Privacy Policy

This English version is provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.

1. Data controller

The controller of the personal data collected through this website is:

2. Data we process

We process only the data that you voluntarily provide to us through the website's forms and contact channels, as well as technical browsing data collected by cookies and analytics tools. Specifically:

• Contact data: name, company, email, telephone number, estimated budget and message, collected when you complete the form on the Contact page.
• Proof of consent: when you accept this Privacy Policy on submitting the form, we record the timestamp of your acceptance together with the rest of the data, as evidence required by Article 7 of the General Data Protection Regulation (GDPR).
• Booking data: name, email and selected time slot when you book a diagnostic call through Cal.com at /reservar.
• Communication data: the content of the messages you send us by WhatsApp, email or telephone.
• Technical browsing data: IP address, browser type, device, pages visited and session duration, collected through cookies — see our Cookie Policy.
• Email authentication metadata: when any server sends email on behalf of the shopiworks.com domain, we receive aggregate DMARC reports containing the sending IP address and the result of the SPF/DKIM checks, for security and fraud-prevention purposes.

3. Purposes of processing

We process this data for the following purposes:

• Handling contact requests — responding to your enquiries, proposals and quotation requests sent through the form, email or WhatsApp.
• Arranging meetings — managing the diagnostic calls you book through Cal.com.
• Provision of contracted services — performing the agreed services, including invoicing, operational communications and after-sales support.
• Marketing communications — sending you information about our services, news and success stories, provided that you have given us your express consent.
• Website analysis and improvement — understanding, on an aggregate basis, how the website is used in order to improve the experience and the quality of our services.
• Security and fraud prevention — protecting the website and our domain against abusive access, spam, attacks and impersonation, by means of server logs and DMARC reports.
• Compliance with legal obligations — meeting the accounting, tax and data protection obligations that apply to us.

4. Legal basis

Where the data comes from a user resident in the European Union, the legal bases for the processing, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), are:

• Consent — for sending marketing communications and for the use of cookies that are not strictly necessary.
• Performance of a contract or of pre-contractual measures — to manage the enquiry, quotation, booking or service you have requested.
• Legitimate interest — to improve our services, prevent fraud and protect the security of the website.
• Legal obligation — to retain accounting records and comply with requests from the authorities.

5. Retention periods

We retain the data for as long as necessary to fulfil the purpose for which it was collected and, where applicable, for the limitation periods of any legal actions that may arise from our relationship with the user. By way of reference:

• Contact form leads — up to 24 months from the last contact, unless you request erasure earlier.
• Cal.com bookings — for the life cycle of the meeting and for up to 12 additional months for commercial follow-up.
• Clients with a contractual relationship — for the duration of the relationship and for up to 6 years thereafter owing to applicable accounting and tax obligations.
• Technical server logs — up to 30 days for security and diagnostic purposes.
• DMARC reports — up to 12 months for email authentication auditing.
• Cookies and similar technologies — see the duration of each one in our Cookie Policy.

6. Recipients and international transfers

Your data is not disclosed to third parties except where required by law. However, we use trusted providers that act as processors on behalf of Shopiworks, LLC to provide technical services:

• Vercel Inc. (United States) — website hosting, CDN delivery and operational logs.
• Cloudflare, Inc. (United States) — DNS management for the domain, security proxy and attack mitigation.
• Resend Inc. (United States) — sending the transactional emails generated by the contact form (internal notification and automatic reply to the user).
• Google LLC — Google Workspace (United States) — receipt and management of emails sent to @shopiworks.com accounts and processing of DMARC reports.
• Cal.com, Inc. (United States) — management of online bookings at /reservar.

As these providers are established in the United States, international data transfers are covered by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914) and, where applicable, by their participation in the EU-US Data Privacy Framework. You may request a copy of the applicable safeguards by writing to info@shopiworks.com.

7. Your rights

Regardless of the country from which you access the website, we recognise the following rights in respect of your personal data:

• Access to the data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure(the “right to be forgotten”) where the data is no longer necessary.
• Restriction of processing in certain circumstances.
• Objection to processing based on legitimate interest or carried out for direct marketing purposes.
• Portability of the data to another controller.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

To exercise any of these rights, you may write to us at info@shopiworks.com, stating the right you wish to exercise and enclosing a copy of a document that enables you to be identified. Users resident in the EU also have the right to lodge a complaint with the competent data protection authority.

8. Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, loss or destruction, including encrypted connections (HTTPS), access control to our systems and the selection of providers that meet recognised industry standards.

9. Minors

This website is not directed at persons under the age of 16. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy to reflect legal, technical or business changes. The date shown at the top of the page reflects the most recent update in force.

11. Contact

For any enquiry about this policy, you may write to us at info@shopiworks.com. For further information on the use of cookies, please see our Cookie Policy.