Privacy Policy
This policy explains how Zenwood Solutions, S.L. processes personal data obtained through zenwood.es, its forms, sample requests, quotations, orders and contact channels. Each form displays a summary and this page provides the full information.
1. Controller
Zenwood Solutions, S.L. (single-member company)
Tax ID B19952068
Carrer dels Pins, 6, 08629 Torrelles de Llobregat, Barcelona, Spain
Barcelona Commercial Registry, sheet B-619520, entry 1
hola@zenwood.es · +34 613 099 044
2. Data processed
- Identity and contact data: name, company, email address, telephone number and address.
- Project and commercial-relationship data: location, application, product, finish, profile, quantity, dates, messages, samples and quotation.
- Order, delivery, invoicing, payment, incident and guarantee data where a commercial relationship exists.
- Technical data: IP address, device, security logs, consent, pages visited and UTM/GCLID parameters, only as permitted by the purpose and cookie choice.
- Content supplied voluntarily. Special categories of personal data should not be submitted unless Zenwood expressly requests them and their necessity has been established.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Answer enquiries, prepare quotations, arrange samples and take requested steps before entering into a contract. | Article 6(1)(b) GDPR: pre-contractual steps requested by the data subject. | Up to 24 months after the last interaction if no contract is concluded, unless the person objects or restricted retention is required for legal claims. |
| Orders, production, delivery, invoicing, collection, incidents and guarantees. | Articles 6(1)(b) and 6(1)(c) GDPR: contract and legal obligations. | For the duration of the relationship and then restricted for the applicable limitation periods; commercial documentation for up to 6 years and tax documentation generally for 4 years. |
| Marketing communications by email and/or WhatsApp. | Article 6(1)(a) GDPR and the Spanish Information Society Services and Electronic Commerce Act: specific, optional and separate consent. | Until consent is withdrawn or after 24 months without interaction, whichever occurs first; minimum opt-out evidence may be retained to prevent further messages. |
| Analytics, campaigns, conversions and advertising audiences. | Analytics or Marketing consent under Article 6(1)(a) GDPR and Article 22(2) of the Spanish Information Society Services and Electronic Commerce Act. | As stated in the inventory in the Cookie Policy. |
| Security, hosting and abuse prevention. | Article 6(1)(f) GDPR: legitimate interest in maintaining a secure service; and Article 6(1)(c) where applicable. | Only for the period needed for security, diagnosis and legal claims, subject to the provider agreement. |
| Remember, measure and demonstrate the privacy choice. | Articles 6(1)(c) and 7(1) GDPR; legitimate interest in demonstrating compliance and evaluating the operation of the privacy mechanism. | Browser choice: 180 days. Minimized banner-session records: 180 days; full IP addresses and page histories are not stored. |
4. Required data and optional marketing
Marked fields are needed to handle the request. Reading the privacy information is not consent to advertising. The marketing checkbox is unticked, optional and does not condition an enquiry, sample request or quotation.
5. Recipients
Zenwood does not sell data. It discloses data or permits access only where necessary: Hostinger for hosting, CDN and security; Google Workspace for email; Clientify when used as a CRM or for authorized acquisition and attribution; Holded for commercial management, orders and invoicing; WooCommerce and the selected payment provider; carriers; accounting and tax advisers; contracted technical providers; and authorities where disclosure is legally required. WhatsApp acts under its own terms when the user starts a conversation. Google, Meta and other optional services receive technical data only after the matching consent.
Clientify may act as a processor to organize contacts and requests. Handling a request does not make advertising consent mandatory. Browsing tracking, campaign attribution and promotional communications remain separate.
6. International transfers
Global providers — particularly Google, Meta, Stripe, PayPal, WhatsApp and certain hosting subprocessors — may process data outside the EEA. Zenwood must keep them active only when the applicable contract identifies a valid safeguard: an adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, or standard contractual clauses under Article 46 GDPR with supplementary measures. Optional services must not be activated in production while the provider contractual file is incomplete.
7. Rights
You may request access, rectification, erasure, objection, restriction, portability and withdrawal of consent free of charge by writing to hola@zenwood.es. An ID copy is not routinely required; proportionate additional information may be requested only where there are reasonable doubts about identity. Zenwood will normally respond within one month, which may be extended by two further months in complex cases.
You may also complain to the Spanish Data Protection Agency.
8. Automated decisions, security and changes
Zenwood makes no solely automated decisions with legal or similarly significant effects. It applies HTTPS, access control, backups, data minimization and confidentiality. This policy is reviewed when a provider, purpose, form, transfer or retention period changes. The Spanish version controls and this English version must remain equivalent.