Privacy policy

1. Data controller

2. Purposes and legal basis

• Clients and suppliers. Managing the contractual or pre-contractual relationship: quotes, invoicing, collections and payments, and the administrative, accounting and tax procedures arising from the provision of the service. Legal basis: performance of the contract (art. 6.1.b GDPR) and compliance with legal obligations (art. 6.1.c GDPR).
• Contact form. Handling and answering the enquiries you send us. Legal basis: your consent when submitting the form (art. 6.1.a GDPR).
• Commercial communications. For clients, sending them information about our services similar to those contracted, unless they object (legitimate interest, art. 6.1.f GDPR and art. 21.2 LSSI). For everyone else, only if they expressly authorise it (consent, art. 6.1.a GDPR).
• Social media. Managing our social media profiles, publishing information about our activity and replying to messages and comments. Legal basis: legitimate interest (art. 6.1.f GDPR) and, for publishing images of people, their consent (art. 6.1.a GDPR). Each social network also processes data under its own privacy policy; for the statistics of our pages we are joint controllers with the platform (art. 26 GDPR).
• WhatsApp. Handling the enquiries you send us via WhatsApp. Legal basis: your consent when you write to us (art. 6.1.a GDPR). The service is provided by WhatsApp Ireland Limited (Meta group), which may process data outside the European Union with GDPR safeguards; please do not send us sensitive data through this channel.

Data is processed only for these purposes. Fields marked with an asterisk (*) in the forms are mandatory: without them we cannot handle the request.

If you are under 14, do not provide us with personal data without the consent of your parents or guardians (art. 7 LOPDGDD).

No automated decisions are made and no profiles are built with your data.

3. Retention

Data will be kept for as long as the service is provided and, afterwards, for the legal periods: 6 years for accounting obligations (art. 30 of the Spanish Commercial Code) and 4 years for tax obligations (art. 66 of the General Tax Law). Enquiry data, for the time needed to handle them. Data for commercial communications, until the person objects or withdraws their consent.

4. Recipients

Data will not be disclosed to third parties, except where required by law. The suppliers who provide services to us (web hosting, IT, advisory…) may access the data as data processors, under the contract required by art. 28 GDPR.

Some suppliers may process data outside the European Economic Area; in that case the GDPR safeguards apply (adequacy decisions or standard contractual clauses).

5. Rights

You may exercise your rights of access, rectification, erasure, objection (in particular, to commercial communications), restriction of processing and portability, and withdraw your consent at any time, by writing to hello@lewelab.com or to Carrer Aragó 5, 08242 Manresa. If you consider that they have not been properly handled, you may file a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es).