— Legal —

Privacy policy

Last updated: 14 October 2026

This policy explains how your data is processed when you visit hambrosia.es or contact Hambrosía using the form, email or WhatsApp Business.

Data controller

Hambrosía is the trading name of Francisco Miguez Portela, who provides the services as a self-employed professional.

Operator: Francisco Miguez Portela
Privacy contact: privacidad@hambrosia.es

The data we process and its sources

We process the information you provide when contacting us: your name, email address, phone number, company and the contents of your enquiry or subsequent correspondence. The form requires a name, email address and message; phone number and company are optional. Without the information needed to contact you or understand your request, we cannot handle it through that channel.

When you use WhatsApp Business, we receive your phone number, the profile information you make visible to us and any messages or files you choose to send. We currently handle conversations manually and do not back them up to Google Drive or iCloud.

Connecting to the website requires technical information, such as your IP address and the browser request, to deliver the pages and maintain the operation and security of the service. Optional visitor measurement is described in the analytics section.

Purposes and legal bases

Handling requests about our services and preparing quotations or proposals you request. Where your enquiry concerns a possible contract, processing is based on steps taken at your request before entering into a contract (GDPR Article 6(1)(b)).
Answering other enquiries you initiate and communicating with people representing a business. The basis is our legitimate interest in handling those communications, using only the information necessary for that contact (GDPR Article 6(1)(f) and, where applicable, Article 19 of the Spanish LOPDGDD).
Providing the website, preventing abuse and handling technical incidents, based on our legitimate interest in maintaining a secure and available service.
Measuring visits and certain website actions only when you accept analytics, based on your consent (GDPR Article 6(1)(a)).

Commercial correspondence is limited to responding to what you have requested, including related quotations and proposals. We currently do not send newsletters, promotions or unsolicited offers following an enquiry.

Hambrosía does not use AI to summarise, analyse or answer these enquiries. We do not make automated decisions with legal or similarly significant effects about people contacting us or create commercial profiles from their messages.

Data retention

Enquiries and quotations that do not lead to a contract: up to 12 months after the enquiry closes or the last related interaction. We review email and WhatsApp quarterly to manage deletion when the retention period ends.
Detailed analytics data: up to 12 months after collection, with periodic deletion of older records.
Analytics choice: valid for 180 days in this browser. Once it expires, a new choice is requested before measurement is activated again.
Where a legal retention obligation or a specific claim applies, only the necessary information is retained for the applicable period, with restricted access and without being used for other purposes.

Providers also retain records necessary to deliver their services. Resend publishes a 30-day retention period for emails and logs on its Free, Pro and Scale plans. Its retention information is linked below.

If an enquiry leads to a service contract, retention of the related documentation and any processing on behalf of the customer will be addressed in the relevant terms and agreements.

Access and service providers

Access to correspondence is limited to the operator and people authorised to handle it. Email aliases are used to organise and distribute messages for this purpose.

These providers process the information needed to provide their services under the applicable contracts and terms. Data may be disclosed to authorities where required by law. We do not sell contact data or disclose it to other businesses to send you advertising.

Processing outside the European Economic Area

Although the website server is located in Spain, some providers may process data outside the European Economic Area. Resend states that it stores data in the United States; Google and WhatsApp also provide for international processing. Applicable safeguards are described in their data protection agreements, including European Commission standard contractual clauses and adequacy decisions where applicable. You can consult these agreements or request information about the safeguards using the privacy contact.

Optional Umami analytics

We use self-hosted Umami to measure pages visited, referral sources, browser or device type, approximate country and actions such as clicking a contact link or starting or submitting the form. Umami uses technical session identifiers and does not use tracking cookies. These statistics do not receive the name, email, phone number, company or message entered in the form.

The tool loads only after you accept analytics. Rejecting it allows you to continue browsing and send enquiries. You can withdraw consent or change your choice using “Privacy preferences” in the footer. Withdrawal stops subsequent measurement and does not affect the lawfulness of previous processing.

Preferences stored in your browser

We use local storage to remember the analytics choice and your light or dark theme preference. These are preferences for this browser. The analytics choice is valid for 180 days; the theme preference remains until you change it or clear the website data. You can remove both using your browser settings. Removing the analytics choice means we will ask for it again.

Your rights

You can request access, rectification or erasure of your data, restriction of processing and, where applicable, data portability. You may also object to processing based on legitimate interest and withdraw your analytics consent.

Email privacidad@hambrosia.es with your request and the information needed to locate the correspondence. Where there are reasonable doubts about your identity, we may ask for the information necessary to verify it; we do not require an identity document copy by default. We normally respond within one month. For complex requests, this period may be extended by two more months, with notice within the first month.

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Access and protection of information

We restrict access to people handling enquiries and use HTTPS connections on the website. Email and WhatsApp enquiries are handled using the services described in this policy. Please provide only the information necessary to explain your request.

Policy changes

We will update this information when contact channels, tools or processing purposes change. The revision date appears at the start. If a new purpose requires your consent, it will be requested before your data is used for that purpose.