Privacy policy

Controller

• —Controller: Mehdi Imara (noli Digital Studio)
• —Tax ID (NIF): 0Y8300347Y
• —Registered address: Avenida Blasco Ibáñez 140, 46022 Valencia
• —Email: contact@noli.website
• —Phone: +34 672 924 416

What we process

Only the data you give us and public information about your business. We do not buy databases and we do not collect data from third parties.

• —Contact data: first name, surname, email address, phone or WhatsApp number.
• —Business data: name, city, country, type of venue, number of venues, presence on delivery platforms, approximate monthly sales, average commission, links to your website, Instagram and Google Maps.
• —Any free-text message you choose to write.
• —Minimal technical data: page language, where the visit came from (campaign or QR parameters) and a cryptographic hash of your IP address. We do not store the IP address in the clear.
• —Public information about your business that we look up online in order to prepare the proposal (for example your Google listing, your website or your delivery-platform page).

Purposes and legal bases

• —Answering your request and preparing a personalised preliminary proposal. Legal basis: pre-contractual measures taken at your request (art. 6(1)(b) GDPR) and your consent to use public information about your business (art. 6(1)(a) GDPR).
• —Managing the contractual relationship if we end up working together, including invoicing. Legal basis: performance of a contract (art. 6(1)(b)) and legal obligations in tax and accounting matters (art. 6(1)(c)).
• —Sending you occasional ideas and case studies, only if you tick that separate box. Legal basis: your consent (art. 6(1)(a)), withdrawable at any time.
• —Preventing abuse of the form. Legal basis: legitimate interest in protecting the service (art. 6(1)(f)).

How the proposal is prepared

The preliminary proposal is prepared automatically from the data you send and from public information about your business, with the help of a language model. The system never sets prices: prices always come from our published list.

A person reviews every non-standard case before it is sent. You can ask for a human review of your proposal at any time by writing to contact@noli.website.

This preparation does not produce automated decisions with legal effects, or similarly significant effects, within the meaning of article 22 GDPR: the outcome is a commercial offer that you can accept, decline or discuss.

Who else receives your data

We do not sell or trade your data. It is processed only by the providers we need in order to serve you, as processors and under a signed agreement:

• —Google Ireland Limited — email, spreadsheet and file storage (Google Workspace, Apps Script and Drive).
• —Vercel Inc. — hosting for the site and for the functions that receive the form.
• —Anthropic PBC — analysis of the request and drafting of the personalised parts of the proposal.
• —Meta Platforms Ireland Limited — delivery of the proposal over WhatsApp, only if you choose that channel or write to us there first.

International transfers

Some of these providers are established in the United States or may process data there. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified and, failing that, on the Standard Contractual Clauses approved by the European Commission, together with any supplementary measures required.

How long we keep it

• —Requests that do not lead to a contract: 12 months from the last contact, then deleted.
• —Clients: for the duration of the relationship and, afterwards, for the period required by tax and commercial law (generally 6 years).
• —Consent to marketing messages: until you withdraw it.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time, by writing to contact@noli.website or to Avenida Blasco Ibáñez 140, 46022 Valencia. Tell us which right you are exercising; we may ask you to prove your identity.

We will reply within one month of receiving the request.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.

Security

We apply reasonable technical and organisational measures: restricted, authenticated access to the data, encryption in transit, secrets kept server-side only, and logs that contain no personal data.