data

Inquiry records are kept for up to 24 months after our last meaningful contact unless a project proceeds.

Client project data is retained for the duration of the engagement plus the period required by applicable law (typically 6 years for commercial records in Spain).

Server logs and analytics are kept for the shortest period needed for security and measurement, normally 12 months or less.

5. Who we share data with

We do not sell personal data. We share it only with processors that help us operate — for example email, hosting, CRM or analytics providers — under written agreements that require GDPR-level protection.

We may disclose data when required by law, court order or to protect our rights, users or the public.

6. International transfers

Some providers may process data outside the European Economic Area. When they do, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Your rights

If you are in the EU/EEA or UK, you may:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Request erasure where there is no overriding legal reason to keep it.
• Restrict or object to certain processing.
• Data portability for data processed on consent or contract.
• Withdraw consent without affecting prior lawful processing.
• Lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Security

We apply technical and organizational measures appropriate to the risk — access controls, encryption in transit, least-privilege access and vendor review. No method of transmission over the Internet is 100% secure; we work continuously to improve our controls.

9. Children

Our services are directed at businesses and professionals. We do not knowingly collect data from anyone under 16. Contact us if you believe a minor has provided data and we will delete it.

10. Changes to this policy

We may update this policy to reflect legal or operational changes. We will post the new version on this page with an updated date. Material changes may also be communicated by email where appropriate.

11. Contact

For privacy requests or questions: hola@yerbabuena.digital. We aim to respond within one business day and to complete rights requests within one month.