Privacy Policy
Last updated: [DATE]
1. Controller
The controller of personal data collected through gastonaps.com is [FULL LEGAL NAME / LEGAL OPERATOR NAME], trading under the GastonAps brand, contactable at [LEGAL CONTACT ADDRESS] and [PRIVACY EMAIL]. Complete this section with the actual controller before launch.
2. Data we may collect
We may collect identity and contact details, company or project information, enquiry content, communication records, source or campaign information, and limited technical and security data generated when the Website is used. Optional analytics data is collected only under the configured lawful basis and consent settings.
3. Purposes and legal bases
Enquiries and communications: to review, respond to and manage a request, based on steps requested before entering a possible engagement and/or legitimate interests in professional communication, as applicable after legal review.
Website security and operation: to prevent abuse, maintain availability, diagnose faults and protect systems, based on legitimate interests and legal obligations where applicable.
Analytics: to understand Website performance and improve content, based on consent where required. Do not load optional analytics before the required choice.
Marketing communications: to send occasional updates only where the person has given valid, separate consent or another lawful basis has been confirmed. Every message must include an unsubscribe route.
Contract and administration: where an engagement begins, to manage proposals, agreements, delivery, invoicing and legal obligations under the separate client documentation.
4. Required and optional information
Fields marked as required are needed to assess and respond to the enquiry. If they are not provided, the request may not be processed. Optional fields help provide context but should remain genuinely optional.
5. Recipients and processors
Data may be processed by carefully selected providers supporting hosting, email, forms, security, analytics, scheduling, CRM or professional administration. List the actual provider categories and make the processor register available internally. Data is not sold to advertisers.
6. International transfers
Some providers may process data outside the country of the controller or the European Economic Area. Where applicable, use a valid transfer mechanism and describe the relevant safeguards, such as an adequacy decision or approved contractual clauses. Replace this paragraph with the actual data-flow position.
7. Retention
Enquiry data should be retained only for the period reasonably needed to respond, manage follow-up and establish or defend claims, then deleted or minimized under a documented schedule. Client and accounting records may be retained for applicable contractual and legal periods. Marketing data is retained until consent is withdrawn or the list is reviewed and no longer justified.
8. Rights
Depending on applicable law, individuals may have rights to access, rectify, erase, restrict or object to processing, request portability, and withdraw consent without affecting earlier lawful processing. Requests may be sent to [PRIVACY EMAIL]. Identity may be verified where reasonably necessary. Individuals may also complain to the competent data-protection authority.
9. Automated decisions
The Website should not make decisions producing legal or similarly significant effects based solely on automated processing. If that changes, this Policy and the relevant notice must be updated before deployment.
10. Security
Appropriate technical and organizational measures are used to protect data, including access control, multi-factor authentication, secure transmission, provider review, backups and monitoring. No internet system can be guaranteed completely secure.
11. Children
The Website and professional services are not directed to children. Do not knowingly collect children’s data through the general enquiry form.
12. Changes and contact
This Policy may be updated when data practices or legal requirements change. The current date will appear above. Questions and rights requests may be sent to [PRIVACY EMAIL].