Privacy policy
1. Data controller
Controller: Enrique Aguilar Cabañero, trading as energEA Projects. Tax ID (NIF): 48258262F. Address: C/ Biscaia, Edificio Yais, commercial premises 8-9, 07829 Port des Torrent, Sant Josep de sa Talaia, Ibiza, Spain. Email: energea@energeaproyectos.com. Telephone: +34 663 876 632.
2. What data we process and why
This website has no forms, uses no cookies and has no analytics or advertising: we do not ask for any personal data when you visit it. It only stores a technical marker in the browser tab that does not identify you (explained in the cookie policy).
We only process the data you choose to send us when you email us, call us or use WhatsApp or Instagram: usually your name, your phone number or email address, and what you tell us about your home or business. We use it to answer your enquiry and, if you wish, to prepare a quotation and, where applicable, carry out the work, invoice it and provide after-sales service.
If you give us data about other people (for example, the architect, interior designer or property manager), please make sure you have told them first.
Please do not send us health data or other sensitive data: we do not need it to prepare a project.
We will not send you marketing by email, text message or WhatsApp without your prior consent.
We do not make automated decisions or build profiles.
This website is not aimed at children under 14, and we do not knowingly process data of children under that age.
3. Legal basis
Answering your enquiry and preparing a quotation: steps taken at your request before entering into a contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR) and, otherwise, the consent you give by contacting us (Article 6(1)(a) GDPR).
Carrying out the work you hire us for and providing after-sales service: the contract (Article 6(1)(b) GDPR).
Meeting legal obligations, such as tax and accounting duties, if a business relationship begins (Article 6(1)(c) GDPR).
Contact details of professionals and businesses (architects, interior designers, hotels, restaurants, etc.): our legitimate interest in maintaining the professional relationship (Article 6(1)(f) GDPR and Article 19 of the Spanish Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights, LOPDGDD).
Technical server logs (for example, the IP address) to deliver the website and keep it secure: our legitimate interest in protecting the site (Article 6(1)(f) GDPR).
Giving us your data is voluntary, but without it we cannot reply or prepare a quotation, all of which is also in line with the LOPDGDD.
4. Retention periods
We keep data only for as long as needed for the purpose for which we received it (Article 5(1)(e) GDPR):
Enquiries that do not lead to a quotation or an order: for as long as needed to deal with them and, at most, 12 months from the last contact; then deleted.
Quotations not accepted: up to 12 months from the date sent, in case you wish to take them up again; then deleted.
Clients: for as long as the relationship lasts. Afterwards, the data is kept blocked, that is, set aside and available only to the authorities and the courts or to deal with claims (Article 32 LOPDGDD), for the periods set by law: 6 years for invoices, accounts and work records (Article 30 of the Spanish Commercial Code, which also covers the 4-year period under the General Tax Act, Articles 66 and 70), and for as long as claims arising from the work may be brought (generally 5 years, Article 1964(2) of the Spanish Civil Code, or any longer period set by a special law). After those periods, it is deleted.
Technical server logs: kept by the hosting provider for the limited time set in its policy; we would only consult them to resolve a security issue.
5. Recipients and transfers
We do not share your data with third parties unless the law requires it (for example, with the Spanish Tax Agency). Only to provide their services to us, and under a data processing agreement where appropriate, the following may have access to it: our email and cloud storage providers (Google Ireland Limited: Gmail and Google Drive, through Google Workspace), management and invoicing software providers, and our tax and accounting adviser.
Web hosting: Cloudflare, Inc. (United States), which hosts and serves the website as a data processor. When you visit it, Cloudflare processes technical connection data, such as the IP address, to deliver the page and protect it against attacks. The typefaces and animation libraries are hosted on the website itself, so no other third parties are contacted when it loads.
Transfers outside the European Economic Area: some of these providers (Cloudflare and, where applicable, Google or other cloud service providers) may process data in the United States. They only do so with the safeguards required by the GDPR: their certification under the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection (Article 45 GDPR and Commission Implementing Decision (EU) 2023/1795), or, failing that, the standard contractual clauses adopted by the European Commission (Article 46 GDPR). You can ask us for more information about these safeguards at energea@energeaproyectos.com.
WhatsApp and Instagram: if you message us on WhatsApp or visit our Instagram profile, that data is also processed under the terms of Meta Platforms Ireland Ltd., which has its own privacy policy. The links on the website only open those services; no data is sent until you write or browse there.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to energea@energeaproyectos.com or to our address and saying which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within one month (Article 12(3) GDPR).
Where processing is based on your consent, you may withdraw it at any time, without affecting processing already carried out.
If you believe we have not handled your data properly, you may complain to the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid, Spain; www.aepd.es) or to the data protection authority of your country of residence in the EU.
7. Security
We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.
8. Changes to this policy
We may update this policy if the website or the regulations change. Last updated: 1 November 2026.