Privacy policy
Last updated:
This policy explains which personal data we collect through brillava.es, why, on what legal basis, who we share it with, how long we keep it and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This English version is provided for convenience; the Spanish version (Política de privacidad) prevails.
1. Data controller
| Item | Data |
|---|---|
| Controller | Dathent SAX, S.L. (trading as Brillava) |
| Tax ID (CIF) | B22632632 |
| Address | Avenida Reyes Católicos, 9, Bajo, 03630 Sax (Alicante), España |
| Privacy contact | [email legal] · WhatsApp +34 647 483 784 |
| Data Protection Officer | Not appointed: the activity does not require one (art. 37 GDPR, art. 34 LOPDGDD). Requests are handled at the email above. |
2. What data we process and where it comes from
All data is provided by you directly through the site or WhatsApp. We do not buy data or obtain it from third parties.
| Form / channel | Data |
|---|---|
| Price calculator (quote request) | Postcode, surface type, square metres, dirt level, access conditions, name, phone, email (optional), preferred language, photographs of the surface you choose to upload, date and version of your consent. |
| "Call me back" | Phone number, language, date and version of consent. |
| Site chat ("Chat with a manager" bubble) | The text of your messages, your name and phone if you choose to give them, the language, the page you write from and the time. Messages are relayed to our team through Telegram (Telegram Messenger Inc.) so we can reply inside the chat; no photographs are transmitted. |
| WhatsApp / phone | Your number, profile name and the content of the conversation. |
| During the service | Full property address (only once the order is confirmed), before/after photographs taken by the crew, job incidents. |
| Technical data | IP address and browser data processed by Cloudflare for security (Turnstile bot protection, rate limiting) and technical server logs. |
Photographs should show only the surface to be cleaned. Please do not upload images showing identifiable people, number plates or personal belongings; if they do, we use them solely to prepare the quote and delete them with the rest of the quote data.
The site is not aimed at minors. Ordering the service requires being over 18.
3. Purposes and legal basis
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Calculate and send you a quote, contact you by phone or WhatsApp to confirm it and arrange the service | Pre-contractual steps at your request (art. 6.1.b). |
| Provide the contracted service, manage date, access, execution and invoicing | Performance of the contract (art. 6.1.b) and tax/accounting legal obligations (art. 6.1.c). |
| Process the photographs you upload and those the crew takes before and after, as evidence of the surface condition and result | Consent (art. 6.1.a) given when sending the request, and contract performance for job photos (art. 6.1.b). |
| Publish before/after photographs of your job on the site or social media | Only with your express, separate consent, requested when the job is finished. Never without it. |
| Protect the site against abuse, bots and fraud; rate limiting | Legitimate interest in the security of our systems (art. 6.1.f). |
| Record your consent (date and version of the accepted texts) | Legal obligation to demonstrate consent (art. 7.1 GDPR). |
| Answer your enquiries and rights requests | Legal obligation (art. 6.1.c) and legitimate interest (art. 6.1.f). |
We do not use your data for advertising or pass it to third parties for commercial purposes. Any future marketing would require a specific consent.
Automated decisions. The calculator produces a price estimate automatically from the data you enter. That estimate has no legal effect and does not bind you: the final price is always confirmed by a person after reviewing your photographs.
4. Recipients and processors
Your data is handled by the people at Dathent SAX, S.L. who manage requests and by the crew assigned to the job. The full property address is disclosed to the crew only once the order is confirmed.
We also use the following providers as processors (art. 28 GDPR):
| Provider | Service | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. (USA) and Cloudflare Spain | Site and API hosting, database, photo storage, bot protection (Turnstile), rate limiting | Data hosted in the European Union (Western Europe region). Cloudflare is certified under the EU-US Data Privacy Framework and applies Standard Contractual Clauses. |
| Telegram (Telegram FZ-LLC, United Arab Emirates) | Internal notification to the management team of each new request (name, phone, postcode, estimated price) and job coordination | May involve an international transfer outside the EEA. [Transfer safeguards applicable to Telegram — pending review with the advisor (TASK-033)] |
| WhatsApp Ireland Ltd. (Meta) | Messaging with customers who write to us or agree to be contacted on WhatsApp | Meta Platforms is certified under the EU-US Data Privacy Framework and applies Standard Contractual Clauses. |
| Google Fonts (Google Ireland Ltd.) | Loading the site's typefaces | Your browser sends your IP to Google when fonts load. No cookies are set. |
No other disclosures are made except those required by law (tax authorities, courts, law enforcement).
5. Retention periods
[Proposed retention periods — pending confirmation by the controller (EPIC-005, question 3)]
| Data | Period |
|---|---|
| Quote and call-back requests that do not become an order | 12 months from the request; then deleted, including photographs. |
| Site chat conversations | 12 months from the start of the chat; then deleted automatically (scheduled purge). |
| Customer and executed-order data | For the duration of the relationship and then blocked for the statutory limitation periods: 4 years (tax, art. 66 LGT) and 6 years (commercial records, art. 30 Commercial Code). |
| Before/after photographs taken by the crew | 12 months after the job is finished, unless a claim is open or you consented to publication. |
| Security logs (IP, requests) | Those generated by Cloudflare under its policy; our internal audit logs, 12 months. |
| Consent record | For as long as the processing lasts plus limitation periods, to be able to prove it. |
6. Your rights
You may exercise, free of charge and at any time, the rights of:
- Access: know which of your data we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer needed.
- Objection: object to processing based on legitimate interest.
- Restriction: ask us to keep but not use your data in certain cases.
- Portability: receive your data in a structured format or have it sent to another controller.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
Write to [email legal] or WhatsApp +34 647 483 784 stating the right you exercise and a detail that identifies you (the phone number used for the request). We reply within one month at most.
If you believe your rights have not been properly handled you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would appreciate the chance to resolve it first.
7. Security
We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS), photographs stored privately and reachable only through short-lived signed links, full address withheld until a crew is assigned, access control on internal tools, a change log for prices and statuses, rate limiting and bot verification on forms.
9. Changes to this policy
We may update this policy for legal or service changes. The date of the current version appears at the top. Each request stores the version of the texts you accepted (2026-09-14 for the current version).
See also the Legal notice and the Terms of service.