1. Data controller
- Controller: Carmen Gurruchaga
- Trading name: BENATT
- Tax ID: 44144921D
- Professional address: Antziola 30, Hernani, Gipuzkoa, Spain
- Privacy email: hello@benatt.com
2. Personal data we process
Depending on how you interact with BENATT, we may process identification and contact details, information about your business or project, content you provide through forms, documents or communications, information required to manage a client relationship and limited technical data related to website security and operation.
Please do not provide sensitive information that is not necessary for the service.
3. Purposes and legal bases
Responding to enquiries and commercial requests
We use the information you send us to respond to enquiries, assess project fit and communicate before a possible engagement. The legal basis is taking pre-contractual steps at your request and, where appropriate, our legitimate interest in responding to communications related to our business.
Managing projects and clients
Where a professional relationship exists, we process the information required to prepare, deliver and administer the project, including onboarding, coordination, billing, agreed support and handover documentation. The legal basis is performance of the contract and compliance with legal obligations.
Legal obligations
We may retain and process certain information where necessary to comply with tax, accounting, administrative or other legal obligations.
Security and abuse prevention
We may process limited technical data to protect the website and prevent spam, fraud, unauthorised access or abusive use. The legal basis is our legitimate interest in maintaining the security and availability of the service.
Marketing communications
We will only send promotional communications where a valid legal basis exists. Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.
4. Forms and onboarding
Initial contact forms and onboarding forms serve different purposes. Contact forms are used to respond to an enquiry or assess a potential professional relationship. Onboarding is used to collect information required to prepare or deliver a project that has already started or is at an advanced contracting stage.
Onboarding responses are treated as working information and do not by themselves approve decisions, scope changes or contractual terms.
5. Retention
Personal data is retained only for as long as necessary for the purpose for which it was collected and to meet applicable legal obligations.
- Enquiries that do not become projects will be deleted or anonymised once they are no longer reasonably needed for follow-up, unless a legitimate reason requires longer retention.
- Onboarding and project information will be kept during the professional relationship and afterwards for the periods needed to address contractual or legal responsibilities.
- Documents subject to tax or accounting obligations will be retained for the legally required periods.
- Technical security data will be retained for periods proportionate to its purpose.
BENATT applies an internal data-minimisation and periodic review policy.
6. Recipients and service providers
We do not sell personal data or disclose it to third parties for their own advertising purposes. Certain technology providers may access information only where necessary to provide services to BENATT, such as hosting, storage, email delivery, form handling or technical infrastructure.
Where those providers act as processors, appropriate contractual safeguards are used. If processing involves an international data transfer, the safeguards required by data-protection law will be applied.
7. Your rights
You may request access to your personal data, correction, deletion, restriction of processing, objection and, where applicable, portability. You may also withdraw consent previously given.
To exercise your rights, email hello@benatt.com stating which right you wish to exercise and providing only the information reasonably necessary to identify your request.
If you believe your rights have not been handled correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
8. Accuracy of information
Anyone providing information to BENATT is responsible for ensuring that it is appropriate and accurate and for communicating relevant changes when needed for proper service delivery.
9. Third-party personal data
If you provide personal data relating to another person as part of a project, you must ensure that you have a lawful basis to do so and that the information shared is strictly necessary.
10. Security
BENATT applies technical and organisational measures proportionate to the type of information processed and reviews access, providers and retention periods with the aim of reducing the risk of loss, unauthorised access or disclosure.
11. Changes to this policy
We may update this policy to reflect legal, technical or process changes. The current version will always be the one published on this page.