1. Who We Are
SpainTrades (www.spaintrades.es) is operated by Stewart James Bartley (NIE: Z2539708F), registered at Calle Santiago 7, 29313 Villanueva del Trabuco, Málaga, Spain. For the purposes of the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD), we are the Data Controller of personal data collected through this platform.
Contact for data protection matters: hello@spaintrades.es
2. What Data We Collect
From Clients (Homeowners)
- Name and email address
- Location/area in Málaga province
- Details of quote requests submitted
- Reviews submitted (held as Pending until moderated and approved)
- Platform messaging communications
- Technical data: IP address, browser type, device type, pages visited
From Tradespeople
- Name, business name, trade, and contact email
- Spanish CIF or NIF number
- Business address and operating area
- Professional photographs and portfolio images
- Business description and service information
- Voluntarily declared qualifications, certifications, and professional associations
- Subscription and payment information (processed by Stripe — card details are not stored by SpainTrades)
- Platform messaging communications
- Review responses submitted (held as pending responses until moderated and approved)
- Technical data: IP address, browser type, device type, pages visited
Voluntarily declared qualifications, certifications, and professional associations are held on the platform as provided by the Tradesperson. This information is not verified by SpainTrades.
3. How We Use Your Data
We use your personal data to:
- Create and manage your account on the SpainTrades platform
- Connect Clients with Tradespeople and facilitate quote requests
- Moderate and publish reviews (all reviews held as Pending until approved by SpainTrades administration)
- Moderate and publish Tradesperson responses to reviews (held as pending responses until approved)
- Notify the SpainTrades administration team when new reviews and responses are submitted for moderation
- Translate text between English and Spanish via DeepL: Tradesperson profile text (business description, services and qualifications) when it is saved or edited, quote requests and messages exchanged between Clients and Tradespeople, and approved review and response text
- Process subscription payments via Stripe
- Send transactional emails via Resend (account confirmation, quote notifications, review status notifications)
- Verify Tradesperson identity and CIF/NIF registration
- Calculate and display average ratings (from Published reviews only)
- Comply with legal and regulatory obligations
- Improve and maintain the SpainTrades platform
- Send a free series of guide emails to businesses listed on Google Maps, and invite them to create a SpainTrades profile (see Section 13)
4. Legal Basis for Processing
- Contract performance — processing necessary to provide the SpainTrades service you have signed up for
- Legitimate interests — improving the platform, fraud prevention, platform security, review moderation, and contacting businesses listed on Google Maps with our free guide series (Section 13)
- Legal obligation — compliance with Spanish and EU law including tax obligations
- Consent — where we have obtained your explicit consent (e.g. marketing communications)
5. Data Sharing — No Third Party Commercial Use
SpainTrades does not sell, rent, or share personal data with any third party for that third party’s own commercial, marketing, or any other independent purpose.
Data is shared only as strictly necessary to operate the platform:
- Between Clients and Tradespeople — to facilitate introductions and quote requests
- Stripe — for payment processing only. SpainTrades does not store payment card details.
- Resend — for email delivery (transactional emails and the trade guide email series)
- Trustpilot — we link to our Trustpilot review page from customer quote pages. We do not send Trustpilot any of your personal data. If you follow the link, Trustpilot’s own privacy policy applies to what you do there.
- Zoho — for CRM and email marketing where consent has been given
- Supabase — for secure database hosting within EU data centres
- DeepL (DeepL SE, Germany) — machine translation between English and Spanish of Tradesperson profile text, quote requests and messages between Clients and Tradespeople, and approved review and response text
- OpenRouter (OpenRouter, Inc., USA) — chat widget messages and AI-generated profile text, routed to the DeepSeek model for the chat widget’s replies and for drafting profile text. Provider routing is configured to exclude China-based hosts and to require no data retention by the model provider.
- Sentry (Functional Software, Inc., USA) — error reports, including the request URL and technical details (browser, device). Email addresses and IP addresses are stripped before the report is sent.
- Upstash — IP addresses, for rate limiting on login, registration and other sensitive forms
- OpenStreetMap Nominatim — addresses and locations entered in Search or on a Tradesperson profile, to convert them into map coordinates (geocoding)
- Cloudflare R2 — a compressed daily copy of the database, kept for 14 days and stored off-site for disaster recovery
- GitHub / GitHub Actions — runs the scheduled jobs, including the daily database backup; that backup file passes through GitHub’s build runners and is also kept as a GitHub artifact for 90 days
- Google Sheets — recipient email address, subject line, and open/click status of outreach emails, exported for reporting
- QuickEmailVerification (QuickEmailVerification LLC, USA) — email addresses of prospective Tradespeople sourced from public business listings, checked for deliverability before outreach
- unpkg and OpenStreetMap’s map tile servers — when a coverage map is shown, your browser requests map tile images and marker icons directly from these services, which see your IP address
Your personal data is never shared with any third party for their own use. All service providers listed above are contractually bound to process data only as instructed by SpainTrades and in compliance with GDPR.
6. Reviews and Responses — Data Handling
Review data submitted by Clients is held with a status of Pending until approved by the SpainTrades administration team. Pending reviews are not visible to any platform user, including the Tradesperson. On approval, review text is translated between English and Spanish by DeepL.
Tradesperson responses are held as pending responses until approved by the SpainTrades administration team. On approval, response text is translated between English and Spanish by DeepL and published to the public profile.
If a Client updates a Published review, the review automatically reverts to Pending status, the translation is cleared, and the Tradesperson’s average rating is recalculated. The updated review is re-moderated before republication.
7. Data Retention
- Account data — retained for the duration of your account plus 2 years following closure
- Transaction and invoice records — retained for 7 years in accordance with Spanish tax law
- Communication and messaging records — retained for 2 years
- Review and response data — retained for the duration of the Tradesperson listing plus 2 years
- Pending and rejected review data — retained for 6 months from submission then deleted
- Technical/log data — retained for 12 months
- Self-declared qualification data — retained for the duration of the active listing plus 1 year
8. Your Rights Under GDPR
Under the GDPR and Spanish LOPDGDD, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate personal data
- Erasure — request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations
- Restriction — request that we restrict processing of your data
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at hello@spaintrades.es. We will respond within 30 days.
You also have the right to lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
9. Cookies and Session Recording
SpainTrades uses essential cookies required to operate the platform and keep you signed in. We do not use advertising cookies and do not set them in your browser.
With your consent, given through the cookie banner on your first visit, we also use Microsoft Clarity to understand how visitors use the site. Clarity records how pages are used (mouse movement, clicks, scrolling and page views) as session recordings and heatmaps. It identifies visitors with a random identifier. This is pseudonymous data: it is still personal data, not anonymous data. Clarity masks the content of input boxes, which Microsoft states is masked in all modes. That does not guarantee that nothing you type is ever recorded, so please avoid entering sensitive details into forms while analytics is on. We tell Clarity that advertising storage is denied at all times.
Google Analytics (GA4) is configured in the application but is currently inactive: no Google Analytics cookie is set and no data is sent to Google. If it is enabled in future, it will run only after consent, and this section will be updated first.
Clarity does not start until you accept, and it does not start on later pages after you reject or withdraw. You can change or withdraw your consent at any time with Cookie Preferences in the footer of every page. Withdrawing denies Clarity analytics storage, clears the analytics cookies this site can reach, and stops Clarity loading on later pages. A page that is already open and holds unsaved input is not reloaded, so it may continue limited, cookieless Clarity activity until you leave it. SpainTrades cannot delete cookies that Microsoft sets on its own domains; you can delete those in your browser.
For the cookies this sets, see our Cookie Policy.
10. Data Security
SpainTrades implements appropriate technical and organisational security measures including:
- Encrypted data transmission (HTTPS/TLS)
- Secure database hosting via Supabase with EU data centres
- Access controls limiting data access to authorised personnel only
- Regular security reviews
11. International Data Transfers
Your data is stored and processed within the European Union. Where any approved processor operates outside the EU, appropriate GDPR safeguards are ensured.
Some processing relies on a provider based outside the EU. Chat widget replies and AI-drafted profile text are generated through OpenRouter (USA), which routes each request to the DeepSeek model; the data centre location depends on which provider OpenRouter routes that request to. Every request tells OpenRouter not to use a provider that retains submitted data and not to use a list of China-based hosts (see Section 5). DeepL is EU-based; SpainTrades currently uses its standard API tier rather than DeepL Pro, which has stronger contractual data-handling terms.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The date of the most recent update is shown at the top of this document.
13. Trade Guide Emails to Businesses Listed on Google Maps
We send a series of eleven free guide emails, over about a month, to tradespeople whose business details are publicly listed on Google Maps. The last email invites you to create a SpainTrades profile if you would like one.
- Where your data comes from — your business’s public name, email address and phone number, and its trade and town, are taken from your public Google Maps listing. We did not collect them from you directly.
- Purpose — only to send you this series of free guides and to invite you to create a SpainTrades profile. We do not sell these details or share them for anyone else’s own use.
- What we record about the emails — when each email was sent, whether it was opened (our email provider reports the first time it is opened), and which guides you downloaded. We use this only to see which emails are useful and to improve the series.
- Legal basis — our legitimate interest in introducing useful, free information to local businesses (GDPR Article 6(1)(f)), weighed against your interests. Every email tells you where we got your details and gives you a one-click way to stop.
- Who receives it — our email provider Resend (see Section 5), and no one else.
- How long we keep it — for as long as the series runs. If you unsubscribe or the address bounces, we delete your name, trade, town and phone number within 30 days and keep only an irreversible hash of your email address on a suppression list, so that we do not write to you again. We keep a minimal record of why you were contacted (a hash of your email address, the date and the source) for 24 months. If you finish the series without joining, we delete your data 12 months after the last email.
Your right to object and to delete. You can object to this processing and have us stop at any time: reply NO to any of the emails, use the “pulsa aquí / click here” link at the bottom of every email, or write to hello@spaintrades.es. We stop straight away. You can also ask us to delete your data, to give you a copy of it, or to correct it, and we will reply within 30 days. See Section 8 for all your rights, including the right to complain to the AEPD.
14. Contact Us
Email: hello@spaintrades.es
Website: www.spaintrades.es
Address: Calle Santiago 7, 29313 Villanueva del Trabuco, Málaga, Spain
Data Protection Authority: Agencia Española de Protección de Datos (AEPD)