Last updated: June 2026
In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (RGPD/GDPR), and Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Imbatik informs you about the processing of your personal data through the website www.imbatik.com.
Please read this Privacy Policy carefully before providing your personal data. If you have any questions, you can contact us using the details provided in this policy.
1. Data controller
Name: Imbatik
Business activity: Digital marketing and web development agency
Email: info@imbatik.com
Website: www.imbatik.com
Contact form: https://www.imbatik.com/contacto/
Address: Carrer de Tanzània, 28 — 08226 Terrassa (Barcelona), Spain
Girona office: Carrer del Riu Onyar, 20, local — 17004 Girona, Spain
2. Personal data we collect
2.1. Data provided directly by the user
When you use our contact form or other forms available on the Website, we may collect the following data:
- First and last name
- Email address
- Phone number (if you choose to provide it)
- Company or organization name (if applicable)
- The message or inquiry you send us
- Any other data you choose to provide voluntarily
2.2. Automatically collected data
When you browse the Website, we may automatically collect the following technical information:
- IP address
- Browser type and operating system
- Pages visited and time spent on them
- Referring URL (the page you came from)
- Date and time of access
- Cookie and similar technology data (as set out in our Cookie Policy)
2.3. Special category data
Imbatik does not collect or process special categories of data (data revealing racial or ethnic origin, political opinions, religious beliefs, genetic, biometric or health data, or data concerning sex life) through this Website.
3. Purposes of processing and legal basis
We process your personal data for the following purposes, on the legal bases indicated in each case:
3.1. Handling inquiries and contact requests
- Purpose: To manage and respond to inquiries, information requests or requests submitted through the Website’s contact forms.
- Legal basis: The data subject’s consent (Art. 6.1.a RGPD), as well as Imbatik’s legitimate interest in serving its clients and prospective clients (Art. 6.1.f RGPD).
- Retention period: Data will be kept for as long as necessary to handle the inquiry and, where applicable, for the applicable legal periods.
3.2. Provision of contracted services
- Purpose: To manage the contractual relationship with clients who hire Imbatik’s services (digital marketing, web design, campaign management, etc.).
- Legal basis: Performance of a contract to which the data subject is a party (Art. 6.1.b RGPD).
- Retention period: For the duration of the contract and, once it ends, for the applicable statutory limitation periods (generally 5 years for civil obligations and 4 years for tax obligations).
3.3. Sending commercial communications
- Purpose: To send information about news, blog posts, services, promotions and content related to digital marketing, only if the user has given their express consent.
- Legal basis: The data subject’s consent (Art. 6.1.a RGPD) and Art. 21 of Law 34/2002 of July 11 (LSSICE).
- Retention period: Until the data subject withdraws their consent or unsubscribes.
3.4. Statistical analysis and website improvement
- Purpose: To analyze user behavior on the Website in order to improve its performance, content and user experience.
- Legal basis: Imbatik’s legitimate interest (Art. 6.1.f RGPD), with the safeguards established by cookie regulations.
- Retention period: As set out in the Cookie Policy.
3.5. Compliance with legal obligations
- Purpose: To comply with the legal obligations applicable to Imbatik, including tax, accounting and invoicing obligations.
- Legal basis: Compliance with a legal obligation (Art. 6.1.c RGPD).
- Retention period: As established by the applicable regulations in each case.
4. Recipients and international transfers
4.1. Disclosure of data to third parties
As a general rule, Imbatik does not transfer or disclose personal data to third parties, except in the following cases:
- When required by a legal obligation (public bodies, the Tax Administration, State Security Forces, etc.).
- When necessary to provide the services contracted by the user.
- When the user has given their express consent.
4.2. Data processors
Imbatik may use external service providers acting as data processors, with access to personal data for the provision of ancillary services. These providers are bound by a data processing agreement in accordance with Art. 28 RGPD and only process data according to Imbatik’s instructions. These providers may include:
- Web hosting service providers
- Email marketing platforms (if applicable)
- Web analytics tools (Google Analytics or others)
- CRM or customer management platforms
4.3. International data transfers
Some of our service providers may be located outside the European Economic Area (EEA). In such cases, Imbatik ensures that international data transfers are carried out with the appropriate safeguards required by the RGPD (GDPR), including:
- Adequacy decisions of the European Commission (countries with an equivalent level of protection).
- Standard contractual clauses adopted by the European Commission.
- Other appropriate safeguards provided for in Art. 46 RGPD.
In particular, for Google services (Analytics, Workspace, Ads), data may be transferred to servers located in the United States under the EU-US Data Privacy Framework.
5. Data subject rights
Under the RGPD (GDPR) and the LOPDGDD, you have the right to exercise the following rights regarding the processing of your personal data:
- Right of access (Art. 15 RGPD): To know which of your personal data we are processing, as well as the source, purposes and recipients of such processing.
- Right to rectification (Art. 16 RGPD): To request the correction of inaccurate or incomplete data concerning you.
- Right to erasure / “right to be forgotten” (Art. 17 RGPD): To request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
- Right to restriction of processing (Art. 18 RGPD): To request that the processing of your data be suspended in certain cases provided for by law.
- Right to data portability (Art. 20 RGPD): To receive your data in a structured, commonly used and machine-readable format, or to request its transfer to another data controller.
- Right to object (Art. 21 RGPD): To object to the processing of your data on grounds relating to your particular situation, or at any time if the processing is for direct marketing purposes.
- Right to withdraw consent: At any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- Right not to be subject to automated decision-making (Art. 22 RGPD): Not to be subject to decisions based solely on automated data processing, including profiling, that produce significant legal effects.
5.1. How to exercise your rights
To exercise any of the rights above, you can contact Imbatik through any of the following means:
- Email: info@imbatik.com
- Contact form: https://www.imbatik.com/contacto/
Your request must include: your first and last name, a copy of your DNI (Spanish national ID) or other valid identity document, and a clear description of the right you wish to exercise. We will respond to your request within a maximum of one month from receipt, a period that may be extended by a further two months in particularly complex cases, with prior notice to you.
5.2. Right to lodge a complaint with the supervisory authority
If you believe that the processing of your personal data violates current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
Agencia Española de Protección de Datos (AEPD)
Website: https://www.aepd.es
Address: C/ Jorge Juan, 6, 28001 Madrid
Phone: 901 100 099 / 912 663 517
However, we encourage you to contact us first so we can try to resolve any disagreement amicably.
6. Minors
The Website is not intended for persons under 14 years of age. Imbatik does not knowingly collect personal data from children under 14. If you become aware that a child under 14 has provided us with personal data without the consent of their parents or legal guardians, please let us know at info@imbatik.com so we can delete it.
In accordance with Art. 8 RGPD and Art. 7 LOPDGDD, processing the data of minors between 14 and 18 years of age requires the consent of their parents or legal guardians.
7. Security measures
Imbatik has adopted appropriate technical and organizational measures to ensure the security of personal data and prevent its unauthorized destruction, loss, alteration, disclosure or access, in accordance with Art. 32 RGPD. The measures implemented include:
- Encryption of communications using the HTTPS/SSL protocol.
- Access control to systems with secure credentials.
- Data backup and recovery procedures.
- Periodic assessment of the security measures in place.
8. Cookies and similar technologies
The Website uses first-party and third-party cookies to improve the user experience and analyze site traffic. You can find detailed information on the types of cookies used, their purpose and how to manage your preferences in our Cookie Policy, accessible from the cookie banner and from the Website footer.
You may withdraw your consent to the use of non-essential cookies at any time through the Website’s cookie settings panel or by changing your browser settings.
9. Changes to the Privacy Policy
Imbatik reserves the right to amend this Privacy Policy to reflect legislative or case-law developments or changes in the services offered. Changes take effect from the moment they are published on the Website.
We recommend that you review this Privacy Policy periodically. In the event of substantial changes affecting the processing of your data, we will proactively notify you, where possible, through the available channels.