This is a translation. If it differs from the Spanish version, the Spanish version prevails.
This agreement governs, under article 28 of Regulation (EU) 2016/679 (GDPR) and article 33 of Spanish Organic Law 3/2018 (LOPDGDD), the processing bizness.page carries out on behalf of its customers. It is part of the terms and is accepted with them when creating an account.
1. Parties
- Controller: the customer who owns the account.
- Processor: Raúl Ocaña Alcaide, tax ID 15432143V, Calle Venegas, 35003 Las Palmas de Gran Canaria (Islas Canarias, España), who provides bizness.page.
2. Subject, duration and nature
The processor hosts the controller’s landings and, on their behalf, collects the data visitors leave on the forms, sends the confirmation emails, keeps the confirmed data and shows it to the controller to view, export or delete. The processing lasts as long as the account.
3. Data and data subjects
- Data subjects: people who sign up on the forms of the controller’s landings.
- Data: email, first name (if the form asks for it), the form they signed up on, and the sign-up and confirmation dates. No special categories of data are processed.
4. Processor’s obligations
- Process the data only on the controller’s documented instructions: this agreement and their use of the dashboard, the API or MCP.
- Not use it for its own purposes or disclose it to third parties, except to the sub-processors in section 5 or as required by law.
- Ensure that those who access it are bound by confidentiality.
- Apply appropriate security measures (art. 32 GDPR): encryption in transit, data access always filtered by account, confirmation links with random tokens of which only a fingerprint is stored, and limits against abusive submissions.
- Help the controller respond to data subjects’ requests (the dashboard and the API let them view, export and delete each lead) and pass on without delay any request it receives.
- Notify them without undue delay, and in any case within 48 hours, of any security breach affecting their data, with the information available.
- Assist them with the impact assessments and prior consultations they’re responsible for, and make available the information needed to show compliance with this agreement.
5. Sub-processors
The controller authorises the following sub-processors, with whom the processor has agreements imposing the same obligations and the safeguards of chapter V of the GDPR for international transfers:
- Vercel Inc.: hosting of bizness.page and the landings, and their technical logs. Location: USA (EU-US Data Privacy Framework and standard contractual clauses). Processing agreement: https://vercel.com/legal/dpa.
- MongoDB, Inc. (Atlas): database. Location: servers in the European Union; the company, in the USA (standard contractual clauses). Processing agreement: https://www.mongodb.com/legal/data-processing-agreement.
- Resend (Plus Five Five, Inc.): sending email: sign-in, lead confirmation and notices. Location: USA (EU-US Data Privacy Framework and standard contractual clauses). Processing agreement: https://resend.com/legal/dpa.
The processor will email any change to this list 15 days in advance; the controller may object and, if there’s no alternative, close the account.
6. Controller’s obligations
- Say on their landing who they are and what they’ll use the data for, and have a legal basis to process it.
- Use the data only for what they said when collecting it, and handle data subjects’ rights.
7. End of processing
When the controller closes their account, the processor deletes the data within 30 days. Before that, the controller can export it from the dashboard. Unconfirmed data is deleted automatically 30 days after it was collected.