Privacy
What data I process, why, and for how long.
This policy complies with Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD). The site has no forms, no newsletter and no user accounts: I process the message or the call you choose to make and the technical data the hosting needs to serve the pages.
Data controller
Data controller
Laura López Real, tax id (NIF) 12342824N, Calle Piedra del Cormorán 2, bloque A, planta 1, puerta 8, 39520 Comillas, Cantabria, Spain, trading as Página Norte. Contact for privacy matters: [email protected].
What data I process and why
What data I process and why
You write on WhatsApp or by email, or you call
- Data
- Your number or your address, your name if you give it, the content of the message and the photos you send
- Purpose
- To answer you and, if you ask, to prepare the brief of your site
- Legal basis
- Legitimate interest in handling your enquiry; pre-contractual steps at your request (art. 6.1.b and f GDPR)
- Retention
- For as long as the conversation lasts and up to two years after, unless it becomes an order
You are a client
- Data
- Contact and invoicing details, the materials of your site and the communications of the order
- Purpose
- To build your site, publish it, invoice and meet tax obligations
- Legal basis
- Performance of the contract; legal obligation (art. 6.1.b and c GDPR)
- Retention
- For the duration of the order and the legal periods after it: in general, four years for tax obligations and six for commercial obligations
You visit the site
- Data
- IP address and technical data of the connection, processed by the hosting provider to serve the pages and protect them from attacks
- Purpose
- Security and operation of the site
- Legal basis
- Legitimate interest (art. 6.1.f GDPR)
- Retention
- The provider's technical logs, for short periods
I make no automated decisions and build no profiles.
Cookies
Cookies
The site uses no cookies: no tracking, no advertising, no analytics, no technical cookies. Its pages are served without third-party scripts, so there is nothing to accept or reject. Should the hosting provider set a strictly necessary cookie to protect the site from attacks, it would need no consent and would be stated here.
Recipients
Recipients
I do not pass your data to third parties except under a legal obligation. To provide the service I use providers that act as processors with the guarantees of art. 28 GDPR:
- Hosting and content delivery: Cloudflare, Inc. (USA, with operations in the EU). International transfers rely on the EU–U.S. Data Privacy Framework and on standard contractual clauses.
- Mailbox: Google Workspace (Google Ireland Ltd.), with the same guarantees.
- Messaging: WhatsApp (WhatsApp Ireland Ltd.), when you choose to write to me there.
Your rights
Your rights
You can access your data, rectify it, erase it, object to its processing, restrict it, ask for its portability and withdraw your consent at any time by writing to [email protected]. I will answer within a month. If you consider that I have not handled your request, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es).
Security
Security
I apply technical and organisational measures appropriate to the risk: the site is served only over HTTPS with security headers, access to the systems is limited and protected with a second authentication factor, and I store no more data than needed.
Minors
Minors
The site is not aimed at children under 14 and I do not knowingly process their data.
Changes
Changes
Any change to this policy will be published here with the date of the last update.
Last updated: 5 November 2026