Privacy policy
Here we explain what personal data we process, why, on what legal basis, how long we keep it and how you can exercise your rights. In this text, «Balisk» and «we» refer to the controller.
Last updated: 27 October 2026
Summary
| Item | Information |
|---|---|
| Controller | Marouan Jaadi (Balisk) · NIF 40577166Z · Carrer Nord, 24, 2n, 17600 Figueres (Girona) · hola@balisk.com |
| Purpose | To answer your request, provide the service and, if you ask, prepare a proposal |
| Legal basis | Your request and pre-contractual steps (Article 6(1)(b) GDPR), the contract, our legitimate interest and, for analytics cookies and commercial communications, your consent (6(1)(a)) |
| Recipients | Technology providers acting as data processors; Google and Microsoft only if you accept their cookies. We do not pass data on to third parties |
| Rights | Access, rectification, erasure, objection, restriction and portability, at hola@balisk.com |
1. Controller
Marouan Jaadi, trading as Balisk, tax ID 40577166Z, address Carrer Nord, 24, 2n, 17600 Figueres (Girona), email hola@balisk.com. We have not appointed a data protection officer because we do not profile people or process data on a large scale.
2. What data we process, why and for how long
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact and requests | Name, email, company, website, role, need and message from the form; language; page of origin and campaign tags (utm), if any | To answer and, if you ask, prepare a proposal | Your request and pre-contractual steps (6(1)(b)) | 12 months from the last contact if there is no contract |
| Free checker | Address of the analysed website; your IP turned into a code with a secret key (pseudonymised, not anonymous data) to prevent abuse; anti-bot check | To analyse the website you enter | The service you request (6(1)(b)) and legitimate interest in preventing abuse (6(1)(f)) | Results: 12 months. IP code: 30 days |
| Clients | Details of the client company’s contact people, billing, contract and communications | To provide the service, invoice and meet legal obligations | Contract (6(1)(b)), legal obligation (6(1)(c)) and legitimate interest (6(1)(f); Article 19 LOPDGDD) | Length of the contract and legal periods, with blocking (Article 32 LOPDGDD) |
| Business outreach | Name, role, company and business phone or address, taken from public professional sources; date and outcome of the contact | To offer our services to businesses | Legitimate interest (6(1)(f)) and Article 19 LOPDGDD | 12 months without reply. If you object, you go on the exclusion list |
| Exclusion list | Minimum data to identify you and date of the objection | Not to contact you again | Legal obligation and legitimate interest (Article 23 LOPDGDD) | As long as needed to respect your objection |
| Commercial communications, if you tick the box | Name, email and the date and wording of the consent you gave | To send you information about our services | Your consent (6(1)(a)) and Article 21 LSSI | Until you withdraw it. After that we keep proof of the consent and of its withdrawal while your contact exists |
| Analytics with cookies, if you accept them | Pseudonymous identifier kept in a cookie; page views, device and browser; usage events: form start and steps, submission, checker result by band (never the analysed address), clicks on the main buttons and language changes. With Clarity, also clicks, scrolling and recordings of the visit with form fields hidden | To learn which parts of the site work and improve them | Your consent (6(1)(a) GDPR and Article 22.2 LSSI) | Google Analytics: 14 months. Clarity: recordings, 30 days; aggregated data, 13 months |
| Record of your cookie choice | Random code, choice per category, cookie policy version, language and date. No IP | To be able to prove your consent | Legal obligation (6(1)(c) and Article 7(1) GDPR) | 24 months |
| Use of the website | Server logs; cookieless aggregated statistics (Cloudflare Web Analytics); record of form and checker submissions | Security, abuse prevention and measuring use of the site | Legitimate interest (6(1)(f)) | Server logs: 7 days. Submission record: 13 months; its IP code is deleted after 30 days |
We do not send commercial emails you have not requested or authorised (Article 21 LSSI). In every business contact we tell you about your right to object and act on it straight away.
We make no automated decisions with legal or similarly significant effects on you (Article 22 GDPR).
3. Who we share your data with
- We do not sell or pass on data to third parties.
- Technology providers acting as data processors (website hosting and security, email, client management, e-signature, invoicing and an artificial intelligence service that helps us sort requests, with no automated decisions), under an Article 28 GDPR agreement. You can ask us for the up-to-date list at hola@balisk.com.
- Analytics: Google Ireland Limited (Google Analytics) and Microsoft Ireland Operations Limited (Microsoft Clarity), as processors and only if you accept their cookies; Cloudflare, Inc. for the cookieless statistics (Cloudflare Web Analytics). We run Google Analytics without advertising or Google signals.
- Legal obligations: tax authorities, banks, courts and authorities, when the law requires it.
4. International transfers
If a provider processes data outside the European Economic Area, the transfer relies on a European Commission adequacy decision or on standard contractual clauses. Google, Microsoft and Cloudflare may process data in the United States: those transfers rely on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), to which their parent companies have signed up, and on standard contractual clauses. You can ask for a copy of the safeguards at hola@balisk.com.
5. Your rights
You can exercise the rights of access, rectification, erasure, objection (including to business outreach, at any time and without giving reasons), restriction and portability, and withdraw consent where processing is based on it: for cookies, with «Cookie settings» in the footer of every page; for commercial communications, by replying «BAJA» (unsubscribe) to any of them or by writing to us. Write to hola@balisk.com or by post to Carrer Nord, 24, 2n, 17600 Figueres (Girona).
We reply within one month at most; in complex cases this may be extended by two months, and we will tell you if so. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the supervisory authority of your country.
6. Security
We apply technical and organisational measures appropriate to the risk, such as access control with email verification and least privilege, encryption in transit, backups and access logs.
7. When we process data on behalf of our clients
If a client gives us access to systems holding personal data, we act as a data processor under the agreement we sign with them. The client is then the controller, and rights are exercised with them.
8. Changes and contact
If we change this policy, we will publish the new version with its date. To exercise your rights or ask about your data: hola@balisk.com or the contact form.