This tool is built to process as little data as possible. Your business details (registered name, tax number, address) never reach our server: the document is assembled inside your browser. What we do record is use of the tool itself and, only if you accept it, audience measurement through Google Analytics.
1. Data controller
- Identity: APLICACIONES SAAS IBERICA, S.L.
- Tax number (CIF): B93773620
- Registered address: Avenida Cañada de los Fenicios, Aldea 5, Casa 24, 18150 Gojar (Granada), España
- Email: hola@textoslegalesweb.es
2. What data we process and why
2.1. What we do NOT process
The details you type into the generator's "your business details" block (name or registered name, tax number, address, your website's contact email, hosting provider and configuration options) are used solely inside your browser to fill in the template. They are not sent to our server, not stored and not recorded anywhere.
2.2. Record of use of the tool
- Data processed: date and time, type of document generated, your acceptance of the disclaimer, an anonymised version of your IP address (without the last octet) and an irreversible cryptographic fingerprint of the full IP. If you also fill in the name and email in the "who is generating the document" section — which are optional — those are stored too.
- Purpose: understanding how much the tool is used, producing aggregate statistics, keeping proof that you accepted the disclaimer, and applying the limit of one generation every 15 minutes per connection, which protects the service against automated use.
- Legal basis: the controller's legitimate interest (art. 6(1)(f) GDPR) in understanding and protecting the use of its own service. The balancing test required by law has been carried out: the processing is minimal, the IP is stored anonymised or as a non-reversible fingerprint, and no profiling is carried out.
- Retention: twenty-four months from generation. Abuse-control records are purged after thirty days.
2.3. Emailing the documents
- Data processed: name, email address, type of document, date of consent and the exact wording accepted.
- Purpose: sending you the documents you requested and, where applicable, maintaining commercial contact relating to the services of the CLOUDESK ecosystem.
- Legal basis: your express consent (art. 6(1)(a) GDPR), given by ticking a box that is not pre-ticked before sending. You may withdraw it at any time.
- Retention: until you ask for erasure or withdraw your consent and, in any case, a maximum of 36 months from the last document you asked us for. After that long without using the tool again, your data is deleted automatically.
So that we can email you the documents, the already-assembled text travels from your browser to our server temporarily, only for as long as it takes to build the message and compress it. That content is not saved to the database or to disk: it is discarded as soon as the email goes out. If you would rather that did not happen at all, use the copy or download buttons, which work entirely on your own machine.
2.4. Email signature generator
The email signature section works on the same principle as the legal text generator, and it is worth understanding why: the name, job title, phone number and email address you type there go inside your signature. You type them so your signature displays them, not to hand them to us. Treating them as if you had given them to us would mean using them for a purpose other than the one you have in mind.
- What we do NOT process: none of the signature fields. The preview, the copy button and the download are resolved entirely in your browser. If you upload a logo or a photo, that file does not leave your computer either: it is embedded inside the signature itself. We do not host user images.
- Usage counter: when you copy or download a signature we record the fact that somebody used the tool, with the date, an anonymised version of your IP address and an irreversible cryptographic fingerprint of the full IP. With no signature data at all: that record cannot tell who you are. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in knowing about and protecting the use of our own service. Retention: twenty-four months.
- If you ask us to email you the signature: we then do process the address you give us, the date of consent and the exact text accepted. Purpose: sending you that signature and the install instructions, and nothing else — we do not add you to any mailing list. Legal basis: your express consent (Art. 6(1)(a) GDPR), given by ticking a box that is not pre-ticked. Retention: the same as in section 2.3.
To build the message, the signature fields travel to our server transiently, only for as long as it takes to assemble the email. They are not stored in the database or on disk. If you would rather that did not happen at all, use the copy or download buttons.
One note about the logo by address. If instead of uploading the image you paste the address of one already published, your browser has to fetch it from that server in order to show it to you, and that server will see your IP address. This is how any image on the internet works and we play no part in it: that server is usually your own website. We mention it because, if you would rather it did not happen, the other option —uploading the file— stays entirely on your computer.
2.5. Audience measurement (only if you accept it)
- Data processed: pages visited, date and time, time on site, approximate country and city, device and browser type, and where the visit came from. Google also assigns a random identifier stored in the _ga and _ga_9GWD5DEKE8 cookies.
- Purpose: knowing how many people use the tool and which pages they visit, in order to improve it.
- Legal basis: your consent (art. 6(1)(a) GDPR and art. 22.2 LSSI-CE), given by pressing "Accept" in the cookie notice. Until you give it, not a single line of Google is loaded. You can withdraw it whenever you like from "Cookie preferences" in the footer.
- Retention: fourteen months in Google Analytics; the cookies expire after twenty-four months.
Measurement is configured with IP anonymisation, with Google signals switched off and with no advertising personalisation. This data is not combined with the usage record described above, and no profiling is carried out.
2.6. If you ask us for a website quote
- Data processed: name, email address, phone number (if you give one) and the message you write, plus an anonymised version of your IP address.
- Purpose: dealing with your enquiry, replying to you and, if it goes ahead, preparing the quote and the contractual relationship.
- Legal basis: steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR). No consent is needed: you wrote to us asking for something, and that is why we process your data.
- Where it is kept: in our own CRM (crm.cloudesk.es). It is not a third party: it is the internal tool of the same controller that runs this site, trading as CLOUDESK. We do not pass your data to anyone.
- Retention: twenty-four months from the last contact. If the enquiry turns into a contract, the statutory invoicing periods apply instead.
Protecting the form. To stop automated submissions we use Google reCAPTCHA v3. The script is not loaded when you open the page: only once you start typing in the form. Google then analyses your browsing behaviour to score whether you are a person, and to do so it may set its own cookies and transfer data to Google LLC (United States), under the European Commission adequacy decision of 10 July 2023. The legal basis is our legitimate interest in protecting the form against abuse (art. 6(1)(f) GDPR). If you would rather not go through it, write to us directly at hola@textoslegalesweb.es.
3. Do you have to give us your data?
No. Generating the documents does not require your name or your email address: the fields in the "who is generating the document" section are optional and you can leave them blank. The tool works exactly the same.
They are only needed if you choose to have the documents emailed to you, because without an address there is nowhere to send them. If you do not provide them, the only consequence is that: we will not be able to email them, but you can copy or download them from the page itself.
The business details you type in to build the document (registered name, tax number, address) are not given to us at all: they stay in your browser, as explained in section 2.1.
4. Recipients
We do not disclose your data to third parties. It is accessed, as data processors under a contract meeting the requirements of article 28 of the GDPR, by the technical providers needed to run the service:
- Web and email hosting provider: Dinaserver, with servers in Spain.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which provides the analytics service, and only if you have accepted analytics cookies.
5. International transfers
This site's own processing (the usage record and emailing the documents) involves no transfer outside the European Economic Area: everything is served from our own server, in Spain, with no external fonts and no third-party scripts.
The one exception is Google Analytics, and only if you accept it. Google Ireland Limited may transfer data to Google LLC in the United States. That transfer relies on the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which Google LLC is certified, and additionally on standard contractual clauses. If you reject analytics cookies, this transfer does not take place.
6. Your rights
Right to object. The usage record described in section 2.2 relies on our legitimate interest. So we are telling you separately and in plain words: you may object to that processing at any time, on grounds relating to your particular situation, by writing to hola@textoslegalesweb.es. If you do, we will stop processing that data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
You may also exercise your rights of access, rectification, erasure, restriction and portability free of charge, and withdraw any consent given, by writing to hola@textoslegalesweb.es stating the right you wish to exercise.
Response time: we will reply within one month of receiving your request. If the request is particularly complex, that period may be extended by two further months, and we will tell you within the first month, explaining why.
Note that because the IP is stored as an irreversible fingerprint, in some cases we will not be able to identify your browsing records without additional information from you (art. 11 GDPR).
If you believe the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es).
7. Security
The site is served entirely over HTTPS. Admin panel passwords are stored hashed with a key derivation function, database queries use prepared statements, forms are protected with a token, and there are usage limits per connection. IP addresses are stored anonymised or as an irreversible fingerprint.
8. Minors
The tool is aimed at people running a business, not at children under fourteen. If we find data belonging to a child without the authorisation required by article 7 of the LOPDGDD, we will delete it.
9. Automated decisions
No automated decisions producing legal effects are taken, and no profiling is carried out.
10. Changes to this policy
If the way we handle data changes, we will update this page and change the last-updated date shown at the top.
Want the privacy policy for your website? Generate it free here.