Last updated: September 29, 2026
This page explains what personal data loor.es processes, for what purposes, for how long, and what you can do about it. The website has no forms, user registration, or open comments: data comes in when you write or call, when you accept statistics in the cookie banner and, in part, simply because you visit it.
Controller
The controller is Manuel Suárez Gutiérrez, a self-employed professional, with tax ID (NIF) 28823485T and address at Calle Carranza 6, 28004 Madrid. For any privacy matter, the email address is info@loor.es.
Summary
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact by email or phone | Name, email address, phone number, and whatever you say in your message | Replying, preparing quotes, and managing commissions | Your request for a quote or the commission (Art. 6(1)(b) GDPR); legitimate interests in answering other inquiries and people who write on behalf of a company (Art. 6(1)(f) GDPR); tax and commercial obligations (Art. 6(1)(c)) | One year from the last message if there is no commission; if there is one, for as long as it lasts and then six years from the last entry in the accounting books |
| Visit statistics | Random identifier, pages viewed, time with the page in the foreground, scrolling, clicks on email, phone, and external links, device, approximate location | Understanding how the website is used | Your consent (Art. 6(1)(a) GDPR) | 14 months |
| Loading Google Tag Manager | IP address and technical browser data | Having the tag manager loaded, which activates analytics only if you accept it | Legitimate interests (Art. 6(1)(f) GDPR) | According to Google, HTTP request logs are deleted within 14 days; diagnostics are aggregated |
| Serving and protecting the website | IP address, requested page, date and time, browser | Making the website work, load fast, and stay protected | Legitimate interests (Art. 6(1)(f) GDPR) | IONOS keeps access logs for a maximum of 8 weeks, with the IP address anonymized; Cloudflare does not publish a period, and its criterion is explained under «Serving and protecting the website» |
| Google fonts | IP address and technical browser data | Displaying the website with its fonts | Legitimate interests (Art. 6(1)(f) GDPR) | The website does not keep it; what Google retains is set out in its policy |
Each processing activity is described in detail below.
If you write or call
When you write to info@loor.es, call +34 659 891 684, or send a message on Instagram or LinkedIn, the data you provide is processed: your name, your email address or phone number, the content of the message, and anything you attach, such as briefs, references, or files. You are not required to provide any data, but without an email address or a phone number it is not possible to reply to you.
The data is used to reply to you, to prepare a quote and, if a commission follows, to manage and invoice it. If you ask for a quote or for information about work for yourself, the legal basis is taking steps at your request prior to entering into a contract and, if there is a commission, the contract (Article 6(1)(b) GDPR). If you write on behalf of a company or for another reason, the legal basis is the legitimate interests in answering whoever writes and in maintaining the relationship with the company you represent (Article 6(1)(f) GDPR and, for professional contact details, Article 19 of Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, LOPDGDD). Invoices and commission documents are kept because tax and commercial law require it (Article 6(1)(c) GDPR).
If the conversation does not lead to a commission, the messages are deleted one year after the last one. If there is a commission, the data is used for as long as it lasts. After that, only the invoices, the accepted quote, and the correspondence about the commission are kept, for six years from the last entry made in the accounting books, which is the period that Article 30 of the Spanish Commercial Code sets for the documents of a business. During that time they are blocked: they are not used for anything else and would only be made available to judges, courts, or authorities that request them. When the period ends, they are destroyed (Article 32 of the LOPDGDD).
The email is hosted by IONOS Cloud S.L.U., which is a processor. Messages on Instagram and LinkedIn are also processed by Meta and LinkedIn under their own privacy policies.
Visit statistics
If you accept analytics cookies in the cookie banner, the website measures visits with Google Analytics 4, loaded through Google Tag Manager. If you do not accept analytics, Google Analytics does not record your visit; what Google Tag Manager does in that case is explained at the end of this section.
With your consent, the following is collected: a random identifier stored in a cookie in your browser, the pages you visit and when, the page you came from, the type of device and browser, and the approximate city and country. The time during which the page is in the foreground is also recorded, as is whether you scroll almost to the end (90% of its height), when you click an email or phone link, and when you click a link that leads to another website, such as Instagram or LinkedIn. For the clicks measured, the address of the link clicked may also be sent. The identifier does not include your name or email address, but it allows your browser to be recognized from one visit to the next, so the data is pseudonymous.
Visits to loor.es are measured in the same Google Analytics property as visits to manuelsuarez.es, which has the same owner.
Accepting analytics does not authorize any advertising use. Through its consent mode, the website tells Google that storage and use of data for advertising purposes are denied (the ad_storage, ad_user_data, and ad_personalization signals).
Google states that, for visitors from the European Union, Google Analytics uses the IP address only to derive approximate location and discards it without logging it (EU, Switzerland, or UK-focused data and privacy).
The legal basis is your consent (Article 6(1)(a) GDPR and Article 22(2) of Law 34/2002 on information society services and electronic commerce, LSSI). You can withdraw it at any time with the cookie settings button that appears in a corner of the screen after you choose, or with the «Cookie settings» link in the footer of the website. From that moment on, the website stops measuring your visits.
Google Analytics keeps the data about your visits for 14 months. Data linked to your identifier is deleted 14 months after your last visit. Reports with aggregated figures, which do not allow anyone to be identified, may be kept longer. Google Ireland Limited provides the service as a processor. The website does not have the advertising features of Google Analytics (Google Signals) enabled and is not linked to Google Ads. The collection of user-provided data, including its automatic detection, is disabled in the Google tag and in the Google Analytics property.
Even if you do not accept analytics, Google Tag Manager is downloaded from googletagmanager.com when each page opens and may send Google technical diagnostics about the tags. Those requests communicate your IP address and technical browser data to Google; no cookie is set. About the diagnostics, the Tag Manager help says: «Google Tag Manager may collect some aggregated data about tag firing. This data does not include user IP addresses or any measurement identifiers associated with a particular individual.» According to the same page, data in standard HTTP request logs is «deleted within 14 days of being received.» The legal basis is the legitimate interests in having the tag manager loaded, which activates analytics only if you accept it (Article 6(1)(f) GDPR).
Serving and protecting the website
The website is hosted by IONOS Cloud S.L.U., and all visits first go through Cloudflare, Inc., which protects it against attacks and serves it faster. To serve each page, both receive your IP address, the address of the page you request, the date and time, and the type of browser. Cloudflare also hides email addresses in the page code so that spam programs cannot collect them, and your browser may send it technical reports when a connection fails.
The legal basis is the legitimate interests in keeping the website available and secure (Article 6(1)(f) GDPR). IONOS is a processor and, according to the IONOS help on log files, keeps access logs for a maximum of 8 weeks and anonymizes visitors’ IP addresses in them. According to its privacy policy, in effect since November 4, 2025, Cloudflare acts as a processor for visit logs and for the content that passes through its network, and in that role processes them according to the customer’s instructions (Section 6); it processes the data it uses to protect its own network as a controller. Cloudflare does not publish a retention period for visit logs. Its general criterion (Section 11) is to keep personal information for as long as corresponds to the business purposes set out in Section 3 of that policy or as long as needed to comply with its legal obligations.
Google fonts
The website’s fonts are loaded from Google Fonts. To download them, your browser connects to fonts.googleapis.com and fonts.gstatic.com, and Google receives your IP address and technical browser data. No cookies are set. The legal basis is the legitimate interests in displaying the website with its fonts (Article 6(1)(f) GDPR). Google processes that data under its own privacy policy.
Who receives the data
The data is not sold. It is processed on behalf of the owner by IONOS Cloud S.L.U. (hosting and email), Cloudflare, Inc. (protection and delivery of the website), and Google Ireland Limited (statistics, only with your consent). If there is a commission, the invoice data is also processed, on behalf of the owner, by the tax advisory firm that files the owner’s taxes, and it is included in returns to the Spanish Tax Agency when the law requires it.
Google also receives your IP address and technical browser data when your browser downloads the fonts or the Tag Manager script, and processes them under its own privacy policy. If you write on Instagram or LinkedIn, Meta and LinkedIn process the message under their own policies.
The data would only be handed over to judges, courts, or other authorities when the law requires it.
Transfers outside the European Economic Area
Google may process statistics, fonts, and Tag Manager data in the United States through Google LLC. Cloudflare, Inc. is a U.S. company. Both participate in the EU-U.S. Data Privacy Framework (Google, Cloudflare), and the European Commission decided that this framework ensures an adequate level of protection in Implementing Decision (EU) 2023/1795, under Article 45 GDPR. For transfers that the framework does not cover, both apply the European Commission’s standard contractual clauses (Article 46 GDPR); in Cloudflare’s case, also if its participation in the framework lapses (Cloudflare data processing addendum, Section 6).
According to its data processing agreement (in Spanish), IONOS processes data in the European Union or the European Economic Area and only transfers it outside when necessary, with the safeguards of Articles 44 et seq. GDPR.
Your rights
No automated decisions that affect you are made with your data, and no profiles are built to make them (Article 22 GDPR).
You can request access to your data, its rectification or erasure, object to its processing, request the restriction of its processing, and request its portability. You can also withdraw any consent you have given at any time, without affecting the processing carried out before.
To exercise these rights, write to info@loor.es stating which right you want to exercise. If there are reasonable doubts about your identity, you may be asked to prove it. You will receive a reply within one month, which may be extended by two further months if the request is complex; in that case, you will be informed within the first month.
If you believe your data has not been processed properly, you can lodge a complaint with the supervisory authority, the Spanish Data Protection Agency (AEPD) (aepd.es).
Changes
If what the website does with data changes, this page will be updated and the date at the top will change.