Privacy policy
Data controller
Controller: Jordi-Joan Ventura Juanola. Spanish Tax ID (NIF): 25371804K. Trade name: WORKSHOP. Address: Carrer de les Moles 17, 4-1, 08002 Barcelona, Spain. Email: workshop.dot.company@gmail.com.
Scope of this policy
This policy applies to the WORKSHOP website, start form, private client portal, contracting and payments, support service and communications addressed to WORKSHOP. It does not apply to clients' online stores or the demonstration store where they operate as independent services with their own policies.
Data we process
We may process identification and contact data, brand name, website or social profiles, billing and project information, onboarding responses, documents and acceptances, payment and subscription information, change requests, support enquiries and messages, files and images supplied, and technical access and security data. WORKSHOP does not receive or store full card details; Stripe processes them. Sensitive data or secrets must not be entered in free-text fields.
Purposes and legal basis
Data is used to manage enquiries and leads, prepare proposals, authenticate portal access, create and retain documents, deliver and track the project, administer payments, subscriptions, support, communications and delivery, prevent misuse and comply with accounting, tax and legal obligations. The legal bases are, as applicable, requested pre-contractual measures, performance of the contract, compliance with legal obligations and the legitimate interest in protecting and administering the service. Where consent is required, it will be requested separately.
Data retention
Leads that do not result in a contract are retained for the time reasonably necessary to respond and follow up, then deleted or anonymised unless a legal obligation or legitimate interest justifies further retention. Project and support data is retained for the contractual relationship and as long as necessary to address liabilities. Contractual, tax, accounting and payment records are retained for the periods required by law.
Service providers and recipients
WORKSHOP uses providers required to deliver the service: Google Workspace and Google Cloud for email, spreadsheets, files and automation; Stripe for payments, subscriptions, invoicing and the payment portal; Vercel for website hosting and execution; and, where applicable, GitHub and domain or infrastructure providers. They receive only the data needed for their function and act under their applicable terms and agreements. Data may also be disclosed where required by law.
International data transfers
Some technology providers may process data from countries outside the European Economic Area. Where an international transfer takes place, mechanisms recognised by applicable law will be used, such as adequacy decisions or standard contractual clauses, together with any additional measures required.
Data relating to store customers
WORKSHOP provides a technical implementation service for online stores. Once a store has been delivered, the main accounts and access credentials remain under the client's control. WORKSHOP does not use the personal data of its clients' customers for its own purposes. If, in order to provide support or carry out a specific intervention, WORKSHOP needs to access personal data relating to customers, users or subscribers on behalf of the client, the applicable data processing agreement will be entered into before such access takes place.
Your rights
You may request access to, rectification or erasure of your personal data, object to or request restriction of its processing and, where applicable, request data portability by writing to workshop.dot.company@gmail.com. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal. You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
Unnecessary data
Please do not send WORKSHOP sensitive personal data or information that is not necessary to respond to your enquiry or provide the contracted service.
Security and credentials
WORKSHOP applies reasonable safeguards and restricts access to project information. Where technical credentials must be configured, they will be requested through restricted channels and retained only for as long as necessary or in the agreed secure password manager. No system is completely infallible; clients must protect their access credentials and notify WORKSHOP immediately if unauthorised use is suspected.
Future changes
If newsletters, analytics, advertising or other tools involving additional processing of personal data are introduced in the future, this policy will be updated before they are used.
Contact: workshop.dot.company@gmail.com
References: AEPD · Información sobre protección de datos