Privacy policy
Last updated: 18/10/2026
This is a translation; in case of doubt, the Spanish version prevails.
This policy explains how Muebles Guillén Design S.L. processes the personal data of people who use this website, ask us for a quote or are our customers. It complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
2.1. Data controller
- Controller: Muebles Guillén Design S.L.
- Tax ID (NIF): B93436616
- Address: Avda. Gerald Brenan, Edificio Bellavista, nº 5, local, 29120 Alhaurín el Grande (Málaga)
- Registry details: Commercial Registry of Málaga, volume 5449, page 117, sheet MA-130713, entry 1
- Data protection contact: guillendesign1@gmail.com · 952 491 522
We have no data protection officer because our activity does not require one (art. 37 GDPR and art. 34 LOPDGDD).
2.2. What data we process
- If you write to us through the form: name and phone number (required); email, what you are interested in and your message (optional). We only ask for what we need to reply. Without the required data we cannot handle your request.
- If you contact us by email, phone or WhatsApp: the data you give us and the content of the conversation.
- If you place an order: identification and contact details, tax ID, delivery or work address, measurements and order details, and billing and payment data.
- Technical data: when you submit the form, the anti-spam service analyses technical data from your browser and connection, such as your IP address, to check that you are not a bot.
We do not ask for or process health data, beliefs or other special categories of data.
2.3. What we use your data for and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Reply to your request for information and prepare the quote you ask for | Pre-contractual steps taken at your request (art. 6.1.b) |
| Manage the order: measuring, manufacturing, delivery, installation and after-sales | Performance of the contract (art. 6.1.b) |
| Invoice, collect payment and meet tax and accounting obligations | Legal obligation (art. 6.1.c): tax law and the Commercial Code |
| Protect the form against automated submissions and abuse | Legitimate interest in the security of the site (art. 6.1.f) |
| Defend our rights in the event of a claim | Legitimate interest (art. 6.1.f) |
We do not send advertising or commercial communications, and we do not make automated decisions or build profiles with your data.
2.4. How long we keep your data
| Data | Period |
|---|---|
| Requests for information or quotes that do not lead to an order | Deleted at most 1 year after the last communication |
| Customer data, accepted quotes and invoices | 6 years from the last accounting entry (art. 30 of the Spanish Commercial Code). This also covers the 4-year tax limitation period (art. 66 of the General Tax Law) |
| Technical data from the anti-spam check | Kept by the provider for the minimum time needed for the check |
After those periods the data is deleted. If a claim is in progress, it is kept blocked, available only to judges and authorities, for the limitation period of the relevant actions (art. 32 LOPDGDD).
2.5. Who we share your data with
We do not sell or transfer your data. We only disclose it when required by law: to the Tax Agency and other public authorities, to courts, and to banks when handling a payment.
In addition, these providers process data on our behalf as data processors. They may only use it to provide their service to us and are obliged to protect it:
| Provider | Service | Data location |
|---|---|---|
| Supabase, Inc. | Database of the management application | Servers in the European Union (company based in the US) |
| Cloudflare, Inc. | Hosting of the website and application, content delivery network and anti-spam check (Turnstile) | Global server network (company based in the US) |
| Google LLC / Google Ireland Ltd. | Servers in and outside the EU |
WhatsApp: we answer through WhatsApp Business. If you choose to write to us that way, the conversation also goes through WhatsApp Ireland Limited (Meta group), which processes it under its WhatsApp Business terms and privacy policy. If you prefer, you can contact us by phone or email.
2.6. International transfers
Some of these providers are US companies or may process data from outside the European Economic Area. In those cases the transfer is covered by:
- the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), where the provider is certified; and/or
- the standard contractual clauses approved by the European Commission, included in each provider’s data processing agreement.
You can ask us for more information about these safeguards at guillendesign1@gmail.com.
2.7. Your rights
You can exercise at any time the rights of:
- access: to know what data of yours we process;
- rectification: to correct inaccurate data;
- erasure: to ask us to delete your data when it is no longer needed;
- objection: to object to processing based on legitimate interest;
- restriction: to ask us to freeze processing while a claim is resolved;
- portability: to receive your data in a structured format.
Write to us at guillendesign1@gmail.com or by post to our address, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month, extendable by two further months in complex cases, and will let you know if the extension is needed.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid).
2.8. Accuracy of data and minors
The data you give us must be true and your own. If you give us another person’s data (for example, for a delivery), you must have informed them and have their authorisation.
This website is not aimed at children under 14, and we do not knowingly process their data without the authorisation of their parents or guardians (art. 7 LOPDGDD).
2.9. Security
We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or alteration, including an encrypted connection (HTTPS), password-restricted access to the management application and backups.
2.10. Changes to this policy
We may update this policy to adapt it to legal changes or changes in how we work. The date of the last update is shown at the top. If the change is significant, we will say so visibly on the website.