Controller
Codnia is the trading brand of Ismael Flores, a founder-led studio with operational base in Murcia, Spain. Contact: help@codnia.com and 722 37 20 89.
To exercise rights or ask any privacy question, write to help@codnia.com.
Data we may process
- Identity and contact data: name, email address, phone or WhatsApp, company and project website.
- Project data: service of interest, business type, goal, timeline, indicative budget and free-text message.
- Booking data: selected time slot, time zone and call-related confirmations.
- Technical and attribution data: landing path, URL query, referrer, UTM, gclid, msclkid, fbclid, device, navigation events and user-agent.
- Security and administration data: internal panel access attempts, internal sessions, pseudonymized IP address, anti-fraud signals and strictly necessary technical records.
Purposes and legal bases
- Replying to messages, information requests and bookings: pre-contractual steps or legitimate interest where there is an existing relationship.
- Preparing proposals, quotes and reasonable project follow-up: pre-contractual steps and legitimate interest in commercial management.
- Sending automatic confirmations and operational communications: performance of the user's request.
- Measuring website performance, funnels and acquisition sources: analytics consent, which you can accept, reject or withdraw.
- Activating marketing or advertising measurement tags through Google Tag Manager: specific marketing consent where applicable.
- Keeping the site secure, preventing spam and protecting the internal panel: legitimate interest and the duty to apply appropriate security measures.
- Remembering language and cookie preferences: legitimate interest for technical cookies and compliance with cookie consent obligations.
Recipients and providers
Codnia may use technical providers needed to host the site, store the database, send emails, prevent abuse or measure website usage. The current code includes, among others, Turso/libSQL for database storage, Resend for email, Cloudflare Turnstile for form verification and Google Tag Manager only if the relevant category is accepted.
Where a provider acts as processor, it must process data under Codnia's instructions and with appropriate security measures. If a provider involves transfers outside the European Economic Area, valid safeguards such as adequacy decisions or standard contractual clauses must be used.
Retention
- Requests and leads: up to 24 months after the last contact if no contract is signed, unless a longer period is needed for legal responsibilities.
- Client data or accepted proposals: during the contractual relationship and applicable tax, accounting or liability limitation periods.
- Analytics events: an indicative maximum of 14 months, unless anonymized or aggregated earlier.
- Technical, language and consent preferences: according to the periods stated in the cookie policy.
- Security and administration logs: for as long as needed to protect the service and evidence accesses or incidents.
Your rights
You may request access, rectification, erasure, objection, restriction, portability and, where processing is based on consent, withdrawal of consent without affecting previous processing.
To exercise them, write to help@codnia.com and indicate which right you want to exercise. If you believe the processing does not comply with the rules, you may complain to the Spanish Data Protection Agency.
Minors and sensitive data
The site is not directed at children under 14. We also do not request special categories of data. Please do not include sensitive information in messages or forms unless strictly necessary for your request.
Automated decisions
Codnia does not make automated decisions with legal or similarly significant effects on users. Analytics is used to understand website performance and improve the service.
Security
We apply reasonable technical and organizational measures to protect data, including form validation, Cloudflare Turnstile, an anti-spam honeypot, rate limiting, pseudonymization of technical identifiers, signed admin sessions and access limits for the internal panel.