Legal & policies
Privacy Policy
FIRST SERVER is the controller for this website, enquiries and customer administration. The controller's full legal identity, address and contact details are available in our Legal Notice. This notice reflects GDPR and Spain's Organic Law 3/2018 (LOPDGDD).
1. Data, purposes and legal bases
- Website delivery and protection: IP address, browser and request metadata, timestamps and security events may be used to operate the site and prevent abuse, based on legitimate interests in reliable and secure delivery, balanced against visitors' rights.
- Enquiries: your email, message and supplied details are used to respond, based on requested pre-contractual steps or legitimate interests in handling correspondence.
- Customer administration: identity, contact, account and billing information are used to perform contracts. For business representatives, the basis is legitimate interests in managing the business relationship.
- Compliance and claims: relevant records are processed to meet legal obligations or establish, exercise and defend legal claims.
- Cookie preferences: essential browser storage records your choice so that it can be respected. With your consent, Google Tag Manager loads optional analytics tags configured in our container to help understand website use. Refusal prevents our integration from loading the Google container.
Information required to respond or provide a service may be necessary for that purpose. Please do not send unnecessary sensitive information. The public website has no application-level registration or checkout. Security filtering may be automated; it is not intended as automated decision-making with legal or similarly significant effects about individuals.
For sanctions and eligibility checks, we may assess necessary identity, residence, registration, beneficial-ownership and transaction information supplied by the customer or available in official sanctions and relevant public company records. The basis is compliance with applicable legal obligations, or legitimate interests in enforcing lawful service eligibility and preventing circumvention where no specific legal duty applies. Potential matches should be verified and relevant correction evidence considered. Records are retained only as needed for the check, legal obligations or related claims.
2. Recipients and service providers
Hosting, network, email and technical providers may handle information necessary for delivery and correspondence. Cloudflare processes website requests for network delivery and protection, including request metadata and security events. Advisers and competent authorities may receive data where necessary and lawful. The website uses system fonts and does not request Google Fonts.
Google Tag Manager (Google) is used to deliver consent-dependent analytics tags. When you accept analytics, loading the container discloses technical request information, including your IP address and browser information, to Google. Any configured analytics may process page visits, device/browser information and cookie identifiers to measure website use. The legal basis for optional analytics is consent. No advertising consent is granted by this website. See the Google Privacy Policy and our Cookies Policy. Rejecting analytics does not prevent access to the site.
3. International transfers
Global providers such as Cloudflare and, after analytics consent, Google may process data outside the EEA. Transfers subject to GDPR require an applicable adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses and supplementary measures where necessary. Contact us for information about the safeguards applicable to a particular service and how to obtain a copy. Locations and transfers for customer workloads must be documented in the service agreement and DPA.
4. Retention
Correspondence is kept for the time needed to handle the matter and related follow-up or claims. Customer records are retained for the relationship and applicable accounting, tax and limitation periods. Technical logs are retained according to operational and security needs, with longer preservation where necessary for an incident or legal requirement. Data is deleted, anonymised or restricted when its purpose ends, subject to legally required retention. Cookie preferences expire for consent purposes after 180 days or when the consent version changes.
5. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Consent can be withdrawn without affecting earlier lawful processing. Use the contact channel or registered address in our Legal Notice. Proportionate identity verification may be necessary. We normally respond within one month; any permitted extension will be explained within that month.
You may complain to the Spanish Data Protection Agency (AEPD) or the competent authority in your place of habitual residence, work or alleged infringement.
6. Customer workloads and changes
Customers may control the personal data they host, with FIRST SERVER acting as processor under the agreed DPA. Requests concerning their content should normally be directed to them. See the Cookies Policy for storage and preferences. Material updates will be reflected in the date on this page; new consent-dependent purposes require consent before they begin.