Privacy Policy

Last updated: March 2026

1. Who is responsible for processing your data?

Name: Webiting
Controller: Adil Azzat El Amidi (self-employed)
Tax ID (NIF): 41684422G
Address: Camí del Rector, 1, 17850 Besalú (Girona), Spain
Contact email: info@webiting.es
Phone: +34 672 93 81 39
Website: https://webiting.es

2. Why do we process your data?

We process the personal data you give us through the website's contact forms for the following purposes:

• Handling information requests: dealing with and replying to the enquiries you send us through the contact form.
• Commercial management: preparing quotes, proposals and communications related to the Webiting services you request.
• Pre-contract communications: keeping in touch with you while you evaluate our services.
• Compliance with legal obligations: keeping records where required by law.

We don't use your data to build commercial profiles or to make automated decisions with legal effects on you.

3. What is the legal basis for processing?

Purpose	Legal basis
Replying to your contact enquiry	Consent of the data subject (Art. 6.1.a GDPR)
Managing the pre-contract relationship	Pre-contract measures (Art. 6.1.b GDPR)
Sending quotes and proposals	Legitimate interest / Consent (Art. 6.1.a and f GDPR)
Compliance with legal obligations	Legal obligation (Art. 6.1.c GDPR)

4. What data do we collect?

Through the contact form we only collect the data you provide yourself:

• Full name
• Email address
• Phone number (if you provide it)
• Message content
• Service of interest (if you specify it)

In addition, like any website, our server may automatically log technical access data such as your IP address, the browser used and the page the request came from. This information is used solely for security purposes and is not processed for commercial purposes.

5. How long do we keep your data?

We keep the data provided through the contact form for as long as necessary to handle your request and, where applicable, for the duration of any business relationship. Once that relationship ends, the data will be kept duly blocked for the applicable legal periods (generally up to 6 years under commercial law) and deleted after that.

If no business relationship is established, contact details will be deleted within a maximum of 12 months from the last communication.

6. Who do we share your data with?

We do not share or sell your data to third parties for commercial purposes. However, to provide the service we use the following data processors:

• Supabase, Inc.: the cloud database provider where contact messages are stored. Supabase complies with the GDPR and data is stored on servers in the European Union or with equivalent safeguards. You can read its policy at supabase.com/privacy.
• Hosting providers: The website may be hosted on third-party servers acting as data processors under contract.

In all cases, we require our providers to meet their data protection obligations under Article 28 of the GDPR.

7. International data transfers

Supabase may host data on servers outside the European Economic Area (EEA). In that case, transfers are made with the appropriate safeguards required by the GDPR (European Commission adequacy decisions or Standard Contractual Clauses). For more information, see Supabase's privacy policy.

7b. Use of Artificial Intelligence (AI Act, EU Regulation 2024/1689)

In compliance with Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence (AI Act), we inform you that this website has a virtual assistant based on artificial intelligence:

• AI system used: Claude, developed by Anthropic, PBC (San Francisco, USA). Anthropic's privacy policy.
• Risk classification: Limited-risk system under the AI Act (customer service chatbot).
• Transparency: The assistant clearly identifies itself as an artificial intelligence system in the chat interface.
• Purpose: Answering questions about Webiting's services automatically, available 24/7.
• Data processed: The text the user types into the chat is sent to Anthropic's API to generate a reply. Webiting does not store chat conversation history.
• Model training: Because Anthropic's API is used under commercial terms, conversations are not used to train Anthropic's AI models, in line with Anthropic's policy for API customers.
• International transfer: Chat data is processed by Anthropic on servers in the USA. Anthropic provides adequate data protection safeguards compatible with the GDPR.
• Right to human assistance: If you'd rather be helped by a person instead of the AI assistant, you can contact us at info@webiting.es or on WhatsApp at +34 672 93 81 39.
• Retention by Anthropic: According to its policy, Anthropic may retain API data temporarily to provide the service and detect abuse, but does not use it to train models under commercial terms.

8. What are your rights?

Under the GDPR and the LOPDGDD, you have the right to:

• Access: know what personal data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): ask us to delete your data when it is no longer needed or you withdraw consent.
• Restriction of processing: ask us to suspend processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, send an email to info@webiting.es stating the right you wish to exercise and attaching a copy of your ID document. We will reply within one month at most.

If you believe your data is not being processed in accordance with the law, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Minors

Our services are not aimed at children under 14. If you are under 14, you must not give us your personal data without the consent of your parents or legal guardians. If we become aware that we have received data from minors without such consent, we will delete it immediately.

10. Confidentiality and security

Webiting takes the technical and organisational measures needed to keep your data secure and prevent its alteration, loss, or unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks it is exposed to. Contact data is transmitted over an encrypted connection (HTTPS/TLS) and stored in a database with restricted access.

11. Changes to this policy

We may update this privacy policy to reflect legal, technological or business changes. When we do, we will publish the updated version on this page with the new update date. We recommend you review it periodically.

12. Information notice on forms

In compliance with Article 13 of the GDPR, all forms on the website include the following basic information: