Legal information

Privacy policy

What data this website collects, what it is used for and what rights you have over it.

Last updated: 6 October 2026

Data controller

What data this website collects

Contact form

You can write to the firm or ask to be called. If you choose to write, the form asks for your name, your email address and your message; if you prefer to be called, your name, your phone number, your message and the time slot that suits you best. What you send arrives in the firm’s inbox.

Appointment requests

Appointments are requested with that same form, by phone or by email. The website has no online calendar: the firm replies to propose a day and a time, using the details you left.

Map

The map on the contact page is from OpenStreetMap. When it is shown, your browser requests the map images from OpenStreetMap’s servers (www.openstreetmap.org and tile.openstreetmap.org), which receive your IP address, as with any request to a website.

Fonts

To display its fonts, the website requests them from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which receives your IP address.

What the website stores in your browser is detailed in the cookie policy.

What it is used for

The data from the form is used only to answer your enquiry and, if you request an appointment, to arrange it. It is not used to send you advertising.

Legal basis

  • Enquiries: your consent, given when you send the form.
  • Appointment requests: steps taken at your request before entering into a contract.

How long it is kept

  • Enquiries: until they are dealt with and, at most, one year.
  • Appointment requests: until the appointment and, at most, one year.

Who else has access to the data

The website is built and hosted by DAOTOMATA FZE (Business Center, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates), which processes the data on behalf of the firm as data processor, under a contract that complies with article 28 of the General Data Protection Regulation. To provide the service, Daotomata uses these providers:

  • Hostinger: the server and its backups, in Paris (France).
  • Cloudflare: delivers the website and protects it from attacks; it receives the IP address and the website traffic.
  • Resend: sends the firm the notification with the content of the form.

The data is not disclosed to anyone else, unless required by law.

International transfers

Daotomata is a company in the United Arab Emirates and accesses the data from outside the European Union; that transfer is covered by the European Commission’s standard contractual clauses. Cloudflare and Resend are United States companies certified under the EU-US Data Privacy Framework.

Your rights

You can request access to your data, its rectification or erasure, the restriction of its processing, object to it, request its portability and withdraw your consent at any time. To exercise them, write to gestoria@vilanovagestio.com or to the firm’s address. If there is any doubt about who is making the request, the firm may ask you to prove your identity.

If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).