Legal
Privacy Policy
Last updated: 2026-08-20
Important notice: this document accurately describes the data that this web application collects and how it is processed, based on the site's current code. It does not replace legal advice. Company identification fields marked [PLACEHOLDER] must be completed before publishing this policy, and legal review is recommended before operating in the US and EU.
1. Data Controller
AMBZ SERVICES SL, Sociedad de Responsabilidad Limitada (Spanish limited liability company)
Tax ID (CIF): B09682196
Address: L'Estació, Novelda, Alicante, Spain
Contact email: info@ambzservices.com
Phone: +34 629 04 75 38
Data Protection Officer: not applicable (not legally required for this company's size and activity)
2. What data we collect
This site collects only the data listed below — there is no user account system, no customer portal, and no online purchase flow:
- Contact form: name, email, phone (optional), and your message. Sent directly by email to our contact address and not stored in any database of ours.
- Cookie consent: an anonymous identifier generated in your browser, the date/time of your decision, the policy version in force at that time, and which categories you accepted or rejected. It does not include your IP address or any directly identifying data.
- Browsing data (only if you accept the "Analytics" category): pages visited, visit duration, device/browser type, and approximate location by IP (IP anonymized), collected via Google Analytics.
- Technical server logs: like any website, our hosting provider may log IP addresses and request metadata for security and technical operation. Hosting provider: Vercel Inc. (website) and Railway Corporation (content management panel), both US-based.
We do not collect payment card data, health information, biometric data, or any special category of data under GDPR (Art. 9) or similar laws.
3. Purpose and legal basis
- Contact form: to respond to your inquiry or quote request. Legal basis: steps taken at your request prior to entering a contract (GDPR Art. 6.1.b) or legitimate interest in handling your inquiry (Art. 6.1.f).
- Analytics (Google Analytics): to understand site usage and improve it. Legal basis: your explicit consent (Art. 6.1.a) — only activates if you accept it.
- Consent record: to demonstrate that consent was validly obtained. Legal basis: accountability obligation/legitimate interest (Art. 5.2 and 7.1 GDPR).
4. Who we share data with (processors)
| Provider | What it receives | Purpose | Location |
|---|---|---|---|
| Resend | Name, email, phone, message from the form | Sending the contact email | US / EU (per their configuration) |
| Google Analytics | Anonymized browsing data | Usage statistics (only with your consent) | US |
| Google Maps | Technical data when the embedded map loads | Showing our location | US |
| Cloudinary | None from visitors — only hosts images we upload | Optimized delivery of catalog images | US / global CDN |
| Strapi (CMS) | Catalog content — no visitor data | Content management | Railway (US) |
International transfers: some providers (Google, Resend, Cloudinary) may process data outside the EEA, primarily in the US. Where this occurs, these providers state they rely on mechanisms such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. [PLACEHOLDER: verify and document each provider's current mechanism before publishing].
We do not sell or share your data for third-party advertising purposes.
5. Data retention
- Contact form messages are sent by email and not stored in our own systems; their subsequent retention depends on your own email management.
- Consent records are kept while that consent is in force, plus a reasonable period afterward to be able to demonstrate it — we recommend defining a concrete period (e.g. 24 months since the last interaction) [PLACEHOLDER: business decision, ideally with legal advice].
- Google Analytics data is retained per your Google Analytics account's retention settings (configurable, 14 months recommended).
6. Your rights
Depending on your jurisdiction (GDPR in the EU, US state laws such as the CCPA/CPRA in California, etc.), you may have the right to:
- Access the data we hold about you
- Request correction or deletion
- Withdraw consent at any time (without affecting prior processing)
- Object to processing or request its restriction
- Data portability, where applicable
- Lodge a complaint with your supervisory authority (in Spain, the AEPD)
To exercise any of these rights, email us at info@ambzservices.com. Given the currently expected volume of requests, we handle them manually case by case; if volume grows, we will implement a more formal process.
[PLACEHOLDER]Confirm whether this business meets CCPA/CPRA applicability thresholds (revenue, volume of California residents' data, etc.) — this requires specific legal review.
7. Cookies
Full details on cookies and similar technologies are in our Cookie Policy.
8. Security
We apply reasonable technical measures: encryption in transit (HTTPS), security headers, validation and rate-limiting on the contact form, and restricted access to our content management panel. No system is 100% secure; if you discover a vulnerability, contact us at info@ambzservices.com.
9. Children
This site is not directed at minors and we do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy. Material changes will be reflected with a new "last updated" date and, when they affect cookies, will invalidate your previously recorded consent, showing you the cookie notice again.