# Legal, privacy and cookies | abuenoben > Legal information, privacy, providers, data retention and cookies for abuenoben.com. Canonical URL: https://abuenoben.com/en/legal Language: en Who operates abuenoben.com, how enquiries are processed and the choices available for your data and analytics. Last updated 24 July 2026 Controller Armando Bueno Ben Professional address León, Spain Tax ID 49018883H Contents 1. [Legal Notice](#legal-1) 2. [Controller and Purposes](#legal-2) 3. [Legal Basis and Required Data](#legal-3) 4. [Providers and International Transfers](#legal-4) 5. [Retention and Prioritization](#legal-5) 6. [Your Rights](#legal-6) 7. [Cookies and Measurement](#legal-7) 8. [Security and Changes](#legal-8) 01 ## Legal Notice abuenoben.com is an informational and commercial website for web, mobile, backend, integration and technical support services. The owner and service provider is Armando Bueno Ben, tax ID 49018883H, with a professional address in León, Spain, and available at contacto@abuenoben.com. Using the website implies acceptance of these terms. Original content, branding, code and materials may not be reproduced or commercially exploited without permission, except where allowed by law. External links are provided for reference and remain under the control of their respective owners. 02 ## Controller and Purposes The data controller is Armando Bueno Ben, with a professional address in León, Spain, and available at contacto@abuenoben.com. Contact data is used to receive, assess and answer enquiries, prepare a requested proposal or scope, manage the requested commercial follow-up and protect the form against abuse and spam. The data processed includes the details you provide, such as name, email, company, project context, optional budget or timing and message. To attribute the enquiry, the first visited path and form path, referrer domain, commercial intent and UTM parameters may be recorded. The full URL and its query are never retained in this flow. Advertising click identifiers are only captured with browser advertising consent. The IP address is used for security and abuse prevention. General technical records in Cloudflare KV and internal notifications retain clean paths and a cryptographic attribution digest, never clear-text click IDs. When the separate optional enhanced-measurement choice in the form is also accepted, immutable pseudonymized records are stored in a dedicated KV namespace: a submission snapshot containing the random ID and the normalized email address transformed with SHA-256; and, only when captured with browser advertising consent, a separate record containing current click IDs. Both have an absolute expiry and click IDs are not written to operational CRM fields. 03 ## Legal Basis and Required Data Managing an enquiry or proposal relies on steps requested before entering into a contract. Applicable legal obligations may justify later processing, while fraud prevention and service security rely on the controller's legitimate interests. Non-essential analytics and advertising are only enabled with consent for their respective category, which can be withdrawn at any time. Rejecting them does not prevent use of the website or contact form. Name, email, organization type, message and confirmation that this policy has been read are required to submit the form; all other fields are optional. 04 ## Providers and International Transfers Cloudflare provides hosting, delivery, Turnstile, anti-spam protection, form processing and technical storage; HubSpot is used as CRM; Resend handles email notifications. Google Analytics 4 is used for analytics when its category is accepted. The Google Ads tag and click-identifier capture depend on the browser advertising category. Later enhanced measurement also requires a separate optional opt-in in the form. In that case Google may receive the random submission ID as a transaction ID, conversion date, current GCLID/GBRAID/WBRAID identifiers when available, consent signals, and the user-provided email address after normalization and SHA-256 transformation. The identifiers and hashes remain pseudonymized rather than anonymous data. Microsoft Clarity, Meta Pixel, LinkedIn Insight Tag and remarketing are not used in this phase. Some providers may process data outside the European Economic Area. Where this occurs, processing must rely on an adequacy decision, the EU-US Data Privacy Framework where applicable, standard contractual clauses or another valid safeguard. 05 ## Retention and Prioritization Enquiries that do not progress are retained for no longer than 12 months to preserve context and avoid duplicate replies. If a professional relationship starts, necessary data is retained for the duration of that relationship and applicable invoicing, tax or claims periods. Technical and consent records are retained for up to 12 months. The pseudonymized snapshot containing the email hash expires no later than 90 days after submission; the separate click-ID record expires no later than 90 days after capture, and retries never extend either deadline. Any legacy CRM values are cleared from active fields when a withdrawal is handled; HubSpot may retain earlier values in property history or backups under its own retention controls, but they are not used for new exports. Brief details may generate an internal commercial priority score based on urgency, budget, project type and context. It only orders human review and does not make automated decisions with legal or similarly significant effects. 06 ## Your Rights You may request access, rectification, erasure, objection, restriction or portability, and withdraw consent, by emailing contacto@abuenoben.com with your request. If you withdraw the optional enhanced-measurement opt-in, both current dedicated-KV records are deleted and any later export associated with that enquiry is disabled. On an active CRM Deal, its advertising-user-data and personalization signals are marked denied; if the Deal is already archived and HubSpot does not allow it to be edited, the process verifies that it remains archived and therefore excluded from the source before deleting the KV records. The browser advertising preference recorded when the form was submitted remains separate historical evidence. Reasonable information may be requested to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency. Withdrawing consent does not affect earlier lawful processing or data that must be retained under a legal obligation. 07 ## Cookies and Measurement Necessary cookies and storage remember the consent version and selected categories, protect the form and run Turnstile. The analytics category allows Google Analytics 4 to load for page, performance and aggregate commercial interaction measurement; page views are sent without query strings or hashes. The advertising category allows the Google Ads tag to load, measure web conversions and capture click identifiers; remarketing is not enabled. This browser preference does not itself authorize later enhanced measurement: that purpose has a separate, optional and unchecked box in the form. Consent Mode v2 starts with analytics storage, advertising storage, advertising user data and advertising personalization denied. After a choice, only the advertising storage and user-data signals needed for measurement are enabled when that category is accepted; advertising personalization remains denied while remarketing is not used. Accept, reject and configure are offered with equivalent ease. You can change or withdraw the choice at any time through Cookie preferences in the footer; withdrawal blocks later loads and removes applicable known optional cookies. Names, email addresses, phone numbers, clients, employers and other personal data must not appear in UTMs, campaign names or events. For enhanced conversions for leads, only the measurement data listed in this policy is shared when the optional form box has been accepted and its consent remains current. 08 ## Security and Changes Input validation, request limits, anti-spam verification and provider access controls are applied. No Internet-connected system eliminates all risk, so passwords, secrets or specially sensitive data should not be sent through the form. This information may be updated when services or providers change. The current update date is shown at the top of the page. [Spanish Data Protection Agency](https://www.aepd.es/)