Privacy and compliance

About this policy

This policy explains which personal data we process, why, for how long and how you can exercise your rights. It applies to this website, to the messages you send us and to our services.

1. Who is responsible

Francisco Javier Resola Medina, a sole trader established in Spain, trading as MARQAB. Spanish tax ID (NIF) 15518602L. Address: C/ Cervantes 9, bajo, 23520 Begíjar (Jaén), Spain. Email: francisco@marqab.ae. We have not appointed a data protection officer because the law does not require one in our case; for any privacy matter, write to francisco@marqab.ae.

2. Which data we process and where they come from

• "Request an example" form: your name, organisation and role (optional), country, email address or WhatsApp number, your message, the service you are interested in and the language of the page. If you tick a contact box, we also keep the date, the channel and the exact version of the text you accepted.
• Messages you send us by email or WhatsApp.
• Professional contact details published by your organisation (for example on its website, in a public directory or in an event catalogue): name, role, organisation and professional address or telephone number.
• Clients: contact and billing details, the contract, deliveries and the files you ask us to seal. These files may contain data about other people (for example the name of a veterinarian or of an owner).
• Browsing: to serve this website, our hosting provider processes the IP address and the technical data of each request. We use no cookies and no audience measurement tools.

On the form, your name, country, at least one contact method and your message are needed; without them we cannot reply. Everything else is optional.

3. Why we use them and on which legal basis

• Replying to your request and sending you the example or the information you ask for: steps taken at your request before a contract (Art. 6(1)(b) GDPR). If you write on behalf of an organisation, our legitimate interest in answering that organisation (Art. 6(1)(f) GDPR and Art. 19 of the Spanish Data Protection Act, LOPDGDD).
• Keeping in touch by WhatsApp or by email: your consent, given separately for each channel (Art. 6(1)(a) GDPR; Art. 21 of the Spanish Information Society Services Act, LSSI).
• Introducing ourselves to your organisation using professional contact details it publishes: legitimate interest (Art. 6(1)(f) GDPR; Art. 19 LOPDGDD). We do this by letter, by telephone or with a single short message asking whether you would like to receive information. We will not send you commercial information by email or WhatsApp unless you ask for it or agree to it.
• Providing the contracted service and client care: contract (Art. 6(1)(b) GDPR).
• Sealing files that contain data about third persons: we act on the client's behalf and on its instructions, under the contract (Art. 28 GDPR).
• Invoicing and accounting: legal obligation (Art. 6(1)(c) GDPR; Spanish tax and commercial law).
• Keeping proof of consents and the list of people who do not wish to receive messages: legal obligation and legitimate interest in showing that we comply (Arts. 6(1)(c), 6(1)(f) and 7(1) GDPR; Art. 23 LOPDGDD).
• Keeping the website secure: legitimate interest (Art. 6(1)(f) GDPR).
• Publishing a record or its show version: only with the written permission of the record's owner. If the owner is an individual, their consent (Art. 6(1)(a) GDPR), which they may withdraw.
• Defending our rights against claims: legitimate interest (Art. 6(1)(f) GDPR).

4. Who receives the data

Only these providers process the data, on our behalf and under contract:

• Cloudflare, Inc. (USA): website hosting and the form database, stored in the European Union.
• Google Cloud EMEA Limited (Ireland): email and the internal notice of each request.
• WhatsApp Ireland Limited (Ireland): only if you contact us through WhatsApp.
• Backblaze, Inc. (USA): backups in Backblaze B2 (EU Central region, the Netherlands). They are encrypted before they leave our computer, so the provider cannot read them.

The time-stamping authority (DigiCert) and the independent public record services receive only the digital fingerprint of each sealed file, never its content or any personal data. The public transparency mirror, hosted on GitHub, contains only random identifiers and digital fingerprints.

We disclose data to the Spanish Tax Agency and other authorities where the law requires it. The banks involved in payments process those data under their own responsibility. We never sell data or pass them to anyone for their own marketing.

5. Transfers outside the European Economic Area

Form records, the vault of sealed records and its backups are stored in the European Union. Email (Google) and WhatsApp (Meta) may involve processing outside the European Union, in particular in the USA. Cloudflare and Backblaze are US companies, although they store our data in the European Union. These transfers rely on the EU-U.S. Data Privacy Framework, in which these companies participate, and on the standard contractual clauses approved by the European Commission, which form part of their contracts. You can ask us for a copy of these safeguards at francisco@marqab.ae. When we write to you or deliver work to you in another country, we are sending you your own data at your request.

6. How long we keep them

• Requests that do not lead to a contract: 12 months after the last contact; then deleted.
• Consent to keep in touch: until you withdraw it. After withdrawal we keep the proof (date, channel and text accepted), blocked, for 3 years, the period during which liability may be claimed, and then delete it.
• List of people who do not wish to receive messages: for as long as we send communications, with the minimum data (address or number, channel and date), so that your choice is respected.
• Published professional details used to introduce ourselves: deleted as soon as you object (only your address or number stays on the list above), or at the latest 12 months after the first contact if there is no reply.
• Clients (contract, correspondence and deliveries): for the duration of the relationship and 6 more years (Art. 30 of the Spanish Commercial Code).
• Invoices and accounts: 6 years; longer only where tax law requires it to support pending items (up to 10 years).
• Files sealed for clients: the period agreed in the contract. If a file is erased, it is also removed from every backup and the erasure is recorded.

7. Your rights

You may ask for access to your data, their rectification or erasure, restriction of processing, portability of the data you gave us, and you may object to processing based on legitimate interest. You may object at any time to receiving commercial communications. If you gave us your consent, you may withdraw it whenever you wish, without affecting what was done before.

Write to francisco@marqab.ae stating which right you are exercising. We will ask you to prove your identity only if we have reasonable doubts. Exercising your rights is at no cost. We will reply within one month, which we may extend by two more months for complex requests, telling you beforehand.

If you believe we have not handled your rights properly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid; sedeagpd.gob.es) or to the authority of your country (sections 11 and 12).

8. How to stop receiving messages

On WhatsApp, reply "STOP". By email, reply with the word "STOP" or write to francisco@marqab.ae. You can also use the page marqab.ae/opt-out. We act on your request without delay and at no cost.

9. Automated decisions

We make no decisions based solely on automated processing and we do not create profiles.

10. Security, minors and cookies

Access to the data is limited to the owner of the business, backups are encrypted, our providers are bound by data processing contracts, and we publish only what the owner of each record has authorised in writing. If we detect a security breach affecting your data, we will act and inform the authority and, where required, you.

This website is intended for professionals and not for minors. If we learn that a child under 14 has sent us data, we will delete it.

Cookies: this website does not place cookies or store any information on your device, so it does not need your consent for that. If we ever used an essential technical cookie, for example for security, we would list it here.

11. If you live in Saudi Arabia

We process your data in line with the Kingdom's Personal Data Protection Law (Royal Decree M/19 of 9/2/1443 H, as amended by Royal Decree M/148 of 5/9/1444 H) and its Implementing Regulation, insofar as they apply to us.

• Legal basis: your consent, the performance of an agreement to which you are a party, or our legitimate interest, which we have assessed and documented in advance and never use for sensitive data.
• Where the data are processed: your data are processed outside the Kingdom, in Spain and the European Union, with the providers listed in section 4. We process only the data needed to answer you or provide the service.
• Commercial messages: we send you commercial information only if you asked for it or agreed to it, or if we have dealt with you before, and you can always ask us to stop just as easily.
• Your rights: to be informed, to access your data, to obtain a copy in a readable format, to ask for their correction or update and for their destruction once they are no longer needed, and to withdraw your consent. We will reply within 30 days at the latest; if we need more time, we will tell you beforehand and why.
• Complaints: you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA, dgp.sdaia.gov.sa).

12. If you live in the United Arab Emirates

We process your data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, insofar as it applies to us.

• Legal basis: your consent, the performance of a contract with you or steps you ask us to take before contracting, and compliance with legal obligations.
• Where the data are processed: your data are processed in Spain and the European Union, which has comprehensive data protection legislation (the General Data Protection Regulation), with the providers listed in section 4.
• Your rights: information, access, portability, rectification, erasure, restriction of processing, objection (including to direct marketing) and objection to automated decisions.
• Complaints: you may complain to the UAE Data Office.
• DIFC and ADGM: if you or your organisation are based in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM), the data protection law of that centre also applies.

13. Changes and languages

If we change this policy, we will publish the new version with its date. If a change affects a consent you gave us, we will ask you again.

This policy is published in Spanish, English and Arabic. In case of doubt the Spanish version prevails, unless another version is more favourable to you.