Privacy Policy
This is a translation. The legally binding version is the Spanish original, Política de Privacidad. In the event of any discrepancy, the Spanish text prevails.
Last updated: 17 August 2026
This policy explains what personal data we process when you visit web.yatoday.es, write to us, or subscribe to our Website as a Service offering. It is written to comply with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).
If you arrived here from one of our clients’ websites, read section 10 first: on those sites the client is the controller, not us.
1. Data controller
| Legal name | Yatoday, S.L. |
| Trading as | Yatoday |
| Tax ID (NIF) | PENDIENTE DE COMPLETAR / TO BE COMPLETED |
| Registered address | PENDIENTE DE COMPLETAR / TO BE COMPLETED |
| Companies register | PENDIENTE DE COMPLETAR / TO BE COMPLETED |
| [email protected] | |
| Website | web.yatoday.es |
Data Protection Officer (DPO). We have not appointed a DPO, as none of the conditions in Article 37(1) GDPR or Article 34 LOPDGDD apply to us. For any privacy matter, write to
2. Summary
| Question | Short answer |
|---|---|
| Who processes my data? | Yatoday, S.L., as controller, when you visit this site or contract with us. |
| What data? | What you give us when you write, what the contract and invoicing require, technical browsing data and — only if you accept — analytics data. |
| What for? | Answering your enquiry, delivering and invoicing the subscription, keeping the service secure, evidencing your cookie choice and measuring site usage. |
| On what basis? | Pre-contractual steps, performance of a contract, legal obligations, our legitimate interest and, for analytics, your consent. |
| Who receives it? | Only the providers we need to operate and invoice. We do not sell it. |
| For how long? | See the table in section 4. |
| What can I do? | Access, rectify, erase, object, restrict, port your data, withdraw consent and lodge a complaint with the AEPD. |
3. What data we process and where it comes from
This site has no forms. Every piece of identifying data comes from you, voluntarily.
a) Data you give us when you get in touch. When you write by email, WhatsApp or Telegram you provide your name or alias, the identifier of the channel you use (email address, phone number or Telegram username), the content of your message and anything you choose to include about your business or project.
b) Data needed for the subscription. If you subscribe: name or company name, tax ID, billing address, contact person, email and phone, plus the payment details handled directly by our payment provider.
c) Content you give us to build your website. Text, images, logos and contact details you choose to publish. Where those materials contain third-party personal data (for example, photographs of your team), we act as processor on your behalf and you are responsible for having a lawful basis for them.
d) Technical browsing data. When any page loads, our hosting provider logs the IP address, user agent, date and time, requested URL and response code, for delivery, security and abuse-prevention purposes.
e) Data attached to your cookie choice. A random identifier (UUID) generated in your browser, your decision, the categories accepted, the consent policy version, the URL where you decided, the language, your user agent and your IP address.
f) Analytics data. Only if you accept: browsing events managed through Google Tag Manager, page views, traffic source, device type and approximate location derived from a truncated IP address.
We do not process special categories of data (Article 9 GDPR).
4. Purposes, legal bases and retention periods
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Answering your enquiry and preparing a proposal, by email, WhatsApp or Telegram, and following it up in our CRM | Pre-contractual steps at your request (Art. 6(1)(b)); legitimate interest in managing the enquiries we receive (Art. 6(1)(f)) | 2 years from the last contact, if it does not lead to a contract |
| Delivering the Website as a Service subscription: design, development, hosting, maintenance and support | Performance of a contract (Art. 6(1)(b)) | For the duration of the contractual relationship |
| Collecting payments, issuing invoices and meeting accounting and tax obligations | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | 6 years (Art. 30 Spanish Commercial Code) and 4 years for tax purposes (Art. 66 LGT) |
| Recording and being able to evidence your cookie choice, including its change history | Legal obligation to demonstrate consent (Art. 6(1)(c) read with Art. 7(1) GDPR and Art. 22(2) LSSI-CE) | 24 months from your last decision |
| Measuring site usage through Google Tag Manager | Your consent (Art. 6(1)(a) and Art. 22(2) LSSI-CE) | Up to 14 months, or until you withdraw consent |
| Keeping the site and platform secure, preventing abuse and diagnosing incidents | Legitimate interest in keeping the service available and protected (Art. 6(1)(f)) | 12 months |
| Handling rights requests and evidencing that they were handled | Legal obligation (Art. 6(1)(c)) | 3 years from the reply |
Where the basis is legitimate interest, we have carried out the corresponding balancing test against your rights and freedoms; you can request a summary at
Once these periods expire, data is deleted or anonymised. It may remain blocked, available solely to courts, tribunals and public authorities, for the limitation periods of any liabilities (Art. 32 LOPDGDD).
End of contract. Under our Terms and Conditions, 30 days after non-payment or cancellation the website and its data may be permanently deleted from our servers. We recommend requesting your copy before then; we will provide it in a standard format.
5. Contact via WhatsApp and Telegram
The contact buttons open a conversation on those services. Their operators process your data as independent controllers, under their own policies: WhatsApp and Telegram.
Telegram FZ-LLC is established in the United Arab Emirates, a country with no European Commission adequacy decision. By voluntarily choosing that channel, the transfer relies on Article 49(1)(a) GDPR (explicit consent, having been informed of the possible risks arising from the absence of an adequacy decision and appropriate safeguards). If you prefer to avoid it, email us at [email protected] — always available and equivalent.
6. Cookies
We use strictly necessary cookies, which require no consent, and analytics cookies, which are only set if you accept them. Until you decide, Google’s consent mode stays in the denied state. You can change your decision at any time through the floating cookie button. Full detail is in our Cookie Policy.
7. Recipients and processors
We do not sell or disclose your data for commercial purposes. We rely on the following providers, acting as processors under an Article 28 GDPR contract unless stated otherwise:
| Provider | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. / Cloudflare Ireland Ltd. | Static site hosting, CDN, attack protection and file storage | EU, with access from the US | EU-US Data Privacy Framework (Decision 2023/1795) and Standard Contractual Clauses |
| Hetzner Online GmbH | Our platform servers: application, database, CRM and consent store | Germany and Finland (EU) | Processing within the EEA; not applicable |
| Mailgun Technologies, Inc. (Sinch group) | Transactional email delivery | Provider’s European region | Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Subscription payment processing | Ireland (EU), with access by Stripe, Inc. from the US | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Limited | Google Tag Manager and analytics | Ireland (EU), with access from the US | EU-US Data Privacy Framework and Standard Contractual Clauses |
| WhatsApp Ireland Limited (Meta group) | Messaging channel, if you choose to use it | Ireland (EU) | Independent controller; not applicable |
| Telegram FZ-LLC | Messaging channel, if you choose to use it | United Arab Emirates | Independent controller; Art. 49(1)(a) GDPR (see section 5) |
| Tax and accounting advisers | Accounting, tax and company-law obligations | Spain (EU) | Processing within the EEA; not applicable |
We may also disclose data to courts, tribunals, law enforcement, the Spanish Tax Agency and other public authorities where legally required.
Payment details (card number, expiry date, security code) are entered directly into Stripe’s environment and are never accessible to us.
8. International transfers
Our core infrastructure is in the European Union. Transfers to the United States in the table above rely on the adequacy decision for the EU-US Data Privacy Framework, to which those providers are certified, and additionally on the Standard Contractual Clauses approved by the European Commission. The validity of that decision is under judicial review before the Court of Justice of the European Union; should it cease to apply, the transfer would rest solely on the Standard Contractual Clauses together with any supplementary measures required.
The transfer to the United Arab Emirates (Telegram) relies exclusively on your explicit consent in choosing that channel (Art. 49(1)(a) GDPR). You may request a copy of the safeguards applied at [email protected].
9. Automated decision-making and profiling
We make no automated decisions producing legal or similarly significant effects on you (Art. 22 GDPR), and we do not carry out profiling. Our analytics is aggregated and statistical.
10. Our role on our clients’ websites
This section matters for understanding how responsibility is divided in the service we provide.
The websites we build and host for our clients are theirs. As regards the personal data those sites collect — for example, when a visitor submits a contact or quote form — the position is:
- The client is the data controller. They decide why the data is collected, they use it to handle the request, and they are who the visitor exercises their rights against.
- Yatoday, S.L. is the processor. We provide the website, the API that receives the submissions, the CRM in which the client manages them, and the cookie consent record — all hosted on
{legal.platformHost}, on servers located in the European Union. We act solely on the client’s instructions, under an Article 28 GDPR processing agreement. - We do not use that data for our own purposes, we do not disclose it to third parties, we do not commercialise it and we do not use it to send communications. Each client’s data is segregated and never visible to another client.
- Every client website publishes its own privacy policy, on its own domain, naming the client as controller and describing in detail what data is collected and what happens to it. That is the policy that applies to a visitor of that site; this one applies only to
{legal.siteLabel}. - On termination, and as the client instructs, we delete or return the personal data processed on their behalf, in accordance with Article 28(3)(g) GDPR.
If you are a visitor to one of our clients’ sites and cannot reach them, you may write to
[email protected]: we will pass your request to the controller and assist them in handling it, as Article 28(3)(e) GDPR requires. The answer always comes from the controller.
11. Minors
This site is aimed at professionals and businesses, not minors. We do not knowingly collect data from children under 14, the age from which Article 7 LOPDGDD allows consent to be given by the child.
12. Security
We apply the appropriate technical and organisational measures required by Article 32 GDPR: TLS encryption of all communications; hosting in European Union data centres; role-based access control and least privilege; strict segregation of each client’s data; regular backups; access and consent-change logging; and rate limiting to prevent automated abuse.
Should a security breach occur that poses a high risk to your rights, we will inform you without undue delay and notify the AEPD in accordance with Articles 33 and 34 GDPR.
13. Your rights
| Right | What it allows |
|---|---|
| Access (Art. 15) | Find out whether we process your data and obtain a copy. |
| Rectification (Art. 16) | Correct inaccurate data or complete incomplete data. |
| Erasure (Art. 17) | Ask us to delete your data when it is no longer necessary. |
| Restriction (Art. 18) | Ask us to keep the data but suspend its use. |
| Portability (Art. 20) | Receive the data you gave us in a structured format, or have it transmitted to another provider. |
| Objection (Art. 21) | Object to processing based on legitimate interest, on grounds relating to your particular situation. |
| Withdrawal of consent (Art. 7(3)) | Withdraw it at any time, without retroactive effect. For cookies, the floating button is enough. |
How to exercise them. Write to [email protected] stating which right you wish to exercise. We may ask for additional information to verify your identity where there is reasonable doubt (Art. 12(6) GDPR). Exercising your rights is free of charge and we will reply within one month, extendable by two further months for complex requests.
Complaints. You may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
14. Obligation to provide data
Browsing this site requires no data at all. To take out the subscription, identification and billing data are necessary: without them we cannot enter into the contract or issue the invoices the law requires us to issue.
15. Changes to this policy
We may update this policy to reflect changes in our processing, in the providers we use or in applicable law. The version in force is the one published on this page, with the date shown at the top. Where a change materially affects the purposes or legal bases, we will increment the cookie consent version so that you are asked again.
16. Language of this document
This document is published in Spanish, English and Russian — the three languages in which this website is offered — so that you can read it in your own (Art. 12(1) GDPR).
The Spanish version is the only prevailing version. The English and Russian versions are translations provided for your understanding; in the event of any discrepancy between them, the Spanish text prevails, as it is the language of the controller, of the contract and of the competent supervisory authority.