Privacy policy.

2. What data we process

Only what we need for each purpose:

• Identification and contact: name, surname, email and telephone.
• Professional: your company or business website and, if you provide them, your job title and tax ID.
• About your project: the services you are interested in and what you tell us about what you want to achieve.
• Purchase: if you buy a module, your name, email and billing address, your company and tax ID if you enter them, your shop's URL and PrestaShop version, the module, the amount and the invoice. Your card details are processed by Stripe and we never see them.
• Newsletter: if you sign up, your email, IP address and browser, and the date and time of signing up, confirming and unsubscribing.
• Communications: the content of the emails, WhatsApp messages and forms you send us.
• Technical: IP address, browser type and pages requested, which the server logs for security.
• Browsing: if you accept analytics or advertising cookies, which pages you visit and which ad you arrive from.

We do not ask you for specially protected data. If you give us someone else's data, for example a member of your team, make sure they know and agree.

If you give us access to your shop to install a module, the data in it is yours: we process it on your behalf and only to install and configure the module, as explained in section 7 of the legal notice.

3. What we use it for

• Reply to your enquiries through the contact form, by email or by telephone.
• Help you over WhatsApp: we use that conversation only to reply to you and, if needed, to prepare your quote.
• Prepare your quote. The form has two steps: when you press “Continue” in the first one, we keep your name, email, telephone and website even if you do not complete the second, so that we can pick your request up again.
• Manage the business relationship and provide the services you contract.
• Sell you the modules you buy: take the payment, issue the invoice, send you the download, install them in your shop and give you support and updates during the included year.
• Send you commercial communications about our services, only if you expressly agree.
• Send you the newsletter with the news, modules and applications of Volcano MKT, if you sign up and confirm your email.
• Comply with our legal, tax and accounting obligations.
• Keep the website secure and improve our services.
• Measure the use of the website and the results of our ads, and show you Volcano MKT ads on other websites and networks, only if you accept those cookies.

4. Legal basis

• Consent: replying to the messages and quote requests you send us through the forms, which you accept by ticking the box; sending you commercial communications and using non-technical cookies (Article 6(1)(a) GDPR). You can withdraw it at any time, without affecting what was processed before.
• Pre-contractual steps and contract: preparing the proposal you ask us for, providing the service you contract and handling the purchase of a module: payment, delivery, installation and support (Article 6(1)(b) GDPR).
• Legitimate interest: handling the enquiries you make by email, telephone or WhatsApp, keeping the website secure and preventing fraud and spam (Article 6(1)(f) GDPR).
• Legal obligation: complying with tax and accounting obligations (Article 6(1)(c) GDPR).

5. How long we keep it

For as long as the business relationship lasts and, afterwards, for the periods set by law:

• Tax data: 4 years from the end of the filing period of each return (Spanish General Tax Law).
• Contract data: 5 years from the end of the contract (Article 1964 of the Spanish Civil Code).
• Commercial communications: until you unsubscribe.
• Newsletter: until you unsubscribe. Afterwards we keep your email and those dates, blocked, for 3 years, only to be able to prove the sign-up and the unsubscription. Sign-ups that are not confirmed are deleted after 30 days.
• Contact and quote requests that do not lead to a contract: 12 months from the last contact, in case you want to pick the conversation up again. Then they are deleted.
• Invoices and accounting records: 6 years (Article 30 of the Spanish Commercial Code).
• Module purchases: during the year of support and, afterwards, the periods above for tax data, contract data and invoices.

After those periods, the data is deleted or anonymised.

6. Who we share it with

• Public authorities, when a law requires it.
• Providers of web hosting (with servers in Spain), email (Google) and management tools, who act as data processors under a signed contract.
• WhatsApp: if you write to us on WhatsApp, the conversation goes through WhatsApp Ireland Limited, which processes your data under its own privacy policy (opens in a new tab).
• Stripe: if you buy a module, the payment is handled by Stripe Payments Europe, Limited (Ireland), which receives the purchase details and those of your payment method. It processes them on our behalf to take the payment and, as a controller, to prevent fraud and meet its legal obligations, under its own privacy policy (opens in a new tab).
• Google and Meta, if you accept analytics or advertising cookies. What data they receive and what for is explained in the cookie policy.

Some of these providers, such as Google, Meta, WhatsApp or Stripe, may process data outside the European Economic Area. When that happens, they do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

7. Your rights

You can exercise these rights at any time:

• Access: know what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to us processing your data.
• Restriction: ask us to restrict the processing.
• Portability: receive your data in a structured format.
• Withdrawal of consent: at any time, for everything based on it.

To exercise them, write to hola@volcanomkt.in saying which right you want to exercise. If we have reasonable doubts about your identity, we will ask you to prove it. We will reply within one month, and we will not charge you anything unless the requests are clearly unfounded or excessive.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es (opens in a new tab)).

8. Commercial communications

We only send you commercial communications if you have expressly agreed. Every mailing includes a simple way to unsubscribe, and you can also ask by writing to hola@volcanomkt.in.

9. Social media

If you follow Volcano MKT or write to us on Instagram or LinkedIn, those platforms process your data under their own policies. We only see what you make public on them and use it to reply to you. Today Volcano MKT is on Instagram and LinkedIn.

10. Minors

This website is not aimed at children under 14 and we do not knowingly process their data. If you think a child has sent us theirs, write to us and we will delete it.

11. Cookies

If you accept them, we use analytics cookies (Google Analytics) and advertising cookies (Google and Meta). Which ones they are, what they are for and how to change your choice is in the cookie policy.

• Cookie policy

12. Security

We apply technical and organisational measures to protect your data, including:

• Encrypted communications (TLS).
• Access control to the systems.
• Access to the data only for those who need it for their work.
• Regular backups.
• Regular updates of software and systems.
• Forms protected against automated submissions.
• Payments on Stripe's secure page: we never see or store your card details.
• Signed download links that expire.

13. Changes to this policy

We may update this policy because of legal changes or changes in the way we work. You will see the date of the latest version at the top of the page. If a change affects how we use data we already hold, we will let you know before applying it.