Privacy Policy

1. Data controller

The controller of the personal data described in this policy is BARI BUTI MARKETING S.L., a company registered in Spain with its registered office at CL. GAITA, 19, 41806 Umbrete (Sevilla), Spain.

For any question about this policy, or to exercise the rights set out in section 7, write to info@bari-buti.com. Requests are handled by the company directly and are answered within one month, as required by the General Data Protection Regulation.

2. What we collect

We collect only what is needed to answer an enquiry, deliver contracted work or run this website. There is no data purchase, no enrichment from third-party databases and no profiling of visitors for advertising purposes.

Information you give us

• Name, work email address, company name and website, when you submit the enquiry form on our contact page.
• The content of your message, including any budget range or service selection you choose to provide.
• Your email address, if you subscribe to the quarterly growth briefing.
• Contact and billing details of the individuals we work with at client companies, for the duration of an engagement.

Information collected automatically

• Pages viewed, referring source, approximate region derived from IP address, device type and browser, where you have accepted analytics cookies.
• Technical server log entries, including truncated IP address and request time, retained briefly for security and error diagnosis.

We do not collect special category data as defined in Article 9 of the GDPR, and we ask that you do not include such information in enquiry messages.

3. Purposes and legal basis

Each processing activity has one legal basis, listed below. Where the basis is consent you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

4. Cookies and analytics

This site sets no analytics or advertising cookies until you accept them through the banner shown on your first visit. Choosing Essential only stores a single preference value locally so that the banner does not reappear, and nothing else is recorded.

If you accept analytics, we measure page views, referring sources and which pages precede an enquiry. The purpose is narrow: to know which pages are worth maintaining. We do not build advertising audiences from this site, we do not share the data with advertising networks, and no remarketing pixels are present.

You can withdraw consent at any time by clearing this site's data in your browser, which removes the stored preference and shows the banner again on your next visit.

5. Who we share with

Personal data is not sold, rented or exchanged. It is shared only with the service providers required to operate the business, each acting as a processor under a written agreement that restricts them to our instructions.

• Hosting and email. Infrastructure providers operating within the European Economic Area, which store website files and business correspondence.
• Analytics. A single analytics provider, active only with your consent, configured without cross-site tracking.
• Accounting. Our accountants in Spain, who receive invoice data as required by law.
• Client platforms. During an engagement, our specialists access advertising, analytics and CRM accounts that belong to the client. We do not export personal data from those systems beyond what is needed for the agreed reporting.

Where a provider processes data outside the European Economic Area, transfers are covered by the European Commission's standard contractual clauses. We will confirm the current list of processors on request.

6. Retention periods

• Enquiries that do not become engagements: deleted 24 months after the last contact.
• Client records: retained for the duration of the engagement and six years afterwards, matching the statutory retention period for commercial records in Spain.
• Briefing subscriptions: retained until you unsubscribe, then removed within 30 days.
• Analytics data: retained in aggregated form for 14 months.
• Server logs: retained for 30 days.

Records held to satisfy a legal obligation cannot be deleted earlier on request, but they are moved out of active use and restricted to accounting access only.

7. Your rights

Under the GDPR you may request access to the personal data we hold about you, correction of anything inaccurate, deletion where no legal obligation requires us to keep it, restriction of processing, portability of data you provided to us, and objection to processing based on legitimate interest.

Send the request to info@bari-buti.com. We will confirm receipt and respond within one month. There is no fee, and we will not ask you to justify the request. If we need to verify your identity we will ask for the minimum necessary to do so.

If you are not satisfied with our handling of a request, you may complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the supervisory authority in your own country of residence.

8. Security

The site is served over HTTPS. Access to business systems requires multi-factor authentication, and client platform access is granted per person rather than through shared credentials, so that it can be revoked individually and immediately when an engagement ends.

Enquiry data is held in our business email and CRM systems and is not copied to personal devices. Should a breach occur that is likely to affect your rights, we will notify the supervisory authority within 72 hours and inform you directly where the regulation requires it.

9. Changes to this policy

When this policy changes, the date at the top of the page is updated. Material changes affecting how we use data already collected will be communicated by email to anyone whose data is affected, before the change takes effect.

This policy is governed by Spanish law and by the General Data Protection Regulation (EU) 2016/679.