Privacy Policy
Website: acastanon.com
Last updated: 19 October 2026
1. Who is responsible for your personal data?
The controller of personal data collected through this website and through direct enquiries about its services is:
- Legal name: A. Castañón
- Trading name: A. Castañón / acastanon.com
- Business address: San Nicolás, 18 - 48991 Getxo, Spain
- Contact email: hello@acastanon.com
- Website: https://acastanon.com
This policy applies to acastanon.com, including the WordPress Malware Removal & Recovery and to enquiries about WordPress, WooCommerce, frontend development, HTML email development, technical maintenance and related consulting services.
Processing client website data is different from managing our own contacts.When a client authorises us to work on its website and we process personal data exclusively on its documented instructions, the client will normally be the controller and we will act as its processor. Where required, an Article 28 GDPR data processing agreement (DPA) will govern that work. This Privacy Policy is not a substitute for that agreement.
2. What information do we process?
Depending on your relationship with us, this may include:
- Contact and professional details: name, email address, telephone number if provided, organisation, role and correspondence.
- Enquiries and malware assessments: affected website URL, reported symptoms, approximate incident date, selected website platform, information voluntarily provided in the form, replies and assessment notes.
- Client and project records: quotations, scope documents, authorisations, service history, communications, agreed actions, technical reports and billing details.
- CRM and communications records: contact history, source of the enquiry, relevant business relationship status, follow-up reminders and records of any marketing preference or objection.
- Technical and security data: IP addresses, browser and device information, access timestamps, server and security logs, where generated by the site or its infrastructure.
- Analytics and cookie-consent data: website usage information obtained through Google Analytics 4 after the required consent, and cookie preferences administered through Cookiebot.
- Professional details from other sources: limited business contact information and publicly observable information about a website, where collected and used lawfully.
Please do not submit passwords, API keys, database exports, payment card details, customer lists, copies of identification documents or sensitive third-party information through an ordinary enquiry form or email. If such material is genuinely needed for an authorised service, we will agree on a suitable secure access or transfer method.
The minimum information needed to respond to a malware assessment request is a way to contact you, the website concerned and a description sufficient to understand the issue. Without it, we may be unable to respond. Optional details need not be supplied, and sending a request does not oblige you to purchase a service.
3. Purposes and legal bases
| Purpose | GDPR legal basis |
|---|---|
| Respond to enquiries, malware assessment requests and quotations | Article 6(1)(b), for pre-contractual steps requested by an individual acting in their own name; or Article 6(1)(f), legitimate interests in handling professional enquiries made on behalf of an organisation |
| Assess a reported issue, verify the requester's authority and propose a scope of work | Article 6(1)(b) or 6(1)(f), as appropriate to the relationship |
| Manage clients, contracts, proposals, project communications and service delivery | Article 6(1)(b) where the individual is the contracting party; otherwise Article 6(1)(f), legitimate interests in administering the business relationship |
| Organise relevant contact and project records within our selected Zoho services | The legal basis applicable to the underlying purpose above; using a CRM or other business tool does not itself create a separate legal basis |
| Send optional newsletters or promotional messages | Article 6(1)(a), consent, or another basis only where electronic communications law specifically permits the message |
| Issue invoices, maintain statutory accounts and meet other legal obligations | Article 6(1)(c), legal obligations |
| Protect the website, detect abuse, manage incidents and defend legal rights | Article 6(1)(f), legitimate interests in security and protection of legal rights; Article 6(1)(c) when a particular legal obligation applies |
| Use Google Analytics 4 for optional website statistics | Article 6(1)(a), consent, together with the consent rules governing non-essential browser technologies |
| Record and respect cookie choices and respond to rights requests | Article 6(1)(c) where needed to comply with law; Article 6(1)(f) where an associated legitimate interest applies |
Where processing relies on legitimate interests, we take account of the reasonable expectations, rights and interests of affected individuals. You may object to relevant processing as described below.
Contacting us or requesting an assessment does not subscribe you to marketing. If an optional marketing subscription is offered, it will have a separate, freely given choice. Where the limited existing-customer exception under Spanish electronic communications law applies, each promotional message will still offer a simple way to object.
4. How we use Zoho
We use Zoho business applications, where activated in our workflow, to support the administration of enquiries and professional relationships. Depending on the applications selected, this may include contact management, responding to correspondence, recording assessment or service history, organising tasks, preparing quotations or managing other business records.
The exact processing depends on the applications enabled. For example, an enquiry may be entered into a customer relationship management system; email may be handled by a business mail service; or a form may send information directly to a Zoho application.
Zoho processes service data on behalf of business customers under the applicable contractual arrangements, while some account, security or operational information may be handled by Zoho for its own purposes under its policies. Zoho's group entities and subprocessors may be involved depending on the selected service and region.
We do not use the mere presence of a contact in Zoho as proof that the person has consented to newsletters or promotional emails. We will keep track of the source of contact data and applicable marketing preferences.
We keep routine Zoho business records separate from client website backups, database exports, production credentials and potentially sensitive forensic material. Those materials are not routinely stored in the CRM or other general-purpose business tools. Any exceptional third-party storage or sharing for client systems is assessed and authorised where required.
Further information: Zoho Privacy Policy, Zoho group entities and Zoho service-specific subprocessors.
5. WordPress Malware Removal & Recovery
When expressly authorised, the malware-removal service may involve reviewing a client's website files, WordPress accounts and settings, databases, logs, plugins and connected systems. Some of these may contain personal data about the client's customers, employees or visitors.
A public form submission does not authorise intrusive scans, restricted-area access, changes to a website or the use of credentials. Before such work, we agree the scope, authorisation and necessary confidentiality and data processing arrangements.
When a local copy is required within the agreed scope:
- Website files and database exports are handled separately from everyday commercial records and kept temporarily on a dedicated encrypted storage device or an equivalently protected, expressly agreed working environment.
- Access is limited to the authorised investigation, remediation, recovery and validation tasks.
- Credentials are exchanged through an agreed secure channel rather than an open contact form, and access is revoked or changed when no longer required.
- Client material is not routinely transferred into Zoho CRM or other general-purpose business applications.
- Client copies are returned or deleted according to the service contract and applicable DPA. The agreed deletion schedule must include a final deadline if confirmation of successful recovery is delayed or never received.
- Any retention needed for legal reasons or a separately authorised forensic purpose is documented and restricted; deletion methods are chosen appropriately for the storage medium.
If we discover indications of a personal data breach, we inform the client without undue delay as required by the applicable agreement. Where the client is the controller, it remains responsible for determining any mandatory notification to regulators or affected individuals, with our assistance where required.
For clarity: our role as a processor for a client's website does not mean that the personal data in that website becomes part of our CRM or marketing database. Any other use requires its own lawful basis and, where applicable, the client's instructions.
6. Information obtained from public sources
We may identify publicly observable symptoms of a security issue affecting a professional website and record a limited amount of publicly available business contact information and technical context. If a named individual's information is involved, we assess the lawful basis, necessity and proportionality of processing it.
Public availability of an email address does not automatically make unsolicited promotional email lawful. Any outreach must also comply with Spain's Law 34/2002 (LSSI) and other applicable electronic communications rules. We respect objections to direct marketing and maintain any necessary suppression record to prevent further unwanted contact.
Where Article 14 GDPR requires information about data obtained indirectly, we provide it within the prescribed timeframe, including the source and categories of data, subject to applicable legal exceptions.
7. Service providers and recipients
We do not sell personal data. Access may be provided only where appropriate for the purposes described above, to the following categories of providers and recipients:
| Provider or category | Role or purpose |
|---|---|
| Zoho group, through the applications enabled for our business | Management of enquiries, contact and business records, correspondence and related administration, depending on the selected products |
| Google Analytics 4 (Google) | Optional website audience measurement after the required consent |
| Cookiebot CMP (Usercentrics A/S) | Cookie consent interface, preference records and cookie declaration |
| Website hosting and infrastructure suppliers | Hosting, backups, logs, technical availability and security of acastanon.com |
| Other email, anti-spam or anti-abuse suppliers, if enabled | Message delivery, form protection and website security |
| Professional advisers and competent authorities | Accounting, legal advice and compliance with binding legal obligations where appropriate |
Providers acting as processors must be subject to appropriate processing agreements and confidentiality and security requirements as applicable. Where a provider acts as an independent controller for specific processing, its own transparency information may also apply.
Different Zoho applications may process different information. An embedded form, a mail account, a CRM integration and a marketing tool can involve different data categories, subprocessors, storage arrangements and tracking technologies.
8. Processing locations and international transfers
Service providers may store, process or allow authorised access to personal data from different countries. We assess relevant transfers outside the European Economic Area under Chapter V GDPR and apply an appropriate mechanism, such as an applicable adequacy decision or European Commission Standard Contractual Clauses, where required, together with any necessary additional measures.
Zoho operates an EU service region (zoho.eu). Choosing an EU data centre does not mean that no personal data can be accessed from outside the EEA: Zoho describes some international support access and service-specific subprocessors. The region, contracting entity and applicable safeguards depend on the Zoho account and products used.
Google Analytics and other externally provided services may also involve international transfers under their applicable arrangements. You may request further information about relevant safeguards through the contact address above.
9. Retention periods
We keep personal data only as long as required for its purpose and any applicable legal duty. Our retention schedule, subject to any legal duty requiring a different period, is:
| Data category | Retention rule |
|---|---|
| Enquiries not leading to a contract, including associated CRM notes | Up to 12 months after the last substantive exchange, unless a shorter period is appropriate or retention is otherwise lawful and justified |
| Publicly sourced professional contacts not leading to a relationship | Reviewed and normally removed within 3 months where there is no lawful reason to retain them; objections to marketing are respected immediately |
| Non-statutory project and commercial correspondence | Generally up to 24 months after the engagement closes, subject to claims, agreed obligations or another applicable retention period |
| Invoices, accounting records and legally required records | For the periods required by applicable Spanish tax, accounting and commercial law; Article 30 of the Commercial Code generally requires relevant commercial records to be retained for six years |
| Consent and objection records | As long as necessary to demonstrate compliance and respect the preference, subject to applicable limitation periods |
| Website and security logs | 10 days |
| Client website backups and temporary forensic copies | Returned or deleted according to the written service agreement and DPA, including an agreed final deletion deadline |
These periods apply to records stored in Zoho as well as to copies held elsewhere. Moving a lead into a CRM, or retaining a vendor's account, must not by itself extend the data's lawful retention period. Any residual provider backups follow the relevant contractual backup/deletion lifecycle, subject to appropriate safeguards.
10. Your rights
Under the conditions set by the GDPR, you may request access, rectification, erasure, restriction of processing, data portability where applicable, and object to processing based on legitimate interests. You may object at any time to processing for direct marketing. When processing is based on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.
Send a request to contact@acastanon.com. We may ask for proportionate information to verify your identity. We normally respond within one month, subject to the extensions permitted by law.
You can complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, without prejudice to judicial remedies.
If a request concerns personal data held solely within a client's site, we may refer you to that client as controller and assist it in accordance with our contract.
11. Information security
We apply technical and organisational measures appropriate to the risks involved, including access restrictions and secure handling of client material. Access to Zoho records is restricted to authorised users, and account permissions and data exports are controlled according to business needs.
No security measure eliminates all risks. If confidential material was sent to us through an inappropriate channel, please contact us promptly.
12. Cookies, analytics and embedded services
We use Google Analytics 4, subject to the visitor's required consent, and Cookiebot to manage cookie preferences. Details of technologies, providers and how consent can be changed appear in the Cookie Policy.
If a Zoho form, widget or other browser-based integration is embedded in the website, any cookies or similar technology it uses must be assessed, disclosed and managed according to the applicable requirements. A server-to-server CRM integration does not automatically mean Zoho tracking cookies are present on the visitor's device.
13. Automated decisions and policy changes
We do not intend to make decisions about enquiries or service acceptance solely by automated processing that produces legal or similarly significant effects on individuals. Routine CRM rules, task reminders or categorisation do not in themselves imply such a decision. If our practices change in a way that requires additional GDPR information, this policy will be updated and notices provided where necessary.
We may revise this policy as services, providers and processing activities change. The date at the top identifies this version.