4friendsFinca Care

Data protection

Privacy policy

Last updated: 01/11/2026

This policy explains, in accordance with Regulation (EU) 2016/679 (GDPR) and the Spanish data protection act (Ley Orgánica 3/2018, LOPDGDD), which personal data we process when you visit 4friends.es or contact us, for what purposes, and what rights you have.

1. Controller

Jan Coenen (4friends)
NIF/NIE: X5660469P
Carrer Roses 2 B, 07600 Son Verí, Llucmajor (Illes Balears), Spain
Email: info@4friends.es
Phone / WhatsApp: +34 627 189 644

We have not appointed a data protection officer because we are not required to (Art. 37 GDPR, Art. 34 LOPDGDD). For any data protection question, please write to info@4friends.es.

2. Summary

  • This website uses no cookies or similar technologies and no analytics, advertising or tracking tools.
  • Fonts and icons are served from our own server; loading the page sends no data to third parties.
  • We only process the technical data needed to deliver the page (server logs) and the data you choose to give us (email, phone, WhatsApp or contact form).
  • All communication with the website is encrypted (HTTPS/TLS).

3. Visiting the website: server logs

Which data: when a page is requested, the web server automatically records the IP address, date and time, the page or file requested, the response code, the amount of data transferred, the referring page (referrer) and the browser identifier (user agent). Requests that look like attacks are additionally recorded in the web application firewall log.

Purpose: delivering the website, keeping it secure and stable, detecting and defending against attacks, and troubleshooting. We do not create profiles or combine these data with other sources.

Legal basis: our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

Retention: logs are rotated weekly and deleted automatically after about five weeks. They are not included in our data backups; backups of the system disk that Oracle keeps for us contain them for up to about two months. Only if a specific entry is needed to investigate a security incident do we keep it until the incident is resolved.

4. Contact by email, phone or WhatsApp

Which data: the data you give us (for example name, email address, phone number, content of your message).

Purpose and legal basis: handling your enquiry and, where applicable, preparing or performing a service contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Retention: we delete the data once your enquiry has been dealt with and is unlikely to be needed again, unless legal obligations require us to keep it (for example business and tax records for the periods set by Article 30 of the Spanish Commercial Code and the General Tax Act).

WhatsApp: if you message us on WhatsApp, the service is provided by WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland), which processes the data under its own privacy policy and may transfer it to Meta Platforms Inc. (USA) under the EU-US Data Privacy Framework. If you do not want this, please use email or phone.

5. Contact form

If you use the contact form, we process your name, email address, your phone number if you give it, and message for the purposes, on the legal bases and for the retention periods described in section 4. Mandatory fields are marked. The form is sent encrypted to our server and from there by encrypted email to our mailbox. We do not use the data for advertising. To protect against spam and mass submissions, the server briefly processes a shortened, obscured IP address (legitimate interest, Art. 6(1)(f) GDPR). We also enter these details in our customer management system at HubSpot (section 7) to keep track of enquiries.

6. Links to other websites

The website contains links to third-party services (Google Maps, Google reviews, WhatsApp, Facebook, Instagram). They are not embedded in the page: only when you click a link does your browser connect to the third party, which is then responsible for any further processing under its own privacy policy. The WhatsApp QR code is an image hosted on our server; displaying it transmits no data.

7. Processors and recipients

We use the following providers, with whom we have data processing agreements (Art. 28 GDPR):

  • Website hosting: Oracle Cloud Infrastructure (Oracle Corporation and its affiliates); the servers are located in Madrid (Spain).
  • Email (enquiries by email and contact form): Incoming emails and messages from the contact form are received and stored by our own mail server in the data centre of dogado GmbH (Dortmund, Germany). We send our replies via Google Workspace (Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland), where sent emails and older enquiries are also stored.
  • Customer management (CRM) (enquiries via the contact form): HubSpot (HubSpot, Inc. and its affiliates); stored in Germany.
  • Domain name resolution (DNS): Cloudflare, Inc.; it only resolves the name 4friends.es and receives no content of your visit.

With the exception of emails held by Google, the data is stored in the European Union. Oracle belongs to a group headquartered in the USA and, under its contract, may access the server from countries outside the European Economic Area, for example from the United States, for support, troubleshooting and recovery. Such access is covered by Oracle's Binding Corporate Rules for processors, approved by the European data protection authorities (Art. 47 GDPR), and additionally by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR); we will send you a copy on request. HubSpot also belongs to a group headquartered in the USA; group companies and individual sub-processors may have access from outside the European Economic Area for support and certain functions, for example from the United States, the United Kingdom or India. This is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which HubSpot, Inc. is certified, and additionally by the Standard Contractual Clauses (Art. 46(2)(c) GDPR). Google may also store and process emails in data centres outside the European Union, for example in the United States. For the United States, this is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified; for other countries, by the Standard Contractual Clauses (Art. 46(2)(c) GDPR; copy on request). Cloudflare only resolves the domain name and receives no content of your visit. We do not pass your data on to any other third parties unless required by law.

8. Your rights

You may at any time and free of charge exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15 to 21 GDPR), and withdraw any consent you have given without affecting the lawfulness of processing before the withdrawal. An email to info@4friends.es is enough; we may ask for additional information to verify your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your Member State of residence.

9. Obligation to provide data, automated decisions

You are not obliged to provide us with personal data; without it, however, we cannot answer your enquiry. We do not make automated decisions or carry out profiling (Art. 22 GDPR).

10. Security

We apply appropriate technical and organisational measures: encrypted transmission (HTTPS/TLS), encrypted storage of website and email data, regular security updates and restricted access.

11. Changes

We will update this policy when the website or the law changes. The version published at any given time applies.

This policy is available in several languages. In case of discrepancy, the Spanish version prevails.

4friends Finca Care