This policy explains what personal data is processed through this website and in the professional activity carried out from it: for what purpose, on what legal basis, who it is shared with, how long it is kept and what rights you have. It is drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and the guarantee of digital rights (LOPDGDD).
- Controller: MARCEL GARCIA GARCIA, a self-employed sole trader operating under the trade name HAKI.
- Tax identification number: ES47941034H
- Address: PLAÇA GALA PLACIDIA, 1, 08006 BARCELONA
- Email: INFO@HAKI.MARKETING
No data protection officer has been appointed, as none of the cases in article 37 GDPR or article 34 LOPDGDD applies. For any question about this policy or about your data, write directly to INFO@HAKI.MARKETING
The cookies and tracking technologies the site loads are described one by one in the Cookie Policy, reachable from the selector at the top of this page.
01What data we process, why, and on what legal basis
Only the data needed for each purpose is collected, and it is not used for purposes other than those set out below without telling you first. No special category data is collected (health, beliefs, trade union membership, ethnic origin or sexual orientation), so please do not include any of it in the message field of the forms.
Contact form
Data processed: first name, surname, email address, telephone, company, role, the message you write, the page of the site you submitted the form from and, so that we know which content brings us clients, the page you entered the site on and where you came from (a search engine, a social network, a link, or the campaign named in the link). That origin is read from the page address and sent only with the form, without storing anything on your device; if you have accepted analytics cookies, the details of your first and last visit held by the cookies described in the cookie policy are added. Every visible field is mandatory: without them the enquiry cannot be handled.
Purpose: to answer your enquiry, assess the need you describe, prepare a quotation where appropriate, and maintain the commercial contact arising from that enquiry. On submitting it you receive a confirmation email, and an internal notice is generated so that you can be answered.
Legal basis: pre-contractual measures taken at the data subject's request (article 6.1.b GDPR). Where the message bears no relation to a possible engagement (a general question, a partnership proposal), the basis is the consent you give by sending it (article 6.1.a).
The form is protected by an anti-spam check (Cloudflare Turnstile) and by a hidden field that only bots fill in. Neither collects further information about you, and neither is used for analytics or advertising.
Job applications
Data processed: first name, surname, email address, telephone, city, the link to your LinkedIn profile or portfolio, the area, experience and type of role you are looking for, what you tell us about yourself and, if you add it, the link to your CV. The form accepts no files: your CV is shared as a link, which stays under your control.
Purpose: to assess your application and to consider you for any hiring we open while we keep your data. Legal basis: your consent, which you give by sending the form (article 6.1.a GDPR) and may withdraw at any time by writing to INFO@HAKI.MARKETING
Applications are stored in Sanity, the site's content management system, in a private space that only the authorised team can access: they are neither published on the website nor disclosed to third parties. They are kept for twelve months from receipt and deleted after that. The form is protected by the same anti-spam check as the contact form.
Meeting bookings
The discovery-meeting scheduler runs on Cal.com. When you book, we process your name, your email address, the date, time and time zone you choose, anything you add in the notes, and any data carried in the link you arrived through, which is used solely to pre-fill the form.
Purpose: to schedule the meeting and send you the invitation with the video-call link and its reminders. Legal basis: pre-contractual measures taken at the data subject's request (article 6.1.b GDPR).
Outbound email prospecting
We run outreach aimed exclusively at professionals and businesses, managed with the lemlist tool. Data processed: first name and surname, role, company and professional email address, obtained from publicly accessible sources and from professional profiles and corporate websites.
Legal basis: the legitimate interest in promoting professional services to potentially interested businesses (article 6.1.f GDPR), read together with article 19 LOPDGDD, which permits processing the contact details of people working for a legal entity in order to maintain a relationship with it. The data always concerns the person in their professional capacity, never their private sphere, and the impact on their rights has been assessed as limited and foreseeable in a business context.
Every message includes a simple way to ask us to stop writing. You may also object at any time by writing to INFO@HAKI.MARKETING Once an objection is acted on, only the minimum data strictly needed is kept, on a suppression list, for the sole purpose of not contacting you again.
Clients, quotations and invoicing
If the relationship progresses, we additionally process the identification and tax data needed to issue quotations and invoices, the contact details of the people involved, and information about the services provided.
Legal basis: performance of the services contract (article 6.1.b GDPR) and compliance with the accounting and tax obligations to which the controller is subject (article 6.1.c).
Browsing data
The site loads measurement tools and third-party tags that set cookies in your browser. What each one sets, how long it lasts and how to block it is detailed in the Cookie Policy, and their legal basis is your consent, except for the strictly necessary ones.
Separately from cookies, the hosting provider records the technical details of each request in its logs (IP address, user agent, date and time, and the resource requested). Purpose: keeping the service running, diagnosing incidents and protecting it from abuse and attack. Legal basis: the legitimate interest in information security (article 6.1.f GDPR).
LinkedIn page
HAKI maintains a LinkedIn page, the only social network linked from this site. If you follow that page, comment or interact with its posts, we process the public information the platform itself shows us (chiefly your name and professional profile) within the network and for the purpose of running that presence and publicising our work. None of it is added to any file of our own.
LinkedIn independently determines how it processes its users' data and the platform's terms, so rights concerning your profile, its visibility and the advertising you receive must be exercised with them: https://www.linkedin.com/legal/privacy-policy
02How long we keep your data
Data is kept for as long as it is needed for the purpose it was collected for and, after that, for the periods the law requires:
- Enquiries received through the contact form: one year from the last contact, unless the relationship leads to a service being provided.
- Job applications: twelve months from receipt; they are then deleted.
- Newsletter subscriptions: until you unsubscribe; from that moment, only the minimum data needed to respect your decision.
- Meeting bookings: one year from the date the meeting was scheduled for.
- Client data with accounting and tax relevance: six years from the last entry, under article 30 of the Spanish Commercial Code, and four years for tax limitation purposes under articles 66 et seq. of the General Tax Act.
- Prospecting data: until the recipient exercises their right to object.
- Cookies and similar technologies: the periods stated for each in the Cookie Policy.
Once those periods expire, data is deleted or blocked, remaining available solely to judges and courts, the public prosecutor or the competent authorities for the limitation period of any actions that might arise, under article 32 LOPDGDD.
04International transfers
Several of the providers above are established in the United States or process data on servers located there. Specifically, contact form submissions are kept in the CRM (Notion) and newsletter subscriber addresses in Loops, both on servers in the United States, and job applications in Sanity, which hosts them in Belgium and the United States; this website keeps no database of its own holding that data.
These transfers rely on the mechanisms set out in Chapter V GDPR: the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the provider is certified under it, and otherwise the standard contractual clauses approved by the Commission, together with any supplementary measures found necessary after the corresponding assessment.
You can request information about the safeguard applicable to each provider, and a copy of the measures adopted, by writing to INFO@HAKI.MARKETING
05Your rights and how to exercise them
The regulations give you the following rights over your personal data:
- Access: to know what data of yours we process and obtain a copy of it.
- Rectification: to correct inaccurate data or complete data that is incomplete.
- Erasure: to ask that it be deleted when it is no longer needed for the purpose it was collected for, among other grounds.
- Restriction of processing: to ask that it be kept but not used while a challenge or an objection is resolved.
- Portability: to receive the data you provided in a structured, commonly used format, or have it transmitted to another controller.
- Objection: to object to processing based on legitimate interest, including commercial prospecting, which will then stop unless compelling grounds override it.
- Withdrawal of consent: to withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to INFO@HAKI.MARKETING or to PLAÇA GALA PLACIDIA, 1, 08006 BARCELONA, stating the right you wish to exercise and enclosing a copy of a document proving your identity. Requests are handled free of charge within one month, extendable by a further two months where their complexity requires it, in which case you will be informed.
If you believe the processing does not comply with the regulations, or that your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency, at C/ Jorge Juan, 6, 28001 Madrid, and online at https://www.aepd.es
06Information security
Appropriate technical and organisational measures are applied to protect data against loss, unauthorised access or misuse, taking into account the state of the art and the risks of the processing: HTTPS encryption across the whole site, anti-spam verification on the forms, controlled and limited access, and the selection of providers offering sufficient guarantees under article 28 GDPR.
No bank or payment card details are requested or processed on this site. Should a security breach occur that poses a high risk to your rights, you will be notified in accordance with articles 33 and 34 GDPR.
07Minors
The services and forms on this site are aimed at professionals and businesses, not at minors. Data on children under fourteen (the age from which article 7 LOPDGDD allows a minor to consent on their own behalf) is not knowingly collected. If we find that data on a child under that age has been provided without their legal guardians' consent, it will be deleted.
08Commercial communications
Electronic commercial communications are only sent where you have given your consent (by subscribing to the newsletter, for instance) or where article 21.2 LSSI-CE applies: the data was obtained in the course of a previous contractual relationship and the communication concerns services similar to those contracted.
In every case each message includes a simple, free way to object, and you can ask us to stop by writing to INFO@HAKI.MARKETING Your email address is never passed to third parties for them to send you their own advertising.
09Automated decisions and profiling
No decisions are taken based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of article 22 GDPR. The measurement tools described in the Cookie Policy analyse use of the site in aggregate and are not used to classify you or to make decisions about you.
10Accuracy of the data you provide
In providing your data you warrant that it is true, accurate and current, and undertake to tell us of any change. If you provide data about other people (a colleague at your company, for example) you must have informed them beforehand of the content of this policy and have a basis legitimising that disclosure.
11Changes to this policy
This policy is reviewed whenever the processing, the providers involved or the applicable regulations change. The version in force is always the one published on this page, with the last-updated date shown above; where a change is substantial it will be communicated through the usual contact channels. Any question about this document can be directed to INFO@HAKI.MARKETING