Privacy policy

1. Data controller and contact details

1.1. The data controller is Santiago Ángel Lope del Palacio, trading as WebMonster, whose business address is Calle Picasso 1, Oficina 5, 28691 Villanueva de la Cañada (Madrid), Spain.

1.2. Data protection enquiries and requests to exercise rights may be sent to [email protected], submitted through a support request in the customer area or sent in writing to the address above. You do not need an account to exercise your rights.

2. Scope of this policy

2.1. This policy explains how WebMonster processes the personal data of people who visit its website, make enquiries, create an account, purchase services or participate in WebMonster Partners or Recommend WebMonster. It also covers customer representatives and contacts, and people introduced by participants in those programmes.

2.2. Customer means a person or entity purchasing services. References to the data subject include any natural person whose data is processed in any of the circumstances described in this policy, even if they have not purchased a service.

2.3. Where WebMonster hosts or processes personal data on the Customer’s behalf to provide hosting, email, managed services or technical work, the Data processing agreement applies. The Customer determines the purposes of that processing. This policy governs processing carried out by WebMonster to manage its own business.

2.4. Cookies and similar technologies are explained in the Cookie policy. Accepting contractual terms or reading this policy does not replace specific consent for processing that requires it.

3. Data processed and its sources

3.1. Depending on the relationship and service, WebMonster may process the following categories of data:

• Identity and contact details: first and last names, company and job title where applicable, NIF or another tax identifier, billing address, email address and telephone number.
• Account and purchasing information: access details and authorised users, orders, quotes, services and domains purchased, renewals, cancellations, preferences and records of accepted terms.
• Billing and payments: invoices, amounts, transaction status and identifiers, refunds and payment method details needed to collect payment through the relevant provider.
• Enquiries and support: the content of requests, communications, incidents, authorisations and documents supplied to address them.
• Partners and Recommend WebMonster: application and participation details, the programme and version accepted, referrals, attribution, commissions, rewards, balances and documents needed to validate, settle or apply them.
• Fraud prevention checks: order details and risk-check results, including indicators that may link a transaction to potentially fraudulent activity.
• Technical and browsing information: IP address, dates and access and activity logs, browser and device information, pages visited and interactions. Collection for statistical purposes is subject to section 8.

3.2. Data comes primarily from the data subject and their use of the website and services. It may also come from the person creating or managing a business account; a Partners or Recommend WebMonster participant introducing a prospective customer; payment or domain registration providers reporting the status of a requested transaction; and FraudLabs Pro, which returns information about an order’s fraud risk.

3.3. Where data is obtained from another person, WebMonster will provide information about its processing and source within the statutory time limits and, if used to contact the data subject, no later than the first communication, unless a legal exception applies.

3.4. Forms identify mandatory fields. A customer account requires identification and billing details, an email address and a telephone number. The telephone number is used for domain registration processes that require it, identity checks where necessary, fraud prevention and occasional service-related contact, for example during incidents. Failure to provide necessary data may prevent account creation, order processing or handling of a request. An enquiry does not require all the data needed to purchase a service. Anyone providing another person’s data must be entitled to do so and provide only what is necessary.

4. Purposes and legal bases

4.1. Enquiries and quotes. Contact details and request content are used to respond, prepare proposals and follow up. Where an enquiry concerns a potential purchase requested by the data subject, the legal basis is taking pre-contractual steps. For other enquiries relating to WebMonster’s business, the basis is its legitimate interest in responding to communications received. Rights requests and legally required communications are handled on the basis of a legal obligation.

4.2. Accounts, purchases and service provision. Necessary data is used to create and manage the account, identify the Customer, process orders, provide services, handle renewals and cancellations and send communications necessary for that relationship. The basis is performance of the contract or requested pre-contractual steps. Data about company representatives and contacts is processed on the basis of the legitimate interest in managing the relationship with the entity they represent.

4.3. Payment collection, billing and legal obligations. Data is used to collect service payments, manage authorised recurring payments, payment problems and refunds, and issue and retain invoices. Payment management is based on contract performance. Invoicing, accounting and tax obligations are based on compliance with legal obligations.

4.4. Support and technical work. Requests, communications and necessary data are used to resolve incidents, carry out authorised work and document actions taken. The basis is performance of the contractual relationship. Where work involves processing personal content hosted on the Customer’s behalf, the processing agreement referred to in section 2.3 also applies.

4.5. Domains. Registrant and necessary contact details are used to process requested registrations, renewals, transfers and other operations, including checks required by the relevant registry. The basis is contract performance and, where applicable, compliance with legal obligations. The rules for each domain extension are addressed in the Specific domain terms.

4.6. WebMonster Partners and Recommend WebMonster. Data is used to manage applications, participation, referral attribution, commissions, rewards, balances, settlements and communications for both programmes. The basis is taking pre-contractual steps and performing the participation relationship; tax documentation is processed to meet legal obligations. Checking for abuse and improper attribution is based on the legitimate interest in protecting the programmes. Attribution cookies requiring consent will be used only after consent has been obtained.

4.7. Security and defence of rights. WebMonster processes necessary data to protect accounts and systems, investigate unauthorised access, prevent fraud and abuse, and establish, exercise or defend legal claims. The basis is the legitimate interest in protecting the business, its services and users, and compliance with legal obligations where applicable. Processing is limited to what is necessary for those purposes, with the rights of affected individuals taken into account.

4.8. Browsing statistics. Data is used to analyse visits and website usage through Google Analytics. The basis is consent given through cookie preferences, which may be withdrawn at any time. Rejecting statistics cookies does not prevent service purchases.

4.9. Fraud analysis. WebMonster uses FraudLabs Pro to assess order fraud risk automatically, using transaction data and checks on the identity, contact details and connection used. If risk is detected, the order is held for human review. WebMonster assesses the information before deciding whether to accept or reject it; the system’s result does not by itself determine rejection or cancellation. The affected person may provide clarification and request a review of the decision through the channels in section 1. This processing is based on the legitimate interest in preventing fraudulent transactions and protecting WebMonster and its customers.

5. Data retention

5.1. Data needed to manage the account and provide services will be kept while the Customer relationship continues or while services, hour packages, balances or obligations remain outstanding, including participation in WebMonster Partners or Recommend WebMonster. Ending one service does not necessarily end every relationship with WebMonster.

5.2. After the relationship ends, only documentation necessary to meet tax and commercial obligations and address potential liabilities will be kept, for the applicable statutory retention and limitation periods. If a claim or proceeding is pending, related documents will be retained until it is resolved and for the relevant subsequent periods. Retention does not authorise use for other purposes.

5.3. Enquiries that do not lead to a purchase will be kept as long as necessary to answer them and complete the requested steps. After that, only information that must be retained for legal obligations or specific liabilities will be kept for the applicable periods.

5.4. Invoices and accounting records will be retained for the periods required by tax and commercial law, taking account of the applicable calculation rules and any extensions or interruptions. These documents may be retained in a separate archive even after the customer account is closed.

5.5. Technical and security logs will be retained as long as needed to check operation, detect and investigate incidents and protect systems. Where logs are needed as evidence of an incident or claim, the relevant records will be kept for the time needed to address it and any associated liabilities.

5.6. Google Analytics retention is described in section 8. Content hosted on the Customer’s behalf and associated backups are governed by the specific terms and the data processing agreement.

5.7. Recipients acting as independent controllers, identified in section 6, apply their own retention criteria to processing for which they are responsible, as explained in their privacy information. WebMonster’s retention periods do not mean those recipients automatically delete their records on the same date.

5.8. When erasure is appropriate, data will be blocked where necessary to address potential liabilities, as required by law. Blocking prevents ordinary use. Once the applicable periods expire, the data will be destroyed or irreversibly anonymised.

6. Data recipients

6.1. Accounts, orders, billing and support requests are managed through systems hosted on infrastructure administered by WebMonster. Infrastructure and support providers may access data where they need to process it to provide their services, subject to the appropriate confidentiality, security and data protection obligations.

6.2. Necessary data will also be disclosed to the following recipients, depending on the transaction:

• Stripe: to process payments, authorised recurring charges, refunds and associated transaction checks. Depending on the activity, Stripe may act as WebMonster’s processor or as controller of its own processing, including processing arising from its legal obligations and certain fraud prevention activities. Its Privacy policy explains this processing.
• Hexasoft Development Sdn. Bhd. (FraudLabs Pro), Malaysia: to analyse order fraud risk. It receives transaction data and the identification, contact and technical data needed for checks. The provider states that it acts as an independent controller for its processing, under its Privacy policy.
• Trilus Asesores Economistas, S.L.: for tax and accounting management and advice, with access to the documents needed for those functions.
• Domain registrars and registries: to carry out requested operations and related checks. Hosting Concepts B.V., trading as Openprovider, is involved alongside the registry for the purchased extension. Disclosures and access to registration data are subject to applicable rules; purchasing a domain does not mean that all the registrant’s details are published indiscriminately.
• Google: to provide Google Analytics where statistics cookies have been accepted. Further information is provided in section 8.
• Financial institutions and providers of the collection or payment method used: to carry out and document transactions, including any Partners settlements.
• Public administrations, authorities and courts: where a legal obligation or valid request exists. Professionals assisting WebMonster with a claim may also be involved, with access limited to what is necessary.

6.3. In WebMonster Partners and Recommend WebMonster, each participant receives the information needed to check their attribution, commissions and rewards. Participation in either programme does not provide general access to referred customers’ accounts, invoices, communications or hosted content.

6.4. Providers acting on WebMonster’s behalf process data according to its instructions and the relevant agreement. Where a recipient determines its own purposes and means, it acts as controller for the processing for which it is responsible.

7. International transfers

7.1. Using international providers, particularly Google, Stripe and FraudLabs Pro, may involve processing data outside the European Economic Area. Hosting the website or customer area on European servers does not rule out those transfers.

7.2. Transfers will take place with the safeguards required by law: an adequacy decision applicable to the recipient and processing or, where appropriate, standard contractual clauses and necessary supplementary measures. Accepting this policy does not give blanket permission to transfer data without those safeguards.

7.3. Data subjects may request information about the applicable safeguards and how to obtain a copy through the channels in section 1. They may also consult the data processing terms applicable to Google Analytics, Stripe’s Data Processing Agreement and FraudLabs Pro’s data protection agreement, which includes controller-to-controller standard contractual clauses for transfers that require them.

8. Google Analytics and cookies

8.1. Google Analytics is used to obtain statistics on visits, pages viewed and interactions, and understand how the website is used. It may process cookie-related identifiers and technical browser and device information. WebMonster activates it only after obtaining consent for statistics cookies. It is not currently connected to Google Ads.

8.2. Retention is configured for two months for event data and fourteen months for user data. The retention period linked to the user identifier resets when new activity is recorded. These settings do not affect standard aggregated statistical reports and are not the same as the lifespan of each cookie.

8.3. Data subjects may accept, reject or change their preferences through the website’s cookie management mechanism. Withdrawing consent does not affect the lawfulness of prior processing or prevent the exercise of applicable rights over data already collected.

8.4. The Cookie policy identifies the cookies used and their characteristics. Google explains its services in How Google uses information from sites or apps that use our services, and in its information on Analytics data retention.

9. Data subjects’ rights

9.1. In the circumstances and subject to the requirements established by law, data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection and portability.

9.2. Where processing is based on legitimate interests, data subjects may object on grounds relating to their particular situation. WebMonster will stop processing unless it demonstrates overriding compelling legitimate grounds or processing is necessary to establish, exercise or defend legal claims.

9.3. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of earlier processing. Portability applies, where appropriate, to data provided by the data subject and processed by automated means on the basis of consent or a contract.

9.4. Requests are submitted through the channels in section 1, identifying the right to be exercised and providing the information needed to locate the processing. If there are reasonable doubts about identity, WebMonster may request proportionate additional information to verify it. A copy of an identity document will not be required as a matter of routine.

9.5. WebMonster will respond without undue delay and, in any event, within one month of receiving the request. Where necessary because of complexity or the number of requests, that period may be extended by two further months; the extension and its reasons will be communicated within the first month. Exercising rights is free of charge except in the exceptional cases permitted by law.

9.6. Erasure does not require deletion of information that must be retained to meet a legal obligation or handle claims. In those cases, its use will be restricted and blocking applied where appropriate.

9.7. Data subjects may lodge a complaint with the Spanish Data Protection Agency or the competent supervisory authority. They do not have to complain to WebMonster first.

10. Security and policy updates

10.1. WebMonster applies technical and organisational measures appropriate to the risk, including access controls, enhanced authentication for administration, encrypted connections and access logging. Two-factor authentication is available for customer accounts and is optional. Measures are reviewed as services and risks evolve, without guaranteeing the absolute absence of incidents.

10.2. This policy may be updated to reflect changes in processing, providers or legal requirements. The current version will be available on the website. Significant changes will be communicated to affected individuals through an appropriate channel. If data is to be used for a new purpose, information will be provided and consent obtained where necessary before that processing begins.