Privacy policy
Last updated: 22 October 2026
1. Data controller
Guardián de Datos SL, Tax ID B70858147, with registered tax address at Calle El Parral 66, 35559 San Bartolomé (Las Palmas), is the controller responsible for processing the personal data you provide through this website. Data protection contact: dpo@gdatos.io.
2. Categories of data processed
Depending on the process or service you use, we process the following categories of data: identification and contact details (name, company, email, phone); data about your business needed to generate your data protection documentation and register you as a client (company name, tax ID, address, activity, number of employees, whether you have a website or video surveillance systems); login credentials for the client panel of the Guardián de Datos portal (portal.gdatos.io); and, if you buy a paid service online, transaction data handled directly by our payment gateway (see Recipients). We do not process special categories of data (Article 9 GDPR) through this website or the client portal.
3. Source of the data
The data we process always comes directly from you, provided through the contact or purchase forms on this website. We do not obtain your data from third parties or public sources.
4. Purpose of processing
We process the data you provide through the contact form (name, email, company and message) to handle your request for information or a quote and, where applicable, to manage any resulting business relationship. If you buy the Legal Compliance Pack or another service, whether through the online checkout or a registration handled directly with us, we also process the data you provide (company name, tax ID, address, phone, number of employees, activity and billing details) to: manage the contract and, where applicable, process payment; register you and manage your access to the client panel of the Guardián de Datos portal (portal.gdatos.io); generate and keep up to date the data protection documentation configured for your business (legal texts for invoices and quotes, contract templates, legal notice for your website, compliance certificate and QR-code signage); and provide support during the contractual relationship. In addition, when we send you emails from our own mailbox (not the automatic notices sent by the portal), we check whether they have been opened or whether the links they contain have been accessed, in order to follow up the contracted service; this processing is based on contract performance and our legitimate interest, and you may object to it at any time through the Rights Exercise Portal.
5. Legal basis
The legal basis is your consent, given by submitting the contact form, and, where applicable, the performance of pre-contractual measures requested by you. When you buy a paid service, the legal basis is the performance of the contract (Article 6.1.b GDPR), together with compliance with legal obligations on tax and invoicing.
6. Recipients
Data is not shared with third parties except where legally required. Data may be processed by technology providers offering web hosting and communication services, acting as data processors, including Mailsuite, which lets us know whether the emails we send have been opened. When you buy a paid service online, the data needed to process payment (name, email and card details) is processed directly by Stripe Payments Europe, Ltd., our payment gateway, which acts as data processor and is responsible for the security of payment data; Guardián de Datos never stores your card details.
7. International data transfers
Data is hosted in the European Union (Germany and Ireland). Stripe Payments Europe, Ltd. may transfer certain data outside the European Economic Area to provide its payment service. These transfers are covered by the safeguards provided in the GDPR (standard contractual clauses approved by the European Commission). More information is available in Stripe's privacy policy (stripe.com/privacy). Guardián de Datos itself carries out no other international data transfers.
8. Retention
Contact form data is kept for as long as needed to handle your request and is deleted if no business relationship is formed. If you buy a service, data is kept for the duration of the contractual relationship and afterwards for the limitation periods of any liabilities that may arise (generally up to 6 years for tax and accounting records under Article 30 of the Spanish Commercial Code, and up to 4 years for the purposes of the General Tax Law).
9. Automated decision-making and profiling
We do not make automated decisions or carry out profiling that produces legal effects on you or similarly significantly affects you.
10. Security measures
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including encryption of communications (HTTPS) and restricted access to data by our staff.
11. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability through our Rights Exercise Portal, available 24/7 at portal.gdatos.io/derechos/gdatos, or by writing to dpo@gdatos.io, stating the right you wish to exercise and attaching a copy of an identification document. If you consider that the processing of your data does not comply with the regulations, you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its electronic office (sedeagpd.gob.es).
12. Social Publishing: connection with Facebook, Instagram, LinkedIn, TikTok and YouTube
If you use the Social Publishing service of the GDatos portal (portal.gdatos.io) and connect your accounts, each network sends us, with your express authorisation on its own permission screen, the ID and name of the account, Page or channel you choose and an access token. We never receive your passwords. We use this data only to show you which accounts are connected and to publish on them the content (text, image or video) that you review and approve in the portal calendar; we never post without your approval, we do not read your private messages or activity, and we do not use this data for advertising, profiling, sale to third parties or training artificial intelligence models. Tokens are stored encrypted on servers in the European Union (Supabase Vault), accessible only by the portal server, and kept while the account remains connected: when you click «Remove» in Social Publishing → Connected accounts, or when you cancel the service, they are deleted immediately. You can also revoke access from the network itself (Facebook: Settings → Business integrations; TikTok: Settings → Security → Apps and services; Google: myaccount.google.com/permissions) or ask us to delete your data at dpo@gdatos.io or portal.gdatos.io/derechos; we will do so within 30 days. Who we share this data with (including Google user data): only with the providers that run the service, as data processors under contracts that oblige them to use it solely for that purpose: Supabase (database and encrypted storage, servers in the European Union) and Vercel (server that runs the portal). The video and text you approve are sent only to the network where you choose to publish them (for example, YouTube). We do not sell, share or transfer this data to any other third party, except where required by law. YouTube: this feature uses the YouTube API Services; by connecting your channel you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy) applies. GDatos' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The legal basis is the performance of the contract for the service you request.